Trends in Confidentiality and Disclosure

A third-party interest of particular concern to psychiatrists is the well-being of identified targets of potential patient violence. This complex issue is pivotally linked to the California case of Tarasoff v. Regents of the University of California (11). The Tarasoff case stemmed from the murder of 20-year-old Berkeley student Tatiana “Tanya” Tarasoff by graduate student Prosenjit Poddar. Tarasoff had reportedly rebuffed Poddar’s romantic advances, and he had a “severe emotional crisis” (13). Poddar voluntarily entered the care of Dr. Lawrence Moore, a psychologist at the University of California, Berkeley, Cowell Memorial Hospital and confided in Moore that he had homicidal thoughts toward Tarasoff. Although Moore contacted the campus police and Poddar was questioned, neither Moore nor his supervisor, Dr. Harvey Powelson, took further steps to protect the intended victim. Two months later, on October 27, 1969, Poddar stabbed Tarasoff to death. (Poddar was convicted of second-degree murder, served five years in prison, and was eventually deported to India; he later married and pursued a Ph.D. in naval architecture in Germany.) Tarasoff’s parents brought a civil action against Moore, Powelson, and their employer. The question that eventually reached the California Supreme Court was what duty of care, if any, existed between the providers and the nonpatient victim.

The initial 1974 court decision in the case (known as Tarasoff I) established a duty to warn specifically identifiable third-party targets. However, a 1976 rehearing (Tarasoff II) replaced this duty to warn with a duty to protect such potential victims. (The distinction here is that warning merely involves notifying third parties directly that they are at risk, whereas protecting means taking steps—such as involving law enforcement—to ensure their safety; the two are not mutually exclusive.) Justice Mathew Tobriner held for the court, “We conclude that the public policy favoring protection of the confidential character of patient-psychotherapist communications must yield to the extent to which disclosure is essential to avert danger to others. The protective privilege ends where the public peril begins” (11). (Although this was a novel ruling, its origins can be traced back to holdings in earlier “negligent release” cases such as Fair v. United States [1956] and Underwood v. United States [1966]) (14). An appellate court briefly reimposed a duty to warn in California from 2004 to 2006, but between 1976 and 2004, and again from 2007 onward, so-called Tarasoff duties in California have only required protection, not warning (15). Reasonable steps to protect a patient might include contacting appropriate authorities, hospitalizing the patient, or warning the intended victim (16). However, in certain circumstances—such as in cases of intimate partner violence—warning may prove insufficient to meet the protection standard. Precisely how much action must be taken by the psychiatrist will depend on both the specific circumstances of the case and the jurisdiction in which it occurs.

Tarasoff had a widespread legal and cultural impact. However, many jurisdictions responded with so-called Tarasoff-limiting statues to curtail physician liability, which softened its impact to some degree (17). As legal precedent, the case is only binding in California. Significant variation exists among state laws on the subject: Thirty-four states impose either a duty to warn or to protect (23 states by statute and another 11 by common law; 18). An additional 10 states and the District of Columbia permit voluntary disclosure (18). Six jurisdictions (Arkansas, Kansas, Maine, Nevada, New Mexico, and North Dakota) offer no legal guidance in such cases (18). Therapists face a particular bind in these jurisdictions because they “are open to significant legal risk no matter how they proceed: if they breach confidentiality, a patient could sue, and if they fail to breach confidentiality and a victim is harmed, the victim could sue” (18). States vary on the standards for foreseeability of future risk required to trigger a duty and also on how specifically the intended target must be identified in advance. For instance, in Almonte v. New York Medical College, the U.S. District Court for Connecticut found a psychiatrist liable for not disclosing the potential threat posed by a pedophile physician-in-training, even though no particular child had been individually named as a target (19). One controversial Washington State case, Volk v. DeMeerleer, expanded the obligation of the physician to take action to protect third parties from patients with dangerous propensities—even if they had not voiced any threats to others (20). However, this decision has been highly criticized (21).

Some states extend the duty beyond the psychiatrist to other physicians. State courts have taken “directly opposite positions in cases involving the duty to warn and protect,” and legislatures have imposed such duties after they have been rejected judicially, as did Virginia lawmakers after Nasser v. Parker (2006) repudiated Tarasoff (22). After a decade of rapid adoption and expansion subsequent to Tarasoff, the general trend at the state level has been a slow but steady retreat from extensive duties (14). Outcomes also appear to favor narrow obligations: Of 70 appellate-level breach-of-duty cases reported by Soulier and colleagues, only six favored the plaintiff (23).

