Can a therapist share information without consent?

Yes, in the situations HIPAA permits, such as talking with a client's other providers for treatment, mandated abuse reports and preventing serious harm. State law and ethics codes often ask for consent where HIPAA doesn't, so check both.

What Information Can Be Shared Without Violating HIPAA?

If you're asking what information can be shared without violating HIPAA, the short answer for a therapist is: more than many clinicians think, and less than some callers will ask for. HIPAA's Privacy Rule is a list of permissions. Without a signed release, it lets you share a client's information for treatment, payment and running your practice, with family who are involved in care, for reports the law requires, and to prevent a serious and imminent threat. It also has firm limits: psychotherapy notes, the minimum necessary rule, and state laws that are often stricter than HIPAA.

Below you'll find each permission read from the regulation itself (45 CFR 164.502, 164.506, 164.508, 164.510 and 164.512) and from the HHS Office for Civil Rights (OCR) guidance on mental health. Then come 20 situations therapists face, each with the rule and the citation, a checklist to copy before any disclosure, and the moments to stop and call a lawyer. Every client in this article is invented.

The rule starts with a ban: a covered entity "may not use or disclose protected health information, except as permitted or required" by the Privacy Rule (45 CFR 164.502(a)). The permissions that matter in a therapy practice are:

To the client. You may share a client's information with the client, and you must give clients access to their record when they ask, with exceptions that include psychotherapy notes (45 CFR 164.524).
Treatment, payment and health care operations (45 CFR 164.506): coordinating with other providers, billing, supervision and running the practice.
Family, friends and others involved in care, limited to what their involvement needs (45 CFR 164.510(b)).
De-identified information, which isn't protected health information at all.
Required by law, including abuse and neglect reports (45 CFR 164.512(a) to (c)).
A serious and imminent threat to the client or someone else (164.512(j)).
Court orders, and subpoenas that meet conditions (164.512(e)).
Health oversight, such as a licensing board investigation (164.512(d)), and some law enforcement requests (164.512(f)).
Business associates that sign a Business Associate Agreement, such as your practice software (164.502(e)).
Incidental disclosures that happen despite reasonable safeguards (164.502(a)(1)(iii)).

Everything else needs the client's written authorization (45 CFR 164.508(a)(1)).

Two points shape the whole list. First, apart from a client's access to their own record and an HHS investigation, these are permissions, not duties. OCR says it plainly in one of its mental health FAQs: "The Privacy Rule permits, but does not require, providers to disclose information in these situations" (HHS FAQ on incapacity). You can always choose to ask the client first. Second, HIPAA is a floor. If your state requires consent where HIPAA doesn't, HHS says the Privacy Rule "presents no barrier to the entity's ability to comply with State law requirements" (HHS FAQ).

Run through these every time, on a phone call as much as in a letter.

Is it protected health information? If what's left after you remove identifying details meets HIPAA's de-identification standard, the Privacy Rule no longer applies to it.
Which permission covers it? Name it: treatment, payment, operations, family involvement, required by law, serious threat, legal process, or a signed authorization. If you can't name one, don't share.
Is there a stricter rule? Psychotherapy notes, substance use records under 42 CFR Part 2, your state's mental health law, your ethics code, and anything you promised in your consent form or Notice of Privacy Practices.
Who is asking, and how much do they need? If you don't know the person, check their identity and their authority to ask: HIPAA requires it for every disclosure except those to family and friends involved in care (45 CFR 164.514(h)). Then share only what the purpose needs.

Then write it down: who you told, what you shared, and the permission you relied on.

Treatment, payment and health care operations

Treatment covers more than your own sessions. HIPAA defines it as "the provision, coordination, or management of health care and related services by one or more health care providers, including the coordination or management of health care by a health care provider with a third party; consultation between health care providers relating to a patient; or the referral of a patient for health care from one health care provider to another" (45 CFR 164.501). A covered entity "may disclose protected health information for treatment activities of a health care provider" (164.506(c)(2)), and HHS adds that this includes "providers not covered by the Privacy Rule" (HHS, Uses and Disclosures for Treatment, Payment, and Health Care Operations).

