Skip to main content
Client information leaves the practice only with a valid basis and through the practice’s process. This is one of the highest-stakes areas of therapy privacy, because the people asking often have a legitimate-sounding reason and a deadline.

​
With authorization

Most releases require the client’s signed authorization on the practice’s form. A valid authorization names who can receive the information, what information, for what purpose, and when it expires, and it tells the client they can revoke it.
  • Use the practice’s form. A form from an outside party may not meet HIPAA’s requirements.
  • Verify the signature is the client’s (or their legal representative’s, with documentation of that authority).
  • Release only what the authorization covers. “Records” doesn’t mean everything if the client checked “treatment summary.”
  • Log the disclosure in the record: what, to whom, when, under which authorization.
  • Psychotherapy notes require their own, separate authorization.
Releases are processed by the front office with Helen’s review. Clinicians don’t send records themselves.

​
Without authorization

Some disclosures are permitted or required without authorization:
  • Treatment, payment, and operations, within minimum necessary
  • Mandatory reporting of child or vulnerable adult abuse
  • Duty to warn under Utah law
  • A valid court order signed by a judge
  • Certain public health, oversight, and law enforcement purposes, narrowly defined
Every one of these goes through Helen before disclosure, except a true emergency. See Mandatory reporting.

​
Subpoenas, court orders, and attorneys

A subpoena is not a court order. A subpoena from an attorney, by itself, does not authorize you to release a therapy record. Utah’s psychotherapist-patient privilege and HIPAA both require more.
Important. If you receive a subpoena, a records request from an attorney, a call from a court, or any legal document naming a client, do not respond, do not release anything, and do not confirm or deny that the person is a client. Give the document to Helen and the practice manager the same day.
The practice will determine, with legal advice, whether there’s a valid basis for release, whether the client must be notified, and whether to object. This can take time, and the deadline on the document is not your problem to solve alone.

​
Requests from family

A family member asking about an adult client’s care gets the same answer every time, warmly: “I’m not able to confirm whether someone is a client here. If they’d like us to share information with you, they can sign an authorization.” Then tell the client, if they are one. For minor clients, Utah law gives parents and guardians access rights, with exceptions. Route any parental request to Helen before responding.

​
Requests from the client

Clients have the right to see and get a copy of their record. Requests go to the front office. The practice responds within the time HIPAA allows and may charge a reasonable copying fee. A clinician who believes access could endanger the client tells Helen, who decides under HIPAA’s narrow exception.

​
Coordination with other providers

Sharing with another treating provider for treatment purposes is permitted without authorization, but our practice is to get one anyway wherever practical, because the client’s trust is worth the extra form. Discuss with Helen.