Guide

Group confidentiality: what you can promise and what you cannot

Summary

In group therapy you can promise your own confidentiality but not the other members'. You are bound by law and your ethics code; the members are not, so what one member repeats outside the room is beyond your control. The standard practice is a written group agreement in which every member commits to keep what they hear confidential, paired with a clear explanation, before the first session, that the promise is a rule the group adopts rather than a guarantee you can enforce.

By Gale Editorial · Updated 2026-07-26. Every figure cited to a dated source. How we write.

What you can promise, and what you can't

In group therapy, confidentiality has two layers of very different strength. Your own duty to protect what members share is enforceable — it flows from your professional ethics code and from privacy law, and breaking it carries real consequences, whether you practice as a counselor, psychologist, or social worker 1Ref 1American Counseling Association (2014).ACA Code of Ethics.That the ACA ethics code requires clarifying confidentiality and its limits in group work.2Ref 2American Psychological Association (2017).Ethical Principles of Psychologists and Code of Conduct.That the APA ethics code requires informed consent about confidentiality and its limits.3Ref 3National Association of Social Workers (2021).NASW Code of Ethics.That the NASW ethics code requires informed consent and protection of client privacy.. The members' duty to one another is not enforceable the same way: they are not covered entities and not bound by your license, so you can require their discretion but you cannot promise it on their behalf.

That asymmetry is the whole design problem of a group. You control the door, the record, and your own mouth; you do not control what a member says to a partner over dinner. Naming that limit plainly — rather than implying a seal the group cannot keep — is both the ethical requirement and the practical one, because members calibrate their disclosures to what they believe is safe.

Who	Bound by	Can you enforce it?
You, the clinician	HIPAA and your ethics code	Yes — license and law back it
A group member	Only the group's own agreement	No — you can require it, not guarantee it

The group agreement, and the conversation around it

Before the first session, put the confidentiality expectation in writing and talk it through. Explain what you will and will not disclose, the mandatory exceptions every client faces, and the request that each member keep what they hear inside the room 4Ref 4HHS Office for Civil Rights (2026).HIPAA Privacy Rule and Sharing Information Related to Mental Health.OCR mental-health guidance on a provider's disclosure obligations and the exceptions clients face.. Have members acknowledge the agreement in writing. The document does not create a legal seal among members, but it sets a shared norm, gives you a basis to address a breach, and shows you obtained genuine informed consent.

Revisit the agreement when a new member joins, and restate it briefly if the group's composition or focus shifts. The conversation matters more than the signature: a member who understands why the limit exists is far more likely to honor it than one who skimmed a form on the way in.

Documenting a group: one record per member

Each member gets an individual progress note in their own chart, not a single shared note that names everyone. The session may be group, but the record is individual: what this client did, said, and worked on, tied to their own treatment plan. Group psychotherapy is billed under its own CPT code, and payers expect a member-specific note behind each claim 5Ref 5APA Services, Inc. (2025).Psychotherapy Codes for Psychologists.That group psychotherapy is billed under its own CPT code, supporting a member-specific note behind each claim.. A note that lists other members by name imports their protected information into this client's file.

Keep other members out of the narrative — refer to 'the group' or 'a peer' rather than to names. This is why group notes are individualized rather than duplicated across charts, and it is one of the first things a records reviewer checks when a group claim is audited.

When the group runs inside a Part 2 program

If your group is part of a federally assisted substance use disorder program, 42 CFR Part 2 governs on top of HIPAA, and it is stricter. The very fact that a person attends can be protected, and the program may not disclose what members share without consent or a listed exception 6Ref 6Office of the Federal Register (2026).42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records.Part 2's confidentiality protections for substance use disorder program records and its 2024 consent alignment.. Part 2's protections attach to the information the program holds — they do not, and cannot, bind the members to one another any more than HIPAA does.

The 2024 Part 2 changes let a single patient consent cover future treatment, payment, and operations, which simplifies routine sharing, but the consent architecture for anything beyond that remains 6Ref 6Office of the Federal Register (2026).42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records.Part 2's confidentiality protections for substance use disorder program records and its 2024 consent alignment.. If a group blends SUD treatment with general mental-health work, handle the Part 2 material by the stricter standard throughout.

