The limits of confidentiality in psychiatry

Privacy is the default, and it's a strong one

The starting position is close to absolute. What a patient tells a psychiatrist is protected by professional ethics and, in the United States, by the HIPAA Privacy Rule. Psychotherapy notes get an extra layer of protection beyond the rest of the record. The profession takes this seriously because the work doesn't function without it. A person who's editing themselves isn't really in treatment.

So the exceptions matter precisely because they're exceptions. They're narrow, they're specific, and they're not a general license to share.

The duty that came out of Tarasoff

The best known exception traces to a 1976 California case, Tarasoff v. Regents of the University of California, which established that a therapist can carry a legal duty toward a person their patient threatens. It's usually shorthanded as the duty to warn. That shorthand is doing a lot of damage.

In California itself, the obligation is now framed as a duty to protect, not simply to warn. That distinction is practical, not academic. Warning is one way to discharge the duty. Hospitalizing the patient, intensifying treatment, or notifying police can be others. A clinician who believes the only available move is to phone the potential victim may be reaching for the most damaging option when better ones exist.

It's a patchwork, not a rule

Here's what most clinicians were never taught clearly. There is no single national Tarasoff rule. States took the case and went in different directions. A review in the Journal of the American Academy of Psychiatry and the Law mapped the variation and counted 29 states with a mandatory duty to warn or protect and 17 with a permissive one, meaning the clinician may break confidentiality without being liable for it but isn't required to. A few states offer no statutory or case law guidance at all.

The same paper makes a second point that should worry the profession more than it does: training on this is patchy. Clinicians routinely believe they're operating under a national standard that doesn't exist. If you practice across state lines, and telepsychiatry means many now do, your duty can change with the patient's zip code. Confirm the rule in the state where your patient physically is, and do it before you're standing in the middle of a crisis.

Mandatory reporting

Separate from any duty to protect, clinicians are mandated reporters. Suspected abuse or neglect of a child, and in most states of a vulnerable or elderly adult, has to be reported. The threshold is usually reasonable suspicion, not proof, and the obligation belongs to the clinician personally.

Courts can also compel records or testimony, though the protections here are stronger than people assume and a subpoena is not automatically the end of the argument. Records covered by federal substance use confidentiality rules carry their own, stricter regime.

What patients actually fear, and what's actually true

The question people are really asking is: if I say the frightening thing out loud, what happens to me. It's worth answering plainly, because the fear keeps people from saying the thing that would help them most.

Telling a psychiatrist you're having thoughts of suicide does not automatically trigger hospitalization or a broken confidence. Most of that conversation stays in the room, and most of the time it leads to a plan, not a police car. The threshold for acting is much higher than disclosure alone, and the clinician's first instinct is nearly always to work with you rather than around you. A profession that wants people to talk honestly owes them that clarity up front. For the patient-facing version of this, the Psychiatry Decoder explains what actually happens in the room.

If you're in crisis, call or text 988 in the US to reach the Suicide and Crisis Lifeline. If someone is in immediate danger, call 911.