Privilege is the court's word: sorting the three confidentialities

Privilege, confidentiality, privacy: three different things

They get used interchangeably, but they are three separate protections with three different masters. Confidentiality is the ethical duty you owe your client. Privacy is the body of law — HIPAA, 42 CFR Part 2, and state statutes — that governs how you may use and disclose the record 1Ref 1HHS Office for Civil Rights (2026).HIPAA Privacy Rule and Sharing Information Related to Mental Health.That privacy is the statutory layer governing use and disclosure of mental-health information, including heightened protection for psychotherapy notes and permitted safety-based disclosures.. Privilege is an evidentiary rule that decides whether protected communications can be compelled in a legal proceeding. Getting a request right starts with naming which of the three it implicates.

The practical payoff: when something lands on your desk, ask whether it is an ethics question, a privacy-law question, or a courtroom question. The answer tells you which rulebook — and often which advisor — you need.

Confidentiality: the ethical duty

Confidentiality is the oldest and broadest of the three — the professional obligation to hold in confidence what a client discloses, operating everywhere, not just in court. Whichever discipline you practice, your own code carries it: the APA code for psychologists 2Ref 2American Psychological Association (2017).Ethical Principles of Psychologists and Code of Conduct.That confidentiality is a core ethical duty for psychologists with defined limits, and that the clinician's role is to protect confidentiality and assert the client's privilege while disclosing only the minimum compelled., the NASW code for social workers 3Ref 3National Association of Social Workers (2021).NASW Code of Ethics.That the NASW code imposes a parallel confidentiality duty on social workers, so the ethical obligation attaches by discipline-specific code., and the ACA code for counselors 4Ref 4American Counseling Association (2014).ACA Code of Ethics.That the ACA code imposes a parallel confidentiality duty on counselors, so the ethical obligation attaches by discipline-specific code. each make confidentiality a core duty, with defined limits. It binds you even where no statute or privilege applies.

Because it is an ethical duty, its exceptions are ethical judgments as much as legal ones. The codes describe when disclosure is permitted or required — an imminent risk of serious harm, or a legal mandate — and expect you to disclose only the minimum the situation needs. Confidentiality does not vanish in those moments; it narrows to what is required 2Ref 2American Psychological Association (2017).Ethical Principles of Psychologists and Code of Conduct.That confidentiality is a core ethical duty for psychologists with defined limits, and that the clinician's role is to protect confidentiality and assert the client's privilege while disclosing only the minimum compelled..

Privacy: the statutory and regulatory layer

Privacy is where the law gets specific. HIPAA is the baseline: it governs how a covered practice may use and disclose protected health information, and it adds heightened protection for mental-health information and psychotherapy notes 1Ref 1HHS Office for Civil Rights (2026).HIPAA Privacy Rule and Sharing Information Related to Mental Health.That privacy is the statutory layer governing use and disclosure of mental-health information, including heightened protection for psychotherapy notes and permitted safety-based disclosures.. On top of HIPAA sit other statutes — 42 CFR Part 2 for substance-use records, and your state's own mental-health-confidentiality law, which can be stricter 5Ref 5Office of the Federal Register (2026).42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records.That substance-use records from a Part 2 program require consent or a Part 2-specific court order to disclose — stricter than the general privacy and privilege rules, so a subpoena alone does not suffice.. Privacy law is what a payer, a records request, or an audit runs into first.

Unlike confidentiality, privacy is enforced by agencies with penalties, so 'I kept it confidential' is not the same as 'I complied with the Privacy Rule.' The two usually point the same way, but privacy law defines the permitted uses, the minimum-necessary limit, and the patient's access rights in operational detail your ethics code leaves general 1Ref 1HHS Office for Civil Rights (2026).HIPAA Privacy Rule and Sharing Information Related to Mental Health.That privacy is the statutory layer governing use and disclosure of mental-health information, including heightened protection for psychotherapy notes and permitted safety-based disclosures..

Privilege: the court's word

Privilege is the narrowest and the most misunderstood. It is not a duty you carry — it is an evidentiary rule that determines whether protected communications can be compelled as testimony or evidence in a legal proceeding. Critically, the privilege belongs to the client, not to you; your role is to assert it on their behalf and to disclose no more than the law compels 2Ref 2American Psychological Association (2017).Ethical Principles of Psychologists and Code of Conduct.That confidentiality is a core ethical duty for psychologists with defined limits, and that the clinician's role is to protect confidentiality and assert the client's privilege while disclosing only the minimum compelled.. Outside a legal proceeding, privilege simply is not the operative concept — confidentiality and privacy are.

