Decoding the Ethics Code, Ch. 7

benisd

chapter_7.docx

Home >Psychology homework help >Decoding the Ethics Code, Ch. 7

CHAPTER 7

Standards on Privacy

and Confidentiality

4. Privacy and Confidentiality

4.01 Maintaining Confidentiality

Psychologists have a primary obligation and take reasonable precautions to protect confidential

information obtained through or stored in any medium, recognizing that the extent and limits of

confidentiality may be regulated by law or established by institutional rules or professional or

scientific relationship. (See also Standard 2.05, Delegation of Work to Others.)

Psychologists respect the privacy and dignity of persons by protecting confidential

information obtained from those with whom they work (Principle E:

Respect for People’s Rights and Dignity). Standard 4.01 of the APA Ethics Code

(APA, 2002b) is broadly written and requires all psychologists to take reasonable

precautions to maintain confidentiality. The nature of precautions required will

differ according to the psychologist’s role, the purpose of the psychological activity,

the legal status of the person with whom the psychologist is working, federal

regulations, state and local laws, and institutional and organizational policies. The

term reasonable precautions recognizes both the responsibility to be familiar with

appropriate methods of protecting confidentiality and the possibility that confidentiality

may be broken despite a psychologist’s best efforts. The following are

general recommendations for maintaining confidentiality across a variety of psychological

activities.

Use of the Internet and Other Electronic Media

When providing services, conducting distance learning, or collecting research

data over the Internet, psychologists must become knowledgeable about or

HMO

FOR THE USE OF UNIVERSITY OF PHOENIX STUDENTS AND FACULTY ONLY.

NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

ANY AND ALL UNAUTHORIZED USE IS STRICTLY PROHIBITED.

136——PART II ENFORCEABLE STANDARDS

obtain technical assistance in employing appropriate methods for protecting

confidential records concerning clients/patients, organizations, research participants,

or students.

􀀵 When files are stored via a common server or backed up on a university system or hub

server, discuss and develop security measures with appropriate personnel.

􀀵 Use encrypted data transmission, password-protected data storage, and firewall

techniques.

􀀵 When confidential information is e-mailed, faxed, or otherwise electronically transmitted

to scientists, professionals, or organizations, take reasonable steps to ensure that

recipients of the information have an adequate confidentiality policy (see also discussion

of HIPAA later in this chapter).

􀀵 Psychologists using the Internet for clinical supervision should instruct trainees on

appropriate procedures to protect client/patient confidentiality.

􀀵 Avoid leaving telephone messages for clients/patients on answering machines.

When such a message is unavoidable, take precautions to ensure the message does

not reveal to others that the client/patient is in treatment or any other confidential

information.

Audio, Video, or Digital Recordings of Voices or Images

Protecting confidentiality when recording voice or images of clients/patients,

research participants, employees, or others may require technical advice or

assistance.

Need to Know: Cybersecurity

Is a Two-Way Street

Cybersecurity at only one end of a network of communication is insufficient. Psychologists

should work with organizations, clients/patients, students, and others regarding how to

install appropriate security protections. This may include discussion of shared encryption

methods and adequate password protection for communications conducted on mobile

computing devices, such as smart phones and other digital devices (for a detailed review

of security concerns and practices, see T. J. Schwartz & Lonborg, 2011).

􀀵 Store recordings in safe locations or use passwords to protect computer access.

􀀵 Distort voice recordings or mask faces in visual images to protect confidentiality.

􀀵 Destroy recordings when they are no longer needed, as long as their destruction does

not conflict with other ethical obligations to maintain scientific, organizational, or

professional records.

FOR THE USE OF UNIVERSITY OF PHOENIX STUDENTS AND FACULTY ONLY.

NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

ANY AND ALL UNAUTHORIZED USE IS STRICTLY PROHIBITED.

Chapter 7 Standards on Privacy and Confidentiality——137

􀀵 Use participant codes on all data collection materials and data entered for analysis.

􀀵 Maintain records linking participant codes to personal identifiers in a secure file and

destroy such records once they are no longer needed.

􀀵 Limit access to personally identifiable information and supervise research personnel in

routine confidentiality precautions.

􀀵 Separate consent forms from coded materials to avoid participant identification.