So under HIPAA you may talk with a client's psychiatrist, primary care doctor or a hospital discharge team about their care, and make a referral, without a release. State law can be stricter, as the section on state law below shows. OCR's mental health FAQs go further: "HIPAA generally does not limit disclosures of PHI between health care providers for treatment, case management, and care coordination, except that covered entities must obtain individuals' authorization to disclose separately maintained psychotherapy session notes" (HHS, Additional FAQs on Sharing Information Related to Mental Health). The same document says a provider may share "the minimum necessary PHI" with a social service agency, such as a supportive housing provider, when it helps the client's care.

Payment covers claims, eligibility checks and medical necessity reviews with an insurer. Here the minimum necessary rule applies. One right matters for private-pay clients: if a client pays you in full for a service and asks you not to tell their health plan, you "must agree" to that restriction for payment and operations purposes, unless a law requires the disclosure (45 CFR 164.522(a)(1)(vi)). That right arrived with the 2013 HIPAA Omnibus Rule, which also tightened the rules on marketing and on selling health information.

Health care operations include quality review and "conducting training programs in which students, trainees, or practitioners in areas of health care learn under supervision" (164.501). Clinical supervision fits here.

You may collect a general consent for treatment, payment and operations if you want, but it can't stand in for an authorization when one is required (164.506(b)(2)).

De-identified information

Information that meets HIPAA's de-identification standard is "considered not to be individually identifiable health information," and the Privacy Rule's requirements "do not apply" to it (164.502(d)(2)). There are two ways to get there: remove all 18 listed identifiers for the client and their relatives, employers and household members, with no actual knowledge that what's left could identify them, or get an expert's determination (45 CFR 164.514(b)).

Therapy cases are hard to de-identify. A job, a town and an unusual event can point to one person even with the name gone. Our guide to the 18 HIPAA identifiers walks through the list, with a checklist for preparing a case for consultation, teaching or writing. If you keep a code that links the case back to the client, sharing that code counts as sharing protected health information (164.502(d)(2)(i)).

When the rule applies, you "must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request" (164.502(b)(1)). You also may not send "an entire medical record, except when the entire medical record is specifically justified" (164.514(d)(5)).

It does not apply to disclosures to a provider for treatment, to the client, under a signed authorization, or when the law requires the disclosure, among a few other exceptions (164.502(b)(2)). For requests from another covered entity, or from a public official who says the request is the minimum necessary, you may rely on the request as stated if that's reasonable (HHS, Minimum Necessary Requirement).

Your ethics code makes it broader. The NASW Code of Ethics asks social workers to "disclose the least amount of confidential information necessary to achieve the desired purpose" (NASW Code of Ethics, 1.07(c)). The ACA Code says that when disclosure is required, "only essential information is revealed" (ACA Code of Ethics, B.2.e). In practice: a letter confirming attendance dates instead of notes, a treatment summary instead of the chart.

Family and friends involved in care

HIPAA lets you share with "a family member, other relative, or a close personal friend of the individual, or any other person identified by the individual, the protected health information directly relevant to such person's involvement with the individual's health care or payment related to the individual's health care" (164.510(b)(1)(i)). How depends on whether the client is there:

The client is present and has capacity:you may share if the client agrees, if you give them a chance to object and they don't, or if you can reasonably infer from the circumstances that they don't object (164.510(b)(2)). A partner the client brings into the session is the usual example. HHS says a client's "agreement to participate in group therapy or family discussions is a good basis for inferring the individual's agreement" (HHS FAQ on group therapy).
The client isn't present, or can't agree because of incapacity or an emergency:you may share what is directly relevant if, in your professional judgment, it is in the client's best interests (164.510(b)(3)). OCR says this can include "temporary psychosis" or being "under the influence of drugs or alcohol," and that once the client regains capacity, you should offer them the chance to agree or object to future sharing (HHS FAQ on incapacity).
The client has capacity and says no:respect it, unless there is a serious and imminent threat and the family member can help prevent it (HHS FAQ).

