Confidentiality

In your first session with her, six weeks ago, you said something you have said hundreds of times: what you tell me here stays here.

This afternoon she describes, without any sense that it matters, leaving her four-year-old alone while she works a night shift. She is not confessing. She is explaining her childcare problem.

You now have to tell her that a report may follow, and that what you promised in week one was never true. Whether the law requires that report depends on where you practise. The promise was the error, made long before this session, in a sentence that felt kind and cost nothing at the time.

Almost every confidentiality item is built on the same fault line. Candidates know the duty; what gets tested is its edge — what you may disclose, to whom, how much, under what authority, and what you should have said at the start.

Three words that are not synonyms. Privacy is the client's right to control access to information about themselves, and 1.07(a) tells you not to solicit private information without compelling professional reason. Confidentiality is your duty not to reveal what you learn inside the professional relationship. Privilege is narrower than either: a rule of evidence keeping certain communications out of legal proceedings. It belongs to the client, who can waive it where you cannot, and whether it exists at all depends on your jurisdiction and licence.

The default and its exception. You may disclose with the valid consent of the client or a legally authorised representative (1.07(b)). Absent that, 1.07(c) requires you to protect the information, with one general exception: disclosure necessary to prevent serious, foreseeable, and imminent harm to a client or others. Read the whole sentence: the attached limits are what items turn on — disclose the least amount necessary, and only information directly relevant to the purpose. A disclosure justified in principle can still be a violation because it went too wide. Standard 1.07(d) adds that you should tell the client beforehand where feasible and discuss the consequences.

When you explain the limits. Standard 1.07(e) requires discussing the nature of confidentiality and its limits as soon as possible in the relationship and as needed throughout — not once, buried in intake paperwork. This is the standard the opening scenario breaks. How those limits get disclosed belongs to informed consent; what they are is this lesson.

The limits themselves. Beyond client authorisation, the recurring ones are:

• Mandated reporting of suspected child abuse or neglect, and in most places abuse of older or vulnerable adults. Who is mandated, what triggers the duty, and how fast you must act are set by state law and differ meaningfully.
• Danger to others. The Tarasoff line of cases established that a therapist may owe a duty to a potential victim. Jurisdictions diverge sharply: some require warning an identifiable victim, some frame a broader duty to protect that hospitalisation can satisfy, some make disclosure permissive. There is no national rule, and an answer asserting one is wrong.
• Danger to self, where the risk meets the serious, foreseeable, and imminent threshold.
• Court orders, discussed below, and third-party payers, who need the client's authorisation (1.07(h)).

A subpoena is not a court order, and the difference is the whole point. A subpoena is typically issued by a party's attorney. It obliges you to respond; it does not authorise you to hand over a clinical record. A court order is signed by a judge and does compel production. Standard 1.07(j) tells you to protect confidentiality in legal proceedings so far as the law permits, and where a court orders disclosure that could harm the client, to ask the court to withdraw the order, limit it as narrowly as possible, or seal the records. Under the HIPAA Privacy Rule, responding to a subpoena unaccompanied by a court order requires satisfactory assurance that reasonable efforts were made to notify the client or obtain a protective order. Never ignore either document — silence risks contempt — and never treat a subpoena as permission.

HIPAA, PHI, and the idea of a floor. The Health Insurance Portability and Accountability Act of 1996 governs protected health information (PHI) — individually identifiable health information held or transmitted by a covered entity or its business associate, in any form, including spoken. A covered entity is a health plan, a clearinghouse, or a provider transmitting health information electronically in a standard transaction, so not every social worker in private practice is one. Covered entities may use and disclose PHI without separate authorisation for treatment, payment, and health care operations, and are otherwise held to a minimum necessary standard that does not apply to treatment disclosures between providers.

Two consequences matter more than the vocabulary. HIPAA is a floor, not a ceiling: where state law gives the client greater protection, that law controls. And the Code can demand more than HIPAA does — HIPAA permitting a disclosure does not make it ethical.

Psychotherapy notes are a distinct category: a mental health professional's notes analysing a counselling session that are kept separate from the rest of the record. Separation is the qualifying condition; notes filed in the chart are just the chart. The definition expressly excludes medication prescription and monitoring, session start and stop times, modalities and frequencies of treatment, test results, and any summary of diagnosis, functional status, treatment plan, symptoms, prognosis, and progress. They generally require their own authorisation.

Substance use records are stricter still. Federal regulations at 42 CFR Part 2 protect records from federally assisted substance use disorder programmes more tightly than HIPAA. A 2024 final rule aligned much of Part 2 with HIPAA — a single consent covering future treatment, payment, and operations, and matching breach notification and penalties — enforceable since February 2026.

