Presenting a Client in Consultation: Consent or De-Identification

Does HIPAA require the client's authorization?

No, not for a consultation that stays inside your own practice. The Privacy Rule permits a covered entity to use or disclose protected health information for its own treatment, payment, or health care operations without an authorization 1Ref 1U.S. Department of Health and Human Services (Office for Civil Rights) (2026).§ 164.506 Uses and disclosures to carry out treatment, payment, or health care operations..That no authorization is required for a covered entity's use or disclosure of PHI for its own treatment, payment or health care operations at (c)(1), and the three conditions at (c)(4) on disclosing to another covered entity for that entity's operations.. The definition of that term reaches reviewing the competence or qualifications of health care professionals, evaluating practitioner performance, and conducting training programs 2Ref 2U.S. Department of Health and Human Services (2026).45 CFR 164.501 - Definitions.The regulatory definition of health care operations, including reviewing the competence or qualifications of health care professionals, evaluating practitioner performance and conducting training programs, and the definition of psychotherapy notes as notes kept separate from the rest of the individual's record.. Case consultation and clinical supervision sit inside that language, and the word doing the work in it is own: the consultation has to be your practice's operation.

HIPAA is the floor. State mental health confidentiality statutes and board rules can raise it, so read your own state's statute and your board's rules alongside the federal text before you settle a standing policy for the practice.

When the group stops being your own operations

When the other clinicians work for other businesses, the disclosure leaves your practice and a different paragraph applies. A covered entity may disclose protected health information to another covered entity for that entity's health care operations only where both have or had a relationship with the individual, the information pertains to that relationship, and the purpose sits in the quality-assessment or competence-review paragraphs of the definition 1Ref 1U.S. Department of Health and Human Services (Office for Civil Rights) (2026).§ 164.506 Uses and disclosures to carry out treatment, payment, or health care operations..That no authorization is required for a covered entity's use or disclosure of PHI for its own treatment, payment or health care operations at (c)(1), and the three conditions at (c)(4) on disclosing to another covered entity for that entity's operations.. A peer consultant who never met your client fails that first test.

But the regulation was not written with a monthly peer group in mind, and no federal guidance in the sources behind this page applies those paragraphs to one. What the text gives you is two boxes: a use inside your own operations, and a disclosure to another entity for its operations. A solo clinician presenting a case to five clinicians from five separate practices sits comfortably in neither. What you have to reason from is the text itself.

Supervision is the cleaner case. Where a pre-licensed associate or clinician #2 is employed by your practice, the supervision runs inside one covered entity and the own-operations permission covers it on its face. The same holds for a supervisor the practice engages to review its own clinicians' work. Whether a paid outside consultant is a business associate needing an agreement is a separate question with its own answer.

That leaves the consultation group, where the ethics codes take over.

Your ethics code is usually the tighter constraint

Three of the major codes answer this differently, and the one you practise under is the one that governs. The counselor code tells counselors not to disclose, in consultation, confidential information that could reasonably lead to identifying a client unless prior consent was obtained or the disclosure cannot be avoided, and to share only to the extent necessary 3Ref 3American Counseling Association (2014).2014 ACA Code of Ethics.Standard B.7.b on case consultation: counselors do not disclose confidential information that could reasonably lead to identifying a client unless prior consent was obtained or the disclosure cannot be avoided, and disclose only to the extent necessary.. The social work code sets a least-information rule and states no consent requirement of its own 4Ref 4National Association of Social Workers (2021).NASW Code of Ethics: Social Workers' Ethical Responsibilities to Colleagues.Standard 2.05(c): when consulting with colleagues about clients, social workers disclose the least amount of information necessary, and the code states no consent requirement of its own..

The marriage and family therapy code is the strictest of the three. In the edition effective January 1, 2026, it bars sharing information that could reasonably identify a client with colleagues or referral sources without written authorization, and limits what is shared to what the consultation needs 5Ref 5American Association for Marriage and Family Therapy (2026).AAMFT Code of Ethics.Standard 2.8, confidentiality in consultations: no sharing of information that could reasonably identify a client without written authorization, and sharing limited to what the consultation requires..

Mixed-discipline groups are common, and they produce a simple operating rule: run the group to the strictest code represented in it, since every member carries their own code into the room. If your discipline is not in that table, the exercise is the same. Open the current edition of your own code and read its consultation standard before the next meeting.