OCR's examples are useful. If the client doesn't object, "A therapist may give information to a patient's spouse about warning signs that may signal a developing emergency." But "A nurse may not discuss a patient's mental health condition with the patient's brother after the patient has stated she does not want her family to know about her condition" (HHS FAQ on adult patients and family).

You can always listen. OCR: "HIPAA in no way prevents health care providers from listening to family members or other caregivers who may have concerns about the health and well-being of the patient" (HHS FAQ). And if a family member tells you something in confidence, you may later withhold it from the client's copy of the record if releasing it would likely reveal the source (164.524(a)(2)(v)).

A person with legal authority to make health care decisions for the client, such as a guardian or an agent under a health care power of attorney that is in effect, is the client's personal representative and is treated as the client (164.502(g)). That is a different and broader right than family involvement.

Serious and imminent threats, and your state's duty to warn

You may share information, "consistent with applicable law and standards of ethical conduct," if you believe in good faith that it "Is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public" and is shared with "a person or persons reasonably able to prevent or lessen the threat, including the target of the threat" (164.512(j)(1)(i)). That can be the person threatened, the police, a family member, a crisis team or the client's psychiatrist. It can include psychotherapy notes (164.508(a)(2)(ii)).

OCR gives clinicians wide room here. You are presumed to act in good faith when your belief rests on your own knowledge of the client or a credible report from someone else (164.512(j)(4)), and "OCR would not second guess a health professional's good faith belief that a patient poses a serious and imminent threat" (HHS, Additional FAQs). OCR's fact sheet for mental health professionals gives an example: a client who reports persistent images of harming their spouse. The therapist may notify the spouse, call the client's psychiatrist or primary care doctor, call 911 if emergency help is needed, or notify law enforcement (HHS, HIPAA Helps Mental Health Professionals to Prevent Harm).

HIPAA only permits the warning. Whether you must warn, whom you must tell and what protects you comes from state law, and "State laws vary as to whether such a warning is mandatory or permissible" (HHS FAQ). Two examples show the range:

California has a duty to protect. A psychotherapist can be liable for failing to protect only when "the patient has communicated to the psychotherapist a serious threat of physical violence against a reasonably identifiable victim or victims," and discharges the duty "by making reasonable efforts to communicate the threat to the victim or victims and to a law enforcement agency" (Cal. Civil Code 43.92).
Texas permits, and doesn't require. A professional may disclose "to medical, mental health, or law enforcement personnel if the professional determines that there is a probability of imminent physical injury by the patient to the patient or others," and "No exception to the privilege of confidentiality under Section 611.004 may be construed to create an independent duty or requirement to disclose" (Tex. Health and Safety Code 611.002 and 611.004). The Texas provision names medical, mental health and law enforcement personnel, not the person threatened, so it is narrower than HIPAA's permission.

Two more points. When a threat is real but not imminent, HIPAA still lets you ask family to help keep watch, if the client has had the chance to object and hasn't (HHS FAQ on duty to warn). And HIPAA doesn't require you to tell the client at the moment you warn someone, but OCR says your Notice of Privacy Practices "should contain an example of this type of disclosure so patients are informed in advance" (HHS, Additional FAQs). Your ethics code may ask you to tell the client when you can. For the clinical side of risk, see our safety plan template.

Abuse and neglect reports

HIPAA permits reports of child abuse or neglect to "a public health authority or other appropriate government authority authorized by law to receive reports of child abuse or neglect" (164.512(b)(1)(ii)), and disclosures that a law requires, "limited to the relevant requirements of such law" (164.512(a)(1)). The duty itself is state law. "Mandated reporting laws require certain professionals to report child abuse and neglect concerns," and many states name social workers and health care professionals among them (Child Welfare Information Gateway, Mandated Reporting).