Settings that complicate the duty. With families, couples, or groups, 1.07(f) requires you to seek agreement among participants about each person's right to confidentiality and duty to protect it, and to be explicit that you cannot guarantee anyone will honour it. Standard 1.07(g) requires stating your agency's policy on disclosure among them. Do not reveal identifying information when consulting or teaching unless the client consented or there is compelling need (1.07(u), (v)). The duty survives the client: confidentiality continues after death (1.07(w)).

The unglamorous half. Standard 1.07(i) forbids discussing confidential information where it can be overheard — the Code names hallways, waiting rooms, elevators, and restaurants. The rest of 1.07 covers secure storage, safe disposal, and safeguards if practice ends through closure, incapacity, or death (l, s, t); encryption, firewalls, and passwords for electronic communication (m); breach-notification policies and telling clients about unauthorised access (n, o); a stated policy on searching for clients online, which you should not do absent compelling professional reason (p, q); and a flat bar on identifying detail on professional sites or social media (r). The joint technology standards (NASW et al. 2017) develop the same ground.

Clients may see their records. Standard 1.08 gives clients reasonable access, with help interpreting it. Limit access only in exceptional circumstances, on compelling evidence of serious harm, and document the request and your reasons. Protect anyone else named in the record.

Items rarely ask whether confidentiality matters. They test the boundary: whether a disclosure is authorised, by what, and how much is allowed.

Expect the subpoena-versus-court-order distinction, and expect over-disclosure to be the trap — an option that discloses for a legitimate reason but reveals far more than the purpose requires. Expect an item where the right move is to talk to the client before disclosing; 1.07(d) makes that the default whenever feasible.

On duty to warn or mandated reporting, well-written items test reasoning rather than a local threshold, because the rules genuinely differ by state. Treat an option hinging on a specific number of hours or category of reporter with suspicion.

Watch the setting: a group or couple item usually tests whether you know you cannot guarantee other participants' silence; a hallway or shared office is testing 1.07(i), nothing more complicated.

Promising more confidentiality than you can deliver. The reassurance in the opening scenario is the most common real-world error here, and items reproduce it. Any option describing confidentiality as absolute, or having you assure a client nothing will ever be disclosed, is wrong.

Treating any official-looking document as authority. Subpoenas, insurer requests, employer enquiries, and police questions all arrive with an air of entitlement. Each prompts the same question — what authorises this disclosure? — and only client authorisation, a court order, or a specific legal duty answer it.

Disclosing correctly but excessively. Having concluded a disclosure is required, candidates stop reasoning and pick the option that shares the record. The duty to disclose the least amount necessary, and only what is directly relevant, survives every exception including mandated reporting.

Assuming HIPAA settles it. HIPAA is a floor. More protective state law, a stricter federal rule such as 42 CFR Part 2, and the Code itself can each require more.

• Privacy is the client's right; confidentiality is your duty; privilege is an evidentiary protection the client holds and can waive, varying by jurisdiction and licence.
• Disclose only with valid authorisation, or under 1.07(c) to prevent serious, foreseeable, and imminent harm — then only the least amount necessary and only what is directly relevant.
• Tell the client first where feasible (1.07(d)); explain the limits as soon as possible and as needed throughout (1.07(e)).
• Subpoena ≠ court order. Respond to both; comply only with the order. Ask the court to withdraw, narrow, or seal where disclosure would harm the client (1.07(j)).
• PHI: individually identifiable health information held by a covered entity, in any form. Not every social worker is a covered entity. TPO needs no separate authorisation; otherwise minimum necessary applies.
• HIPAA is a floor — more protective state law wins, and the Code may demand more than HIPAA permits. 42 CFR Part 2 guards substance use programme records more strictly still, enforceable as aligned since February 2026.
• Psychotherapy notes qualify only if kept separate from the record, exclude medication, session times, modalities, test results, and diagnosis/treatment/progress summaries, and need their own authorisation.
• Groups, couples, families (1.07(f), (g)): seek agreement, state agency policy, say plainly you cannot guarantee others will comply.
• After death, the duty continues (1.07(w)). No identifying detail in consultation or teaching without consent or compelling need (1.07(u), (v)).
• Client access (1.08): reasonable access with interpretation; limit only on compelling evidence of serious harm, and document it.

Sources used

• NASW. (2021). Code of ethics. Standard 1.07(a)–(w); standard 1.08.
• Reamer, F. G. (2015). Risk management in social work (3rd ed.).
• Barsky, A. E. (2023). Essential ethics in social work practice.
• NASW, ASWB, CSWE & CSWA. (2017). Standards for technology and social work practice.
• HIPAA Privacy Rule, 45 CFR Parts 160 and 164; psychotherapy notes at 45 CFR 164.501.
• Confidentiality of Substance Use Disorder Patient Records, 42 CFR Part 2.