􀀵 Apply for a Certificate of Confidentiality under 301d of the Public Health Service Act of

1946 to obtain immunity from a subpoena requiring disclosure of identifying information

when there is a possibility that data collected are of a sensitive nature that, if

released, could result in stigmatization, discrimination, or legal action that could jeopardize

an individual’s financial standing, employment, or reputation (see http://grants2

.nih.gov/grants/policy/coc/).

􀀵 When publishing or otherwise disseminating research findings, consider special confidentiality

protections when unnamed but small, unique samples can be identified

through descriptions of demographic variables (e.g., persons with rare diseases from

distinct communities).

􀀵 Ensure that recruitment and research procedures do not inadvertently reveal confidential

information. For example, when studying addictions, mental disorders, sexually

transmitted diseases, or other potentially stigmatizing conditions, approaching target

populations for recruitment may result in public identification of the condition.

􀀵 Become familiar with and ensure HIPAA compliance when research involves the use of

PHI obtained directly by the investigator or through a covered entity (see section on

HIPAA later in this chapter).

􀀵 Become familiar with cultural and contextual factors that may influence participant

confidentiality preferences and concerns.

􀀵 A psychologist conducting cross-cultural research in the Amazon arranged to have

individual interviews conducted in a private area of the village to protect participant

confidentiality. To the psychologist’s surprise, the villagers objected to these arrangements

as strange and uncomfortable because they did not ordinarily conduct social

or business interactions in private settings. In addition, those who did express interest

in participation brought their family members to the interview. With permission

from his IRB, he modified the procedures so that interviews were conducted in a

corner of a public space within the village, and family members were permitted to

be present at the invitation of the participants. Informed consent clarified to villagers

Research

􀀵 An educational psychologist sought consent and parental permission to use teacher

and student images in a web-based instructional video for science education. To

address parental concerns that students might be identified by Internet predators she

used “masking” effects on video shots of students’ faces and sound editing to remove

any reference to names. When there were too many faces to conceal through masking,

she extracted a digital photograph from a scene in which only activities and not

identities were visible and then used editing software to extract appropriate audio

recordings to supplement the photographs (see Schuck & Kearney, 2006).

FOR THE USE OF UNIVERSITY OF PHOENIX STUDENTS AND FACULTY ONLY.

NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

ANY AND ALL UNAUTHORIZED USE IS STRICTLY PROHIBITED.

138——PART II ENFORCEABLE STANDARDS

Implications of HIPAA for Practice and Research

Practitioners and scientists whose work includes creating, using, disclosing, collecting,

storing, or analyzing PHI should become familiar with requirements of the

HIPAA Privacy Rule summarized below (45 CFR Parts 160–164; see also “A Word

About HIPAA” in the Preface of this book).

Privacy Officer

Under HIPAA, “covered entities” must designate a “privacy officer” to oversee

and ensure that HIPAA-compliant privacy procedures are developed and

implemented. This requirement is “scalable,” in that meeting the requirement

will differ depending on whether a psychologist is in solo practice, directing a

group practice, or administrating a large institutional program. Covered entities

must implement security procedures that prevent unauthorized access to

health records. They must also take steps to ensure that employees, business

associates, individual contractors, consultants, collection agencies, third-party

payors, and researchers with whom Protected Health Information (PHI) is

shared comply with HIPAA regulations. Psychologists transferring PHI files to

or from HMOs or other companies are required to take steps to ensure that

confidential records are transmitted in secure ways, for example, by means of a

secured fax machine. Requirements for HIPAA compliance also vary with each

state’s privacy laws.

the type of information to be discussed, how the discussion with each individual

would be kept confidential from all who were not present during the interview, and

steps the psychologist would take to ensure that individual participants could not be

identified by others when the study results were disseminated (adapted from Monshi &

Zieglmayer, 2004).

􀀵 Store therapy notes or client/patient records in locked file cabinets or in passwordprotected

computer files.

􀀵 When working with an HMO or within an institution, personally confirm that client/

patient permission for sharing confidential information has been obtained appropriately

through third-party contractual or institutional release forms.

􀀵 Protect the identity of clients/patients or other persons not covered by an HMO when

the HMO conducts a utilization review that includes inspection of noncovered clients’/

patients’ records.

􀀵 Obtain appropriate written permission and/or signed HIPAA-compliant authorization

before releasing confidential information to third parties (see below).

Assessment and Psychotherapy Records

FOR THE USE OF UNIVERSITY OF PHOENIX STUDENTS AND FACULTY ONLY.

NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

ANY AND ALL UNAUTHORIZED USE IS STRICTLY PROHIBITED.