Its contours are defined by courts and by statute, and they vary by jurisdiction and by the type of case, so the specifics — which communications are covered, which exceptions apply — are a question for your state's law and the court you are in. What is constant is the structure: the client holds it, a court adjudicates it, and it lives in litigation.

Where they diverge: exceptions and holders

The three come apart at the edges — over who can lift the protection and when it yields. Confidentiality can be overridden by an ethical or legal duty, such as a mandated report or a safety-based disclosure to prevent serious harm, and HIPAA expressly permits certain of those disclosures 1Ref 1HHS Office for Civil Rights (2026).HIPAA Privacy Rule and Sharing Information Related to Mental Health.That privacy is the statutory layer governing use and disclosure of mental-health information, including heightened protection for psychotherapy notes and permitted safety-based disclosures.. Privacy law sets its own permitted disclosures. Privilege, by contrast, generally yields only when the client waives it or a court orders disclosure — a different lever than the other two 6Ref 6HHS Office for Civil Rights (2026).Court Orders and Subpoenas.The procedural distinction between a court order (disclose only what it authorizes) and a subpoena without a court order (disclose only with satisfactory assurances of notice or a protective order), which is how privilege is tested in practice..

• Confidentiality yields to a duty (mandatory reporting, imminent-harm disclosure), narrowed to the minimum.
• Privacy yields to a permitted or required use under HIPAA, Part 2, or state law.
• Privilege yields to the client's waiver or a court's order — not to a payer, and not to a subpoena alone.

A classic trap is the patient who puts their own mental state at issue in litigation, which can waive privilege by operation of law in many courts. That is a legal determination, not one you make at the desk 6Ref 6HHS Office for Civil Rights (2026).Court Orders and Subpoenas.The procedural distinction between a court order (disclose only what it authorizes) and a subpoena without a court order (disclose only with satisfactory assurances of notice or a protective order), which is how privilege is tested in practice..

Privilege in practice: the subpoena on your desk

Most clinicians meet privilege as a piece of paper — a subpoena, or the law-office letter asking for a client's records. The distinction that matters is procedural: a subpoena signed by an attorney is not a court order from a judge. HIPAA lets you disclose under a court order only what the order authorizes; for a subpoena without a court order, you may disclose only with satisfactory assurances the client was notified or a protective order sought 6Ref 6HHS Office for Civil Rights (2026).Court Orders and Subpoenas.The procedural distinction between a court order (disclose only what it authorizes) and a subpoena without a court order (disclose only with satisfactory assurances of notice or a protective order), which is how privilege is tested in practice..

A subpoena alone rarely authorizes you to hand over a therapy record. A workable sequence when one arrives: do not disclose reflexively; notify the client or their counsel; assert the client's privilege and confidentiality unless and until it is waived or a court orders production; and, for anything beyond the routine, get your own legal advice on the specific demand. The law-office letter is a request, not an order — treat it as one 6Ref 6HHS Office for Civil Rights (2026).Court Orders and Subpoenas.The procedural distinction between a court order (disclose only what it authorizes) and a subpoena without a court order (disclose only with satisfactory assurances of notice or a protective order), which is how privilege is tested in practice..

Special cases: SUD, psychotherapy notes, group

A few settings layer extra protection on top of the three. Substance-use records from a 42 CFR Part 2 program require the patient's consent or a Part 2-specific court order before disclosure — a subpoena is not enough, which is stricter than the general rule 5Ref 5Office of the Federal Register (2026).42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records.That substance-use records from a Part 2 program require consent or a Part 2-specific court order to disclose — stricter than the general privacy and privilege rules, so a subpoena alone does not suffice.. Psychotherapy notes get their own HIPAA lock, needing specific authorization for most disclosures 1Ref 1HHS Office for Civil Rights (2026).HIPAA Privacy Rule and Sharing Information Related to Mental Health.That privacy is the statutory layer governing use and disclosure of mental-health information, including heightened protection for psychotherapy notes and permitted safety-based disclosures.. And group confidentiality is inherently shared, since a clinician cannot guarantee what other members will repeat.

For a solo practice, the takeaway is to spot which layer is in play before you respond. A demand for SUD records, a request touching psychotherapy notes, or a question about family informants each changes the analysis. When two layers overlap — say a subpoena for SUD records — apply the stricter one, and confirm with counsel rather than guessing at the desk 5Ref 5Office of the Federal Register (2026).42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records.That substance-use records from a Part 2 program require consent or a Part 2-specific court order to disclose — stricter than the general privacy and privilege rules, so a subpoena alone does not suffice..