Changing the name is not de-identification

Disguising identifying details in a case presentation is good practice and it is not de-identification under HIPAA. The rule recognizes two routes: expert determination, or the safe harbor, which requires removing eighteen listed identifiers of the individual and of relatives, employers and household members, including names, all geographic subdivisions smaller than a state, and all elements of dates except the year 6Ref 6U.S. Department of Health and Human Services (Office for Civil Rights) (2026).§ 164.514 Other requirements relating to uses and disclosures of protected health information..The two de-identification routes at (b): expert determination, and the safe harbor's removal of eighteen listed identifiers of the individual and of relatives, employers and household members, plus the no-actual-knowledge condition.. The safe harbor also requires no actual knowledge that what remains could identify the person.

The list runs longer than a case presentation usually strips, and because it covers relatives, employers and household members too, an employer's name sits on it beside the client's. Expert determination is the other route, and it is a formal exercise nobody runs before a Tuesday peer group.

The actual-knowledge condition is what defeats most disguising. In a group of clinicians practising within the same few square miles, an occupation, an age and a distinctive presenting problem can carry a name along with them.

None of that makes disguising pointless. It narrows who in the room could re-identify the client, and it is worth doing on its own terms. But it does not move the conversation outside the Privacy Rule, so the permission still has to come from somewhere: your own operations, or the client's authorization.

Presentations about one member of a family carry a second exposure. The chart wall between related clients holds only if you keep it up in the group as well as in the record, because describing a couple, or a parent and a child, can identify the client you did not set out to present.

Psychotherapy notes follow a separate rule

Content that lives in psychotherapy notes is protected more tightly than the rest of the chart. HIPAA requires an authorization for any use or disclosure of psychotherapy notes, subject to a closed list of exceptions 7Ref 7U.S. Department of Health and Human Services (2026).45 CFR 164.508 - Uses and disclosures for which an authorization is required.The requirement at (a)(2) of an authorization for any use or disclosure of psychotherapy notes, and the exception at (a)(2)(i)(B) for the covered entity's own training programs in which students, trainees or practitioners in mental health learn under supervision.. One of those exceptions covers the covered entity's own training programs in which students, trainees, or practitioners in mental health learn under supervision, which is written as your program rather than an outside peer group 7Ref 7U.S. Department of Health and Human Services (2026).45 CFR 164.508 - Uses and disclosures for which an authorization is required.The requirement at (a)(2) of an authorization for any use or disclosure of psychotherapy notes, and the exception at (a)(2)(i)(B) for the covered entity's own training programs in which students, trainees or practitioners in mental health learn under supervision..

Two consequences follow for a solo practice. Psychotherapy notes earn that protection only while they are kept separate from the rest of the individual's record 2Ref 2U.S. Department of Health and Human Services (2026).45 CFR 164.501 - Definitions.The regulatory definition of health care operations, including reviewing the competence or qualifications of health care professionals, evaluating practitioner performance and conducting training programs, and the definition of psychotherapy notes as notes kept separate from the rest of the individual's record., so you can decide in advance what you are presenting from. And the training exception is drawn around a program the covered entity runs, which means an employed or engaged supervisor reads differently from five colleagues who are not part of your practice.

Present from the progress note where the clinical question allows it.

Share the least that answers the question

The minimum necessary standard applies to a consultation disclosure. A covered entity must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose 8Ref 8U.S. Department of Health and Human Services (Office for Civil Rights) (2026).§ 164.502 Uses and disclosures of protected health information: General rules..The minimum-necessary standard at (b), and the closed list of uses and disclosures it does not reach, which covers disclosures to or requests by a health care provider for treatment and does not cover consultation.. The listed exceptions to that duty do not reach consultation. They include disclosures to or requests by a health care provider for treatment, which is a different act from asking a colleague how to handle a case.

In practice the minimum is smaller than most presentations. A clinical question survives the removal of nearly everything that identifies a person.

Strip before you present:

• the name, the initials and any nickname the client uses
• the town, the employer, the school, and the practice location where it narrows the field
• exact dates of birth, of a hospitalization, or of the incident under discussion
• the one distinctive detail that makes the case memorable, which is usually the same detail that makes it identifiable

Keep the diagnosis, the treatment history in general terms, what you have already tried and the question you want answered. That is the material a group can respond to.

What to write down before the next group meeting

Three documents do the work, and none of them takes an hour. The first is your informed consent paperwork, which names consultation and supervision by role rather than by person, so it survives a change of consultant. The second is a written agreement among the group's members covering what may be presented, what leaves the room, and whether anything is recorded. The third is a short chart entry.

A common convention is to record that a consultation occurred, the question asked and the recommendation received, and to keep the process detail out of it. What matters is that the entry is consistent across clients, because the inconsistent record is the one that reads badly two years later.

One question opens most privacy decisions in a solo practice: who's asking for the therapy record, and what permission covers them. Consultation is the odd case, because nobody is asking for anything. You are the one deciding what leaves the building, which is why the ground rules are worth writing before you need them.

Date the group agreement, and re-read it whenever a member joins or leaves.