Chapter 7 Standards on Privacy and Confidentiality——139

Small Group Practices

HIPAA distinguishes between large and small health care practices, recognizing

that for the latter, it is impractical to expect that employees will not handle PHI.

The following is a partial list of requirements when staff members have access to

such records (see Rada, 2003):

All staff must be formally trained in HIPAA regulations, including state laws

relevant to faxing information that includes PHI and the group’s sanction

policy for violators.

Staff must sign an employee confidentiality form, placed in their personnel

record along with a record of their training.

E-mails and fax coversheets used to communicate PHI must indicate that the

information is confidential.

The fax policy must be posted beside the fax machine.

All vendors used by the practice for accounting, legal, actuarial, billing, or

other services must sign a business associate contract with the practice.

In addition to a privacy officer responsible for the development and implementation

of the policies and procedures, each group practice must have an

office manager who (a) oversees HIPAA authorizations, completion and maintenance

of required records, and new staff training; (b) receives privacy complaints

and mitigates harmful effects of privacy disclosures; and (c) applies

sanctions when appropriate. In small clinics or practices, one person may

perform both these roles.

Research Creating, Using, or Disclosing PHI

Psychologists who are health care providers or who employ health care providers

to conduct research involving assessments or diagnoses that will be entered into a

participants’ permanent health record or used for treatment decisions involving

research participants should consider themselves or their research team covered

entities under HIPAA. Investigators who are not themselves health care providers

but who conduct intervention evaluation research or quality improvement research

for a health care facility or any other organization that is a covered entity must also

ensure that their procedures are HIPAA compliant. Additional details are provided

in Chapter 11 in the sections on Standards 8.02, Informed Consent to Research, and

8.05, Dispensing with Informed Consent for Research.

Implications of FERPA for Psychologists

Working in Schools

The Family Educational Rights and Privacy Act of 1974 (FERPA; http://www2

.ed.gov/policy/gen/guid/fpco/ferpa/index.html) is a federal law that protects the

privacy of student education records in all schools that receive funds under an

applicable program of the U.S. Department of Education. FERPA gives certain

FOR THE USE OF UNIVERSITY OF PHOENIX STUDENTS AND FACULTY ONLY.

NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

ANY AND ALL UNAUTHORIZED USE IS STRICTLY PROHIBITED.

140——PART II ENFORCEABLE STANDARDS

rights to parents that get transferred to the student at age 18 or after leaving high

school. A student’s educational record may not be released without written permission

from the parent or the eligible student.

FERPA does allow disclosure of records without consent (a) in cases of health

and safety emergencies; (b) to comply with a judicial order or with state or local

authorities within the juvenile justice system; (c) to school officials with legitimate

educational interest; (d) to accrediting agencies, specified officials, or organizations

in connection with auditing or certain studies on behalf of the school; (e) to schools

to which the student is transferring; or (f) to parties in connection with the student’s

financial aid. HIPAA regulations do not apply to records that fall under

FERPA regulations. FERPA, unlike HIPAA, does not make distinctions between

student health and academic records. School psychologists need to be familiar with

state and district policies, which may be more protective of student health privacy

(e.g., HIV/AIDS). Readers may wish to also refer to “Need to Know: Avoiding

Conversion of Treatment Records to Educational Records” in the Chapter 9 section

on Standard 6.01, Documentation of Professional and Scientific Work and

Maintenance of Records.

4.02 Discussing the Limits of Confidentiality

(a) Psychologists discuss with persons (including, to the extent feasible, persons who are legally

incapable of giving informed consent and their legal representatives) and organizations with

whom they establish a scientific or professional relationship (1) the relevant limits of confidentiality

and (2) the foreseeable uses of the information generated through their psychological activities.

(See also Standard 3.10, Informed Consent.)

Legal, institutional, or professional obligations frequently place limits on the

extent to which private information acquired during psychological activities can be

kept confidential. Psychologists are often legally required to (a) report suspected

child abuse or neglect to child protection agencies; (b) contact family members or

other professionals to protect an individual from imminent self-harm; (c) warn a

potential victim of a client’s/patient’s intent to harm him or her; (d) contact a law

enforcement agency when they have foreknowledge of certain crimes; (e) assist in

lawful military investigations; (f) provide companies, police departments, or military

agencies psychological information to determine suitability for employment,

promotion, or assignments; (g) provide treatment or assessment information in

criminal or civil cases; or (h) provide information to third-party payors when mental

health treatment is covered by a health plan.