Reports about an adult victim of abuse, neglect or domestic violence are narrower. They are permitted when the law requires them, when the client agrees, or when a law expressly allows them and you believe the report is needed to prevent serious harm, with one more narrow case for a client who can't agree (164.512(c)(1)). After such a report you "must promptly inform the individual that such a report has been or will be made," unless that would put the client at risk of serious harm, or you'd be informing a personal representative you believe is responsible for the abuse (164.512(c)(2)). Many states have separate reporting laws for elders and dependent adults; check yours.

Court orders, subpoenas, police and licensing boards

A court order:you may disclose "only the protected health information expressly authorized by such order" (164.512(e)(1)(i)).
A subpoena not signed by a judge:"A subpoena issued by someone other than a judge, such as a court clerk or an attorney in a case, is different from a court order" (HHS, Court Orders and Subpoenas). Before you respond, HIPAA requires written assurance that the client was given notice and a chance to object, or that a qualified protective order was sought (164.512(e)(1)(ii) to (iv)). State privilege law usually adds its own barrier. Our article on psychotherapy notes vs progress notes has a step list for when a subpoena arrives.
Police:HIPAA allows disclosures under a court order or court-ordered warrant, a subpoena or summons issued by a judicial officer, a grand jury subpoena, or certain administrative requests, plus limited identifying details to help locate a suspect, fugitive, material witness or missing person (164.512(f)). A casual call asking whether someone is your client usually fits none of these, and your state's mental health law may allow less. Ask what the request rests on, and get it in writing.
Your licensing board:health oversight covers "licensure or disciplinary actions" (164.512(d)(1)), and psychotherapy notes may be disclosed for oversight of the therapist who wrote them (164.508(a)(2)(ii)). Call your liability insurer before you respond.

Disclosures under 164.512, such as responses to subpoenas and court orders, abuse reports and oversight requests, are ones a client can ask you to list in an accounting of disclosures. Disclosures for treatment, payment and operations, to the client, under an authorization, or to family involved in care are exempt (45 CFR 164.528). Our release of information form article has a disclosure log you can copy.

Psychotherapy notes need their own authorization

Psychotherapy notes are notes "documenting or analyzing the contents of conversation" during a session that are "separated from the rest of the individual's medical record" (164.501). You "must obtain an authorization for any use or disclosure of psychotherapy notes," with narrow exceptions (164.508(a)(2)):

Your own use in treating the client.
Your practice's own supervised training programs.
Defending yourself in a legal action the client brings.
Disclosures to HHS, those required by law, oversight of the notes' author, to a coroner or medical examiner, and to prevent a serious and imminent threat.

That includes another treating provider. OCR: the rule requires an authorization "prior to a disclosure of psychotherapy notes for any reason, including a disclosure for treatment purposes to a health care provider other than the originator of the notes" (HHS FAQ). Parents have no HIPAA right to a copy of a child's psychotherapy notes either (HHS FAQ). Progress notes are part of the record and follow the ordinary rules.

Minors and parents

A parent is usually a minor's personal representative and can see the record and authorize disclosures. HIPAA leaves the age of majority and parents' authority to state law (HHS FAQ). The parent is not the personal representative for a service when (164.502(g)(3)(i)):

the minor consents to it, no other consent is required by law, and the minor hasn't asked for the parent to be treated as the representative;
the minor may lawfully get it without a parent's consent, and the minor, a court or another person authorized by law consents; or
the parent agrees to a confidential relationship between you and the minor.

HHS's example of the first: "A State law provides an adolescent the right to obtain mental health treatment without the consent of his or her parent, and the adolescent consents to such treatment without the parent's consent" (HHS, Personal Representatives).

State law then decides in both directions. Where it permits or requires telling the parent, you may; where it prohibits it, you may not. Where it is silent and the parent isn't the personal representative, a licensed professional decides about the parent's access, using professional judgment (164.502(g)(3)(ii)). On notifying a parent, OCR says that if state law lets the minor consent but "is silent on parental notification, the provider would need the child's permission to notify a parent" (HHS FAQ). You may also decline to treat a parent as the representative if you reasonably believe the parent has abused or neglected the child or could endanger them (164.502(g)(5)). The serious threat permission applies to minors too.