Testimonial privilege refers to the legal right of an individual to “prevent the discovery or introduction in judicial proceedings of confidential relational communications” (24). Historically, Anglo-American common law has only recognized two such privileges—those between spouses and those between attorneys and clients. Although New York State enacted a physician-patient privilege by statute in 1828, and many jurisdictions followed, these protections were riddled with exceptions and were the subject of considerable criticism (25). During the 1960s, a campaign by the Group for the Advancement of Psychiatry called for the creation of a specific psychotherapist-patient privilege (25). Connecticut adopted such a law in 1961, and some form of the privilege is now recognized in every state (25). In the influential case of In re Lifschutz (26), California psychiatrist Joseph Lifschutz refused to turn over his records during a personal injury lawsuit and was briefly jailed. In a losing but well-regarded plea to the California Supreme Court, Lifschutz’s attorney (Sigmund Freud’s great-grandnephew, Nicholas) argued that forced disclosure would undermine his client’s relationships with his other patients, who could no longer be certain of their privacy, and was a violation of the equal protection clause because clergy did not face the same compulsion (16). Lifschutz himself later pointed out another argument for creating the privilege: The alternative was the unpalatable prospect of jailing noncompliant psychiatrists (27). The U.S. Supreme Court created a psychotherapist-patient privilege for the federal courts in Jaffee v. Redmond (12).

At dispute in Jaffee was the admissibility of psychotherapy notes taken by a social worker treating an Illinois police officer, Mary Lu Redmond, who was accused of using excessive and fatal force in breaking up a knife fight. The estate of Ricky Allen (represented by executor Jaffee) sought to admit these notes to impeach Redmond on cross-examination. Writing for a seven-two Supreme Court majority, Justice John Paul Stevens upheld such a privilege:

Effective psychotherapy . . . depends upon an atmosphere of confidence and trust in which the patient is willing to make a frank and complete disclosure of facts, emotions, memories, and fears. . . . For this reason, the mere possibility of disclosure may impede development of the confidential relationship necessary for successful treatment. (12)

Stevens distinguished psychotherapy from general medical care, in which physical examination and diagnostic tests can form the basis for treatment. (Although all states recognize a more general physician-patient privilege, such protections are not afforded in the federal courts.) In practice, the courts have interpreted psychotherapy as described in Jaffee to cover all interactions with a psychiatrist necessary for diagnosis or treatment of a patient (28). In other words, the distinction between talk therapy and medication management—while relevant as it pertains to psychotherapy notes under HIPAA—is not relevant to privilege under Jaffee. Both are generally protected. (In contrast, a social worker involved only in placement or logistics, rather than diagnosis or treatment, might not be.) In dissent, Justice Antonin Scalia noted the price of creating such a privilege: the loss of potentially probative evidence at trial that might lead to “occasional injustice” (12).

One key aspect of physician-patient privilege is that it is said to be held by the patient. Although therapists may assert the privilege on the patient’s behalf, they may not do so over a patient’s objections. Critics of this approach (including Lifschutz) have contended that the psychotherapist should be able to assert a therapeutic privilege to protect patients who “do not know what they are waiving” when, for example, revealing the unconscious fantasies exposed by projective tests (25, 29). In some (but not all) jurisdictions, psychotherapist-patient privilege survives the death of the patient (30); a Supreme Court ruling in Swidler & Berlin v. United States (31), finding a posthumous attorney-client privilege, implicitly raises the prospect that a federal psychotherapist-patient privilege may also extend beyond the grave. States vary on whether this privilege applies to group therapy—with some statutes explicitly extending protections and other silent. An Alaska Court of Appeals decision, Beaver v. State (32), held that “communications made by an adjudicated juvenile sex offender, Patrick Beaver, were admissible as evidence even though the statements were made during group therapy at a juvenile correctional facility” (30, 33). One unresolved question regarding the boundaries of privilege relates to the precise definition of psychotherapists. The Supreme Court in Jaffee referred specifically to psychiatrists, psychologists, and social workers doing psychotherapy, but other courts have extended the interpretation of psychotherapist under the Jaffee precedent to include those engaged in marriage counseling and “counseling on problems of alcohol dependency” through an employee assistance program, but not “statements . . . made to volunteer workers at an Alcoholics Anonymous office” (34). Similarly, the scope of psychotherapy itself remains indeterminate. For example, a defendant police officer’s postincident psychiatric debriefing has been found not to qualify (35).