Disclosure of such information can have serious material consequences for

clients/patients, research participants, organizational clients, and others with whom

psychologists work. Promising confidentiality without revealing its known limitations

is a misrepresentation of fact that may violate a person’s privacy and liberty

(Bersoff, 1976). Release of confidential information poses risks to individuals and

their families when disclosures lead to investigation by child protective services,

arrest, conviction, institutionalization, loss of health or disability insurance, loss of

HMO

FOR THE USE OF UNIVERSITY OF PHOENIX STUDENTS AND FACULTY ONLY.

NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

ANY AND ALL UNAUTHORIZED USE IS STRICTLY PROHIBITED.

Chapter 7 Standards on Privacy and Confidentiality——141

child custody, or social stigmatization. Disclosures of confidential information can

also lead to financial or legal risk for organizations.

Under Standard 4.02a, psychologists must discuss with persons and organizations

with whom they work reporting obligations and other limits to the confidentiality

of information that can be reasonably anticipated. This includes informing

those with whom one works about (a) state-mandated reporting requirements

related to suspicion of child maltreatment and elder abuse and foreknowledge of

specific types of crimes, and (b) the psychologist’s own professionally derived standards

for disclosing information (see Standard 4.05b , Disclosures).

Persons Legally Incapable of Consent

This requirement extends to persons who are legally incapable of giving informed

consent and their legal representatives (see Standard 3.10b, Informed Consent; “A

Word About HIPAA” in the Preface of this book). Practicing psychologists should

inform clients/patients and their legal guardians about the nature of information

that will be shared with guardians and with others based on law, institutional or

organizational regulations, or the psychologist’s policies regarding disclosure of

information related to self-harm or harm to others (Fisher, 2002a; Fisher & Oransky,

2008; Zeranski & Halgin, 2011; see also the Hot Topic, “Confidentiality and

Involvement of Parents in Mental Health Services for Children and Adolescents,” at

the end of this chapter). School psychologists may need to inform students, guardians,

and school personnel about laws governing the release of school records—for

example, FERPA, which establishes the right of parents to obtain copies of their

children’s school records (20 U.S.C. § 1232G[a][1][A]; 34 CFR § 99.11b).

Research psychologists should inform legal guardians and, to the extent possible, the

prospective participants themselves about any limitations in confidentiality. Such

limitations might include reporting requirements, if investigators are state-mandated

child abuse or elder abuse reporters, or protective policies, if the investigators have

elected to disclose to guardians or professionals information about participants with

suicidal ideation or other serious health compromising behaviors (Fisher 2002b,

2003a, 2003b; Fisher & Goodman, 2009; Fisher & Vacanti-Shova, 2012).

Third-Party Payors

When services will be covered by third-party payors, psychologists need to

inform clients/patients about information that will be shared with the third party,

including treatment plans, session notes, and diagnoses. Some contractual agreements

with health maintenance organizations (HMOs) permit utilization reviews

that provide HMO access to information about clients/patients not covered under

the policy. Clients/patients must be informed of such limits on confidentiality if

records cannot be adequately de-identified. Psychologists receiving payment

through credit cards should inform persons about the possible use of this information

by credit card companies that may sell their client lists to organizations specializing

in self-help or other related products.

FOR THE USE OF UNIVERSITY OF PHOENIX STUDENTS AND FACULTY ONLY.

NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

ANY AND ALL UNAUTHORIZED USE IS STRICTLY PROHIBITED.

142——PART II ENFORCEABLE STANDARDS

Military

In the military, there is no psychologist–client confidentiality in the traditional

sense. Military psychologists are required to release information on command to

assist in the lawful conduct of investigations or to determine suitability of persons

for service or assignments. One of the most noteworthy gains in confidentiality and

respect for the rights of the individual was the implementation of DoD Directive

6490.1 (U.S. DoD, 1997a) and DoD Instruction 6490.4 (U.S. DoD, 1997b). Thanks

to the efforts of military psychologists, active-duty service members sent for

commander-directed mental health evaluations now have (a) the right to know why

they were referred for the evaluation and who will be conducting that evaluation,

(b) an opportunity for a second opinion following receipt of a summary of the findings,

and (c) a right to speak with legal counsel, a chaplain, and a member of

Congress regarding their situation (see Orme & Doerman, 2001). W. B. Johnson,

Grasso, & Maslowski (2010) point out that actual “conflicts” between the APA Ethics

Code and military law (Standard 1.02, Conflicts between Ethics and Law, Regulations,

or Other Governing Legal Authority) can be avoided by skilled clinicians who work

within the chain of command. For example, when ordered to provide a client’s/

patient’s record under the DoD need-to-know statute, a psychologist could work

with the requesting officer to determine the specific information of interest (e.g., is

this member fit to deploy?), so that the client’s/patient’s privacy could be protected

with a general response that does not include specific details of mental health history

and current specific problems (W. B. Johnson et al., 2010).