Set the terms at intake: what you'll share with parents, what stays private, and the safety exceptions, in writing. Our informed consent example has wording to adapt.

Substance use records and 42 CFR Part 2

Substance use disorder records can follow a second federal rule, 42 CFR Part 2. It covers a federally assisted program, meaning a person or unit that "holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment" (42 CFR 2.11), and federal assistance includes being a "Participating provider in the Medicare program" (42 CFR 2.12(b)). OCR: "Generally, the Part 2 rules provide more stringent privacy protections than HIPAA, including in emergency situations" (HHS, Additional FAQs). The 2024 update, with a compliance date of February 16, 2026, allows one consent for all future treatment, payment and operations disclosures and created "SUD counseling notes" that need their own consent (HHS, Fact Sheet 42 CFR Part 2 Final Rule). Whether a general therapy practice is a Part 2 program depends on how it presents its services and its federal ties; ask a lawyer before you assume either way.

State law and your ethics code can be stricter

A state law that "relates to the privacy of individually identifiable health information and is more stringent" than HIPAA stays in force (45 CFR 160.203(b)). Texas shows how that works: its mental health statute says a professional "may disclose confidential information only" for the purposes it lists. Many states have a mental health confidentiality law like it.

Ethics codes can be stricter too. HIPAA lets you send claims information to an insurer without a release, but the ACA Code of Ethics says "Counselors disclose information to third-party payers only when clients have authorized such disclosure" (B.3.d), and that counselors disclose information "only with appropriate consent or with sound legal or ethical justification" (B.1.c). That is one reason many therapists get a signed release before any outside conversation, even one HIPAA allows.

What needs a signed authorization

Unless one of the permissions above applies (a court order, for example), these need the client's signed authorization:

Psychotherapy notes, outside the narrow exceptions above.
A client's lawyer, employer, school, union, or a life or disability insurer.
Family members who aren't involved in care, or anything beyond what their involvement needs.
Testimonials, and replies to online reviews that confirm someone is a client (164.508(a)(1)).
Marketing (164.508(a)(3)).
An identifiable case in a talk, a book, a training or a post.
Any sale of health information (164.508(a)(4)).
Anything you can't match to a specific permission.

Use a form with every element of 164.508(c); our release of information template has them all. For what goes wrong when this step is skipped, see our HIPAA violation examples from real enforcement cases.

1. Can I tell a client's psychiatrist how therapy is going? Under HIPAA, yes. That's treatment (164.506(c)(2)), and minimum necessary doesn't apply to a provider for treatment. Don't send psychotherapy notes without an authorization. Check your state's law, and consider asking the client anyway.

2. Can I discuss a case with a colleague or my consultation group? Consulting another provider about a client's care is treatment (164.501), and supervision is health care operations. For a peer group whose members aren't treating the client, de-identify the case first.

3. A client's mother calls about her 24-year-old son, my client. You can listen. You can share only what's relevant to her involvement, and only if your client agreed or didn't object when given the chance, or can't decide and it's in his best interests (164.510(b)), or a serious and imminent threat applies (164.512(j)). Confirming that he's your client is itself a disclosure, so without his permission, say you can't confirm who is or isn't a client.

4. A parent of my 15-year-old client asks what we talk about. Usually the parent is the personal representative, but not if state law let the teen consent alone or the parent agreed to confidentiality (164.502(g)(3)). Then state law and your judgment decide. Go back to what you agreed at intake.

5. A divorced parent asks for a child's records. Personal representative status follows legal authority to make health care decisions, so ask for the custody order and check state law before you send anything. Call a lawyer if the order is unclear.

6. My client's partner joins the end of the session. If the client brought them in and doesn't object, you may infer agreement (164.510(b)(2)(iii)). Keep to what the partner needs to know.