Common-law actions for breach of confidentiality were recognized in Britain by the mid-19th century, but American case law has “taken a more circuitous route” (35). Early cases either addressed disclosures that were also defamatory or those justified by significant public policy concerns (36). Not until the 1980s did American courts broadly start to recognize breach of confidentiality and invasion of privacy claims in the physician-patient context (35). A watershed case was that of Humphers v. First Interstate Bank (37), in which the Supreme Court of Oregon upheld a tortious breach of confidentiality claim after a physician provided a patient’s biological daughter (who at birth had a closed adoption to another couple) with information that allowed the daughter to identify her biological mother (35). Several high-profile incidents added public impetus to the development of legal protections. In the case of Jane Doe v. Joan Roe and Peter Poe (38), a former patient of two New York psychotherapists sued after the pair “published a book that contained verbatim and extensive aspects of the patient’s thoughts, feelings, emotions, fantasies, and other biographical and diagnostic information” (16). In ruling for the plaintiff, the New York State Supreme Court rejected the argument that the scientific merits of the material justified publication. In 1991, Diane Wood Middlebrook penned a biography of Pulitzer Prize–winning poet Anne Sexton that relied on the contents of audiotapes recorded by Sexton’s psychiatrist, Dr. Martin Orne. Although Sexton had authorized the posthumous release of the tapes to her daughter, who later passed them along to Middlebrook, a public outcry over this supposed breach of privacy ensued (36). In 1995, the Los Angeles Times revealed the contents of extensive and nearly verbatim notes based on audio recordings that psychiatrist Ralph Greenson recorded of sessions with actress Marilyn Monroe, producing another backlash (39).

Before 1996, the protection of private health care information was largely left to the regulation of individual states. Although every state had “some statutes restricting the use and disclosure of medical information,” rare were those that had “taken a comprehensive approach” (40). Instead, most protections were “either condition specific or entity specific, leaving much information in the health care system uncovered” (41). Most states had specific confidentiality laws that applied to AIDS patients or public health data, but not more general protections. Oklahoma, for example, prevented disclosure by dentists and chiropractors but by not physicians or hospitals (40). One exception was the field of substance abuse treatment: The confidentiality of alcohol and drug abuse patient records has been protected since 1972 by specific federal regulations (42 C.F.R.) implementing sections of the Public Health Act. The enactment of HIPAA largely nationalized the regulation of physician-patient confidentiality and the protection of personal health care information (42). The HIPAA privacy rule was later modified by the Health Information Technology for Economic and Clinical Health Act (43).

The confidentiality sections of HIPAA were largely implemented by the U.S. Department of Health and Human Services under what is known as the Privacy Rule. The rule places significant limitations on the disclose of protected health information (PHI) and individually identifiable health information, which now generally requires patient consent. Under HIPAA, covered entities (which include hospitals and providers) should only request or disclose the minimum amount of PHI necessary to achieve the goals of a disclosure. These entities face both civil and criminal penalties for disclosing protected information in violation of the statute—with fines of up to $250,000 and 10 years in prison per incident. State confidentiality laws may prove stricter than HIPAA—and federal regulations do not preempt additional safeguards. For instance, HIPAA allows release of medical records in response to grand jury subpoenas, but in Turk v. Oiler (41), an Ohio hospital was found liable for doing so because it had breached a more narrowly tailored state statute.

During the course of practice, psychiatrists may receive subpoenas for patient records. They should be careful not to release such records in violation of the HIPAA privacy rule. Subpoenas are not synonymous with court orders. They may be issued by a wide range of attorneys in the legal system, as well as court clerks and certain other government authorities. Unlike a court order, which is generally binding on a provider under HIPAA, those receiving a subpoena should be sure that meaningful efforts are taken to inform the patient-owner of the health care information subject to the subpoena so that they have an opportunity to object; providers may also have an obligation to attempt to seek a qualified protective order (QPO) for the information. This QPO is an order limiting the purposes for which the disclosed PHI can be used—generally keeping it confidential and limiting its use to the legal matter at hand. When receiving a subpoena, a psychiatrist should consult her or his insurer and an attorney for guidance.

The advent of new technologies further complicates the interplay of confidentiality, therapeutics, and public welfare. For example, plugging a patient’s name into an Internet search engine or a publicly accessible database, such as those used by the judicial system, allows third parties with access to both search terms and URLs to trace patients back to specific health care facilities. In theory, breaches can then render such data available to the general public. In an ever more complex world, society—whether through public health agencies, law enforcement entities, or civil litigation—can also be anticipated to make increased demands on providers for information. Even for those psychiatrists acting in good faith, navigating these challenges will likely require sound judgment and considerable guidance from medicolegal experts.