Abnormal Psychology

Ethical and Legal Issues 719

Limits of Confi dentiality: HIPAA in Action

Congress passed the Health Insurance Portability and Accountability Act in 2002

(HIPAA; U.S. Department of Health and Human Services, 2002), and in doing so

widened the set of circumstances under which confi dential information could be

shared with other individuals and organizations participating in the care or moni-

toring of a patient. No longer was the patient’s permission to share information

with other health providers legally required. HIPAA does recognize the special

nature of psychotherapy provided by a mental health clinician, however; patients

must provide written consent before clinicians can share notes from their psycho-

therapy sessions. Without a patient’s consent, the clinician can share only limited

information—such as the dates of treatment, the patient’s diagnosis and prognosis,

and the medications prescribed—with other people or organizations involved in the

treatment or monitoring of the patient.

Through HIPAA, patients lost an element of control over the distribution of

their health records (Appelbaum, 2002). The circumstances under which health care

information can be shared without a patient’s consent (or even without the patient’s

being told about it) now include the following (U.S. Department of Health and Hu-

man Services, 2002):

1.During litigation. The opposing lawyer in a lawsuit can request health information

from a provider and must only state that he or she made reasonable attempts to

notify the patient about the request for information. During litigation, lawyers

can even request the medical records of witnesses!

2.When the person is a police suspect. Police offi cers can request health information

about a suspect without having a warrant or being under any judicial oversight.

3.Marketing efforts by health providers (and their business associates) to patients.

For instance, if a community mental health center were initiating a variety of

therapy groups, for people with depression, social phobia, and ADHD, the cen-

ter would be able to send a brochure about the groups to patients currently

receiving treatment at the facility.

4.Research. When investigators have approval for a study that uses patients’ med-

ical records, the investigators may have access to those records without the pa-

tients’ explicit permission.

However, unless the sharing of information is specifi cally to facilitate treatment,

the law specifies that the provider should disclose only the minimum necessary

information.

Legal Restrictions on Confi dentiality

States usually have laws to protect confi dentiality. However, most states have excep-

tions to those rules. Typically, confi dentiality can be violated in certain situations:

• when a patient gives the clinician permission to violate confi dentiality, for exam-

ple by explicitly giving permission to a therapist to speak to the patient’s spouse;

• when a clinician has reasonable cause to suspect abuse of children, the elderly, or

the disabled (in such cases, the clinician usually must report the suspected abuse

to the appropriate authorities so that steps can be taken to protect those who can-

not otherwise protect themselves);

• when a clinician has reasonable cause to believe that a patient is likely to harm

himself or herself signifi cantly or attempt suicide (in this situation, the clinician

must take steps to protect the patient); and

• when a clinician has good reason to believe that a patient is likely to infl ict signifi -

cant harm on a specifi ed other person (in this case, the clinician must take steps to

protect that other person).

Thus, a clinician should not have violated Goldstein’s confidentiality if he

spoke in generalities about his violent urges. Even if Goldstein had said that he had

Confi dentiality

The ethical requirement not to disclose

information about a patient (even whether

someone is a patient) to others unless legally

compelled to do so.