Your psychotherapy notes about a group

Notes you keep as your private analysis of a group session — your impressions, hypotheses, and process observations — can be maintained as psychotherapy notes, the tier HIPAA protects most heavily and keeps separate from the chart 7Ref 7HHS Office for Civil Rights (2026).Does HIPAA provide extra protections for mental health information compared with other health information?.That psychotherapy notes are kept separate and generally require the client's authorization to disclose.. Kept apart, they generally require the client's written authorization to disclose, even to a payer. The individualized progress note that supports billing is a different document and does not receive this protection.

Keep the two physically separate, and never let a psychotherapy note about a group become a roster: the heightened protection covers your analysis, not a list of who was present. When the tiers blur, both lose the clarity that makes them defensible.

Recording, privilege, and the courtroom question

Two questions surface once a group has run for a while. First, recording therapy: if you record a session, you need every member's consent, and the recording becomes part of the protected record you must safeguard. Second, privilege: privilege is the court's word for whether a communication can be kept out of evidence, and in some jurisdictions the presence of third parties — the other members — can complicate it.

Neither has a single national answer that fits every case, so name recording consent in your group agreement, and if litigation is a live risk for a member, tell them plainly that a group is a less private container than individual work. Your state's evidence law controls the privilege question, so learn its rule before a subpoena forces the issue.

Adjacent formats: couples, family, and collateral informants

Multi-person work outside a therapy group raises cousins of the same problem. In couples records, the file often belongs to both partners jointly, so a release usually needs both signatures — one partner cannot unilaterally extract the shared record. When a family member or outside party gives you information as a collateral source, family informants sit in a separate lane: you can listen freely, but you disclose carefully, and you keep their input from becoming a back channel around your client's own privacy.

The through-line across all of these formats is the same: you can control your own conduct and your own records with precision, and you can set norms for everyone else — but a norm is not a lock, and honest practice says so out loud.

Common questions

No. You are bound to protect what members share, but the members are not covered entities and cannot be held to your standard. The honest promise is that you will protect confidentiality and that the group has agreed to do the same — not that disclosure is impossible. Say this before the first session so members can calibrate what they choose to share.

No. Write one individual progress note per member, filed in that member's own chart and tied to their treatment plan. Do not write a single shared note naming everyone, and do not list other members by name in any client's record. Group therapy has its own billing code, and payers expect a member-specific note supporting each claim.

Address it through the agreement the group adopted: name the breach with the group, restate the norm, and decide clinically whether the member can continue. You are generally not responsible for a member's breach if you took reasonable steps — informed consent, a written agreement, and clear expectations. Document what happened and how you responded.

Yes. Mandatory reporting and safety-based exceptions apply to each member exactly as they would in individual work. Cover them when you review the confidentiality agreement, so members know the limits before they disclose. If a report becomes necessary, follow your ordinary process and document the basis, keeping other members' information out of the report itself.

Yes, with the consent that your state and the setting require, and with an age-appropriate explanation of the limits. Minors calibrate disclosure just as adults do, so be concrete about what you might have to share and with whom. Whether a minor can consent on their own turns on state law and the type of care involved.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

1.American Counseling Association (2014). ACA Code of Ethics. American Counseling Association. link ✓That the ACA ethics code requires clarifying confidentiality and its limits in group work.
2.American Psychological Association (2017). Ethical Principles of Psychologists and Code of Conduct. American Psychological Association. link ✓That the APA ethics code requires informed consent about confidentiality and its limits.
3.National Association of Social Workers (2021). NASW Code of Ethics. National Association of Social Workers. link ✓That the NASW ethics code requires informed consent and protection of client privacy.
4.HHS Office for Civil Rights (2026). HIPAA Privacy Rule and Sharing Information Related to Mental Health. U.S. Department of Health and Human Services. linkOCR mental-health guidance on a provider's disclosure obligations and the exceptions clients face.
5.APA Services, Inc. (2025). Psychotherapy Codes for Psychologists. APA Services, Inc.. link ✓That group psychotherapy is billed under its own CPT code, supporting a member-specific note behind each claim.
6.Office of the Federal Register (2026). 42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records. eCFR. link ✓Part 2's confidentiality protections for substance use disorder program records and its 2024 consent alignment.
7.HHS Office for Civil Rights (2026). Does HIPAA provide extra protections for mental health information compared with other health information?. U.S. Department of Health and Human Services. linkThat psychotherapy notes are kept separate and generally require the client's authorization to disclose.

https://www.gale.care/for-providers/pr-group-therapy-confidentiality · 7 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

← Back to for providers