7. A client at risk stops coming and doesn't answer. OCR says you may contact a family member if you judge there may be an emergency and contacting them is in the client's best interests, or to lessen a serious and imminent threat, even if the client earlier said not to, sharing only what's needed (HHS, Additional FAQs).

8. A client says they're going to hurt a coworker. HIPAA permits a warning to anyone reasonably able to prevent the harm, including the coworker (164.512(j)(1)(i)). Your state decides whether you must warn and how. Consult, act, and document your reasoning.

9. A client describes abuse of a child. If your state names you as a mandated reporter, report to the agency the law names, with what the law requires (164.512(a) and (b)(1)(ii)).

10. A client tells me about a violent crime they committed years ago. HIPAA's permission to tell police about an admitted violent crime does not apply to information learned in "counseling or therapy" (164.512(j)(2)). Without a current threat, a law that requires a report, or legal process, HIPAA gives you no basis to tell anyone. Call a lawyer before doing anything.

11. A subpoena arrives from the other side's attorney in a divorce. It isn't a court order. Don't send records until the 164.512(e) conditions are met and you've checked state privilege. Contact your client and your lawyer or insurer first.

12. A judge signs an order for records. Send only what the order expressly covers (164.512(e)(1)(i)). Ask your lawyer whether to request that the judge review sensitive material privately first.

13. A police officer calls asking whether someone is my client. Don't confirm on the phone. Ask what the request rests on (a court order, a warrant, a judicial subpoena) and for it in writing, and call your lawyer. A serious and imminent threat is the exception (164.512(f) and (j)).

14. An insurer asks for records for a medical necessity review. That's payment: send what the review needs, not the whole chart (164.502(b)). Psychotherapy notes need an authorization. If the client paid in full and asked you not to tell the plan, you must honor it (164.522(a)(1)(vi)).

15. A client's lawyer, employer or school asks for a letter. You need the client's signed authorization (164.508). Share only what the form lists.

16. A client asks for a copy of their own records. You must act on the request within 30 days, with one 30-day extension if you tell the client why (164.524(b)(2)). Psychotherapy notes are excluded from the right of access, and state law may set a shorter deadline.

17. My licensing board asks for records. Health oversight is permitted (164.512(d)). Call your liability insurer and follow the board's process.

18. A client has died, and their sister asks what they talked about. If the sister was involved in the client's care, you may share what's relevant to that involvement, unless the client expressed a different wish (164.510(b)(5)). The estate's executor or administrator is the personal representative (164.502(g)(4)). HIPAA protects the record for 50 years after death (164.502(f)).

19. Can I send appointment reminders? Yes. "Appointment reminders are considered part of treatment" (HHS FAQ). Keep messages short: time and your name, not the reason for the visit.

20. Can I post a client's thank-you note on my website? Not without a signed authorization. A testimonial confirms that someone is your client.

Paste this into your notes or print it for the desk by your phone.

Before i share client informationTemplate · 4 parts to fill in

BEFORE I SHARE CLIENT INFORMATION

Who is asking:How I checked who they are:What they want:Why they want it:

Is it PHI?YesNo, it is de-identified

Permission I am relying on:Treatment (164.506)Payment (164.506)Health care operations (164.506)Family or friend involved in care (164.510(b))Required by law, incl. abuse report (164.512)Serious and imminent threat (164.512(j))Court order or valid legal process (164.512(e)/(f))Signed authorization dated:None: do not share

Stricter rules checked:Psychotherapy notes excludedSubstance use records (Part 2)State mental health lawEthics codeWhat my consent form promised

Client told before sharing: [yes / no / why not]What I will share (minimum needed):How: [call / letter / secure email / portal]Added to disclosure log: [yes / no]Note written in client record: [date]

When to call a lawyer

Call a healthcare lawyer, or your liability insurer's risk line, before you act when:

A subpoena, court order, warrant or police request arrives.
A licensing board, an auditor or a government agency asks for records.
You're weighing a duty-to-warn disclosure and have time to consult.
Parents disagree, a custody order is unclear, or a teen and a parent want different things.
A client discloses a past crime.
Substance use records are involved and you're not sure whether Part 2 applies.
You think you've already shared something you shouldn't have.