Implications of HIPAA

Psychologists creating, transferring, analyzing, or storing PHI via electronic

transmission or working with a managed care company, bill collection agency, or

other organization that does so are required to provide individuals with a Notice

of Privacy Practices that details the uses and disclosures of PHI and the individuals’

privacy rights under relevant federal or state law (45 CFR 164.520).

Notice of Privacy Practices and informed consent forms used by psychologists

working in small group practices need to clarify the extent to which confidential

information will be shared with other practicing professionals in the group on a

regular basis and how confidentiality protections will be protected (see “A Word

About HIPAA in the Preface of this book).

(b) Unless it is not feasible or is contraindicated, the discussion of confidentiality occurs at the

outset of the relationship and thereafter as new circumstances may warrant.

Clients/patients, research participants, organizations, and others are entitled to

know the limits of confidentiality and its potential consequences before deciding

whether or how to engage in a scientific or professional relationship with a

psychologist. Standard 4.02b requires that psychologists discuss the known extent

FOR THE USE OF UNIVERSITY OF PHOENIX STUDENTS AND FACULTY ONLY.

NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

ANY AND ALL UNAUTHORIZED USE IS STRICTLY PROHIBITED.

Chapter 7 Standards on Privacy and Confidentiality——143

and limits of confidentiality at the outset of the relationship. The phrase “unless it

is not feasible or is contraindicated” permits psychologists to delay discussion of

confidentiality in cases in which the treatment needs of a new client/patient, such

as acute trauma, must take priority. It also permits delays when the limits of confidentiality

need to be further explored. For example, a therapist may need to call a

client’s/patient’s health plan to determine its utilization review policies. In such

situations, confidentiality is discussed as soon as the crisis has subsided or all information

has been obtained.

In some instances, the scientific or professional relationship may change over

time, requiring renewed discussion of confidentiality. For example, in longitudinal

studies involving children extending over several years, both participants and their

guardians may need to be reminded of confidentiality policies, especially if a change

in such policies is warranted as the child matures into adolescence or adulthood.

A psychologist whose client/patient asks him or her to testify as a fact witness

on the client/patient’s behalf should carefully explain to the client/patient how

this changes the nature of confidentiality and the implications of waiving client–

therapist privilege.

Need to Know: Should Psychologists

Search the Internet for Information on

Clients/Patients, Students, Employees,

and Others With Whom They Work?

The informational opportunities offered by new technologies raise ethical questions regarding

confidentiality and informed consent when psychologists’ search cyberspace for information

about those with whom they work. F. W. Kaslow, Patterson, and Gottlieb (2011)

suggest that intentional Internet searches conducted without the knowledge of those with

whom psychologists work may violate an individual’s expected zone of privacy, erode trust

in the professional relationship, shift the psychologist’s role to that of an investigator, and

impede the developing autonomy of clients/patients, students, or employees (Principle A:

Beneficence and Nonmaleficence; Principle B: Fidelity and Responsibility; Principle C:

Integrity; Principle E: Respect for People’s Rights and Dignity). They suggest the following:

The psychologists’ Internet search policies should be made clear at the outset of

any professional relationship and be similarly direct when the psychologist obtains

information through such a search.

Before conducting an Internet search, psychologists should consider whether it

would violate fundamental assumptions of privacy, integrity, and trust held by clients,

students, prospective employees, and others with whom they work.

Intentionally searching for information over the Internet without the knowledge of

clients, students, and others should only be undertaken when absolutely necessary

(e.g., when there is a concern about potentially violent behavior or self-harm).

Psychologists should also keep in mind that information on the Internet is not

always accurate, and they should guard against unverified assumptions.

FOR THE USE OF UNIVERSITY OF PHOENIX STUDENTS AND FACULTY ONLY.

NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

ANY AND ALL UNAUTHORIZED USE IS STRICTLY PROHIBITED.

