August 4, 2026
12 min read
By Albert Wong, PhD · Clinical Psychologist
The short answer
Confidentiality has a small, well-marked set of exits, and nearly all of them exist to protect somebody's life or a legal process: suspected abuse or neglect of a child (and, in most states, of elders and dependent adults) triggers mandatory reporting; a serious threat of violence against an identifiable person triggers a duty to protect in most states — mandatory in some, permitted in others, with the specifics set by state law; imminent danger to self permits the disclosures needed to keep the client safe; a signed release lets you share what the client authorizes; and courts can compel records — though a subpoena from a lawyer is not the same thing as a court order, and responding to one without analysis is one of the most common confidentiality mistakes in practice. Everything else — insurance claims, supervision, practice operations — runs on HIPAA's ordinary rules and the consent conversation you had at intake. When an exception applies, disclose the minimum necessary, and document what you decided and why.
Every therapist has felt the room change. A client is halfway through a sentence and suddenly you're not just listening anymore — you're triaging. Did that cross the line? Which line? Whose line? The client keeps talking. Some part of you is now riffling through a filing cabinet labeled "things they taught me once, in one lecture, years ago."
That filing cabinet deserves better organization, because the stakes run in both directions. Disclose when you shouldn't and you've broken the promise the whole profession stands on. Stay silent when the law required you to speak and you may share responsibility for what happens next — and face your licensing board either way. So here's the working map: the exits from confidentiality, what each one actually requires, and the habits that keep a hard moment from becoming a career moment.
Confidentiality isn't a courtesy; it's the working condition of therapy. People say true things in your office precisely because those things stop at the door. The law protects that expectation strongly — and then carves exits for the narrow situations where secrecy would cost more than it protects: a child being harmed, a life in danger, a court that cannot decide a case without the facts. Every exit below follows that logic. If you're ever unsure whether a situation qualifies, the logic itself is a decent compass — and your state's specific statute is the map.
Every U.S. state makes therapists mandated reporters of suspected child abuse or neglect, and most extend similar duties to elders and dependent adults. Three things about this exit trip people up:
The famous one. After Tarasoff v. Regents (California, 1976), most states adopted some version of a duty to protect identifiable third parties from a client's serious threat of violence — but the implementations differ in ways that matter:
Two practical notes. First, the threshold is a serious threat against someone identifiable — general hostility, dark fantasies discussed reflectively, or anger at "everyone" typically doesn't trigger the duty, and treating it as if it did harms treatment without protecting anyone. Second, when the duty does trigger, the response is calibrated, not maximal: the statute tells you who may be told what. This is the moment for a documented consultation with a colleague or your malpractice carrier's risk line — same day, noted in the chart.
Suicidality by itself is not a confidentiality exit — it's the daily work of the profession, managed inside the frame: safety planning, means restriction conversations, measurement, higher levels of care. The exit opens when risk becomes imminent and managing it requires other people: initiating an involuntary hold, calling emergency services, or involving family the client hasn't authorized. HIPAA permits disclosures to prevent a serious and imminent threat, and state laws provide the hospitalization machinery. The professional standard is proportionality — disclose to the people necessary, the information necessary, for the time necessary — and the protective habit is documentation that shows your risk assessment, the options you weighed, and why you chose what you chose. A crisis handled well and documented poorly looks, years later, exactly like a crisis handled poorly.
Here's the exit where careful therapists get hurt, because it arrives looking official. A subpoena is frequently just a demand letter drafted by an attorney — it deserves a response, but it does not by itself authorize you to hand over a therapy record. A court order — signed by a judge — can. The practical protocol:
Most real-world disclosure isn't dramatic at all. A signed release lets you coordinate with the psychiatrist. HIPAA's treatment-payment-operations provisions let you file the insurance claim, run the billing, and consult with a supervisor — with the minimum necessary standard governing how much travels (a claim needs a diagnosis and a code, not a narrative). Two habits keep this lane clean: an informed consent at intake that names the limits of confidentiality in plain language — so none of the exits above ever comes as a betrayal — and de-identification anywhere content flows for non-treatment purposes. When a minor is the client, the map gains a layer: parents generally hold the record rights, but many states carve out adolescent-consented services (and thoughtful clinicians negotiate explicit house rules with the family at intake about what stays in the room).
Every exit above ends the same way: a note. What you observed, what standard you applied, who you consulted, what you disclosed to whom, and why that disclosure was the minimum that met the duty. Boards and courts judge process, and the note is the only evidence your process existed. Make the note easy to write and it gets written — this is where good records software quietly becomes a risk-management tool, keeping progress notes, separate process notes, releases, and consent documents where they belong and timestamped.
The necessary caveat, stated plainly: this article is education, not legal advice, and confidentiality law is genuinely state-specific. Your state statute, your licensing board's guidance, and your malpractice carrier's risk-management line (free with most policies, and glad to hear from you before you act) are the authorities for a real situation. The consultation call is never the weak move — it's the documented, professional one.
And when the room changes mid-sentence — it will again — you'll have a map instead of a filing cabinet: abuse gets reported, serious threats get the statute's response, imminent danger gets the minimum disclosure that keeps someone alive, lawyers get analysis before records, and everything gets a note. The promise holds better when you know exactly where its edges are.
Practice Harbor keeps the record straight — progress notes, consent documents, releases, and risk documentation, organized and timestamped, with AI drafting that de-identifies before anything leaves the chart. Built by a practicing psychologist. Free for pre-licensed clinicians, $19/mo licensed.
The mandatory situations in most U.S. states are: reasonable suspicion of abuse or neglect of a child (and in most states, elders and dependent adults), which must be reported to the designated agency on a short statutory timeline; and, in states with a mandatory duty to protect, a serious threat of physical violence against a reasonably identifiable person, which requires the statutorily specified response such as warning the victim or notifying law enforcement. A judge’s court order compelling records must also be obeyed. Other exits — imminent danger to self, permissive duty-to-protect states — allow disclosure without mandating it.
Not by itself. A subpoena signed only by an attorney is a formal demand that deserves a timely response, but it does not override therapist–client privilege the way a judge’s court order does. The standard protocol is: never ignore it, never simply comply — notify the client (the privilege is theirs to waive in writing), contact your malpractice carrier or an attorney, and often assert privilege until a judge rules. Releasing records in response to a bare subpoena, without client authorization or a court order, is one of the most common confidentiality violations in practice.
Suicidal ideation by itself is normally handled within confidentiality through safety planning and clinical care. When risk becomes serious and imminent, HIPAA and state laws permit the disclosures necessary to protect the client — contacting emergency services, initiating an involuntary hold evaluation, or involving family members — under a minimum-necessary standard: tell the people needed, only what they need, for as long as the emergency lasts. The clinical record should document the risk assessment, the options considered, any consultation, and the rationale for what was disclosed.
Progress notes — the official medical record with diagnoses, dates, and treatment summaries — can be reached by payers for claims and audits and by courts through proper legal process. Psychotherapy notes (process notes) receive extra protection under HIPAA when they are kept separate from the medical record: they require the client’s specific authorization for nearly any release and are generally excluded from routine insurance disclosures. That protection depends on actually maintaining them as a separate document set rather than mixing process material into progress notes.