In an emergency, act to keep people safe first and consult as soon as you can.

How this works in TranqBay

TranqBay is practice software for therapists in private practice: a practice website, online booking, video sessions, session notes and a form library in one place. Here is where it touches disclosure.

A release of information template in the form library.The library has ready-made templates you send to a client for a session, including intake, consent to treat, telehealth consent and release of information. The client fills them in online, and the answers wait with the session. Before you rely on any release as a HIPAA authorization, check it against the elements in 164.508(c); for psychotherapy notes, a lawyer, an employer or an insurer, use a signed authorization like the one in our release of information article.
A Business Associate Agreement.Video sessions are end-to-end encrypted and HIPAA-ready. TranqBay's BAA applies when you accept the Terms, with no separate document to sign. You can read TranqBay's Business Associate Agreement before you store any client information.

To see what a new client sees before the first session, look at a practice website template and the booking page on practice.tranqbay.health.

Questions to take to a healthcare lawyer

Bring these to a healthcare attorney licensed in your state. They are the points in this article that depend on your state, your license and your facts:

Does my state's mental health confidentiality law allow treatment disclosures to a client's outside psychiatrist or doctor without consent?
Is my state's duty to warn mandatory or permissive, who must I tell, and what discharges it?
Which professions are mandated reporters here, and do elder or dependent adult reporting laws apply to me?
At what age can a minor consent to therapy here, and what may I tell parents without the minor's agreement?
How do custody orders affect who can see a child's records?
What notice or court order does a subpoena for mental health records need here, and who holds the privilege?
Am I a 42 CFR Part 2 program?
Do my consent form and Notice of Privacy Practices describe the disclosures I actually make?
Does my online release of information meet HIPAA's authorization elements and state requirements?

Frequently asked questions about sharing information under HIPAA

What information can be shared without violating HIPAA?

For a therapist: information shared with the client, for treatment, payment and health care operations, with family involved in care (limited to their involvement), de-identified information, reports the law requires, disclosures to prevent a serious and imminent threat, and responses to court orders or legal process that meets HIPAA's conditions. Everything else needs a signed authorization.

Can a therapist talk to my family?

Only about what's relevant to their involvement in your care, and only if you agree or don't object when given the chance, or if you can't decide for yourself and it's in your best interests, or to prevent a serious and imminent threat. A therapist can always listen to family.

What is the minimum necessary standard under HIPAA?

A rule that you limit what you share, use or request to what the purpose needs. It doesn't apply to disclosures to another provider for treatment, to the client, under an authorization, or as required by law.

When does a therapist have to break confidentiality?

When a law requires it: mandated abuse reports, a court order, and in some states a duty to warn or protect. HIPAA permits these disclosures; the duty comes from state law.

Does HIPAA apply to de-identified information?

No. Information de-identified under 164.514 is not protected health information. But a therapy case is easy to recognize, so de-identify with care.

Do I need a release to send records to another therapist?

Not for progress notes and other record content shared for treatment, under HIPAA. You do for psychotherapy notes, and many states and ethics codes expect consent anyway.

Before the next call

Keep the checklist by the phone, put your limits of confidentiality in your consent form, and write a note each time you share. Many disclosure mistakes start with a quick answer to a caller, not a considered decision.

If you'd like booking, video sessions, notes and client forms in one place, see how TranqBay works for private practice: you can look at a practice website template and the booking page your clients would use. If you're deciding whether to join, this page explains how joining TranqBay works.

Sources

29 sources

Regulations 12HHS 12States 2Associations 2Federal 1

Laws and regulations12

U.S. Department of Health and Human Services12

State boards and laws2

Professional associations2

Other federal agencies1

29Child Welfare Information Gateway: Mandated Reportingchildwelfare.govhttps://www.childwelfare.gov/topics/safety-and-risk/mandated-reporting/

Updated October 25, 2026. Found it useful? Send it to a colleague.