144——PART II ENFORCEABLE STANDARDS

4.03 Recording

Before recording the voices or images of individuals to whom they provide services, psychologists

obtain permission from all such persons or their legal representatives. (See also Standards 8.03,

Informed Consent for Recording Voices and Images in Research; 8.05, Dispensing With Informed

Consent for Research; and 8.07, Deception in Research.)

Psychologists who use audio, visual, or digital recordings of voices or images to

provide services to individuals must obtain permission from all such persons or

􀀵 Psychologists conducting therapy or assessments via e-mail or through secure chat

rooms should inform clients/patients about the possibility of strangers hacking into

secure sites or, when applicable, the extent to which institutional staff have access to

secure sites on a hub server.

􀀵 Sometimes, clients/patients may send unsolicited sensitive communications to a

therapist’s personal e-mail account. Once psychologists become aware that such an

e-mail has been sent, they should inform such clients about the risks of others reading

these e-mails and discourage clients/patients from future e-mail communications if

such communications are clinically contra-indicated.

􀀵 Clients/patients who discuss sensitive information with psychologists over a cell

phone should be warned about the limits of confidentiality when this medium is

used.

􀀵 Psychologists transmitting health records to managed care companies or other health

providers need to alert clients/patients to potential breaches that may occur when

health information is passed through multiple systems, including utilization reviewers,

case managers, bookkeepers, and accountants (such information may be included in

the HIPAA Notice of Privacy Practices discussed earlier in this chapter).

􀀵 Psychologists providing services on a website should include a visible and easy to

understand privacy statement whenever a consumer’s personal information is

requested. In addition to information regarding site privacy protections (e.g. firewalls),

the privacy statement should advise consumers of how personal information will be

used (e.g., sold to other sites, used to contact the consumer at a later date) and

whether they can opt out of these uses.

clients/patients of the risks to privacy and limits of confidentiality.

Psychological services or transmission of records conducted over the Internet

and other electronic media are vulnerable to breaches in confidentiality that may

be beyond the psychologist’s individual control. Under Standard 4.02c, clients/

patients must be made aware of the risks to privacy and limitations of protections

that the psychologist can institute to guard against violations of consumer confidentiality

when information is transmitted electronically (see Standard 4.01,

Maintaining Confidentiality).

FOR THE USE OF UNIVERSITY OF PHOENIX STUDENTS AND FACULTY ONLY.

NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

ANY AND ALL UNAUTHORIZED USE IS STRICTLY PROHIBITED.

Chapter 7 Standards on Privacy and Confidentiality——145

their legal representatives before recording begins. Although exceptions exist for

informed consent to recording voices and images in research (see Standards 8.03,

8.05, and 8.07), under Standard 4.03, no such exceptions are permissible for service

providers. The following are examples of violations of this standard.

􀀴 A court-appointed forensic psychologist conducting a competency evaluation of a

prisoner audiotaped the assessment without informing the prisoner or the prisoner’s

attorney.

􀀴 A clinical psychologist conducting behavior therapy with a 6-year-old diagnosed with

attention-deficit disorder decided to videotape the therapy sessions to better analyze

the child’s behavioral responses to different situations. The psychologist did not obtain

permission from the child’s parents to videotape the session.

4.04 Minimizing Intrusions on Privacy

(a) Psychologists include in written and oral reports and consultations, only information germane

to the purpose for which the communication is made.

Clients/patients, research participants, and organizational clients often share

or unintentionally reveal private information to psychologists that may not be

germane to the purpose of the psychological activities. Under Standard 4.04,

psychologists are prohibited from including such information in their reports

or consultations. Examples of potential violations of this standard include the

following:

􀀴 A woman referred for a neuropsychological evaluation to assess the cause of a speech

disorder immediately following a head injury was accompanied to the psychologist’s

office by an individual she identified as her longtime female domestic partner. The

psychologist’s report referred to the client as a lesbian, even though sexual orientation

was not a relevant factor in the diagnosis.

􀀴 During a break in an assessment battery for a competency determination of an incarcerated

young man, the forensic psychologist heard the man brag about the crime to

another inmate. During the competency hearing, the psychologist’s expert testimony

included mention of the casual admission to the crime (for further information, see

Committee on Ethical Guidelines for Forensic Psychologists, 1991).

􀀴 A school psychologist who evaluated children with learning disabilities for academic

placement typically met with parents to obtain a developmental history and

information about the child’s study habits at home. During one of these discussions,

a parent mentioned that her husband had lost his job a few months ago. The psychologist’s

report included mention of the father’s unemployment, although it was

not a factor in the report’s conclusions regarding the child’s learning status and

schooling needs.

FOR THE USE OF UNIVERSITY OF PHOENIX STUDENTS AND FACULTY ONLY.

NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

ANY AND ALL UNAUTHORIZED USE IS STRICTLY PROHIBITED.

146——PART II ENFORCEABLE STANDARDS

Implications of HIPAA

Standard 4.04a is consistent with HIPAA regulations regarding the “minimum

necessary.” When disclosing or requesting PHI, a covered entity must make reasonable

efforts to limit the information to the minimum necessary to accomplish the

intended purpose of the use, disclosure, or request. This requirement does not

apply to disclosures to another health care provider for treatment, disclosures to the

individual client/patient, disclosures required by law, or for other purposes under

the HIPAA regulation (45 CFR 164.502[b]).

(b) Psychologists discuss confidential information obtained in their work only for appropriate

scientific or professional purposes and only with persons clearly concerned with such matters.

With rare exception (see Standards 4.05, Disclosures, and 4.07, Use of

Confidential Information for Didactic or Other Purposes), psychologists should

never discuss confidential information obtained in their work without the permission

of research participants, clients/patients, organizational clients, or others who

have been promised confidentiality. In some instances, consent is implicit or refers

to a category of individuals, such as when research participants and patients/

clients consent to have confidential information shared with members of a

research team or treatment staff.

In other instances, clients/patients with psychological impairments may not

have a legally appointed guardian but do have a family caregiver actively involved in

their treatment with whom confidential information can be shared. Standard 4.04b

requires in such situations that psychologists discuss confidential information

only with persons who are clearly concerned with the matter and limit disclosures

only to information that is pertinent to the scientific or professional issue

at hand. The intent of the standard is to permit discussions with others necessary

to competently conduct psychological activities, to prohibit unnecessary

discussion of confidential information, and to avoid the use of such information

as gossip among professionals.

􀀵 A school psychologist evaluated a fourth-grade student for placement in a special

education class. With permission and a signed authorization from the child’s parents,

the psychologist discussed the need for such a placement with the school principal.

However, the psychologist refused to discuss the child’s diagnosis when questioned by

several concerned teachers in the faculty dining room.

􀀵 A clinical gerontologist developed behavioral treatment plans for Alzheimer’s patients

at a long-term care facility. Although staff psychologists implemented the behavioral

plans, it was often necessary to coordinate the patients’ psychological services with

staff and family members. The psychologist provided nursing staff and family members

only with information they needed to ensure the consistency of the plan and carefully

refrained from sharing with anyone who was not the patient’s legal representative

information about the patient’s diagnosis or other personal information.

FOR THE USE OF UNIVERSITY OF PHOENIX STUDENTS AND FACULTY ONLY.

NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

ANY AND ALL UNAUTHORIZED USE IS STRICTLY PROHIBITED.

Chapter 7 Standards on Privacy and Confidentiality——147

HMO

Implications of HIPAA

Under the HIPAA Privacy Rule, psychologists working in independent practice,

group practices, or systems of health care are permitted to share PHI internally

(45 CFR 164.502 and 165.506). The nature of information shared is not restricted

when disclosure is with other health professionals for the purposes of providing

treatment. However, psychologists must disclose only the minimum amount of

information necessary to nontreatment personnel, such as staff responsible for

scheduling appointments or billing, to enable them to perform their duties.

4.05 Disclosures

(a) Psychologists may disclose confidential information with the appropriate consent of the organizational

client, the individual client/patient, or another legally authorized person on behalf of

the client/patient unless prohibited by law.

Standard 4.05a permits but does not require psychologists to disclose confidential

information if appropriate consent has been obtained from the organizational

client, the individual client/patient, or another legally authorized person.

Psychologists should have persons or organizations provide a signed release, provide

a signed authorization if HIPAA is applicable, or otherwise document the

permission or request to have confidential information disclosed. Documentation

should specifically identify the persons or organizations to whom confidential

information may be released, should be time limited, and should, where applicable,

be HIPAA compliant. Psychologists should not ask individual or organizational

clients to sign blanket releases for the disclosure of confidential information over

an indeterminate period of time. Before releasing confidential information at the

request of a hospital, organization, agency, or HMO, psychologists should confirm

that the institution or organization obtained appropriate consent or authorization

for the disclosure (see also the Hot Topic, “Managing the Ethics of Managed Care,”

in Chapter 9).

Implications of HIPAA

Standard 4.05a requires psychologists to be mindful of laws that prohibit disclosure.

HIPAA requires that covered entities obtain written valid authorization from

the individual or his or her personal representative prior to releasing PHI (45 CFR

164.508; see “A Word About HIPAA” in the Preface of this book for a list of authorization

criteria). In addition, when appropriate release and authorizations are

obtained, psychologists should remember to share only the minimum amount of

information necessary for billing agencies and non–health provider internal staff to

perform their roles (HIPAA, 45 CFR 164.502[b]; Standard 4.04, Minimizing

Intrusions on Privacy).

FOR THE USE OF UNIVERSITY OF PHOENIX STUDENTS AND FACULTY ONLY.

NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

ANY AND ALL UNAUTHORIZED USE IS STRICTLY PROHIBITED.

148——PART II ENFORCEABLE STANDARDS

Declining Requests

Under Standard 4.05a, psychologists may decline an appropriately obtained request

to release confidential information if the psychologist believes that disclosure will

cause harm. However, psychologists should be aware that certain federal and statutory

laws limit providers’ rights to withhold such information. Under the HIPAA Privacy

Rule, covered entities have an obligation to agree to a patient’s reasonable requests for

release of PHI and can deny a request only if it is reasonably likely to endanger the life

or physical safety of the individual or another person or is likely to cause equally substantial

harm. In addition, psychologists must allow clients/patients the right to have

the denial reviewed by a designated licensed health care professional. Readers should

refer to Chapter 12 for how decisions regarding disclosure of information relate to

Standards 9.04, Release of Test Data, and 9.11, Maintaining Test Security.

Research

Under HIPAA, an individual’s access to PHI created or obtained in the course of

treatment research may be suspended temporarily for as long as the research is in

progress, provided the individual has agreed to the denial of access when consenting

to the research and has been promised right of access upon completion of the

research (45 CFR 164.524[a][2][iii]; Standard 8.02, Informed Consent to Research).

Psychotherapy Notes and PHI Compiled

for Legal or Administrative Action

Under HIPAA patients do not have the right to access psychotherapy notes, and a

client/patient must provide a separate signed authorization specific to the release of

psychotherapy notes when a covered entity agrees to their release (see “A Word

About HIPAA” in the Preface to this book). Certain forensic records are also protected

under HIPAA. Patients do not have the right of access to information compiled

in reasonable anticipation of, or for use in, a civil, criminal, or administrative

action or procedure (45 CFR 164.508 and 164.524[a][1]). For information on other

exceptions, see discussions of Standards 6.03, Withholding Records for Nonpayment,

and 9.04, Release of Test Data.

(b) Psychologists disclose confidential information without the consent of the individual only as

mandated by law, or where permitted by law for a valid purpose such as to (1) provide needed

professional services; (2) obtain appropriate professional consultations; (3) protect the client/

patient, psychologist, or others from harm; or (4) obtain payment for services from a client/

patient, in which instance disclosure is limited to the minimum that is necessary to achieve the

purpose. (See also Standard 6.04e, Fees and Financial Arrangements.)

Standard 4.05b describes those situations in which it is ethically permissible to

disclose identifiable confidential information without the consent of an individual

FOR THE USE OF UNIVERSITY OF PHOENIX STUDENTS AND FACULTY ONLY.

NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

ANY AND ALL UNAUTHORIZED USE IS STRICTLY PROHIBITED.

Chapter 7 Standards on Privacy and Confidentiality——149

“Duty-to-Protect” Laws

A number of states have adopted “duty-to-protect” laws following the landmark

court case Tarasoff v. Regents of the University of California (1976). In this case, a

psychologist at a university health center recognized that Prosenjit Poddar, a client

with a pathological attachment to his ex-girlfriend, Tatiana Tarasoff, was a danger

to her after he made some threats. The psychologist and his supervisor notified

campus police that the client was dangerous and should be committed, but after

interviewing him, the police released him. Poddar did not return for therapy and

or organization. The standard is permissive rather than mandatory, leaving the

decision to disclose confidential information without consent under the abovelisted

categories to the psychologist’s discretion. At the same time, the standard

prohibits disclosure of confidential information without consent for any purpose

other than those listed.

Clients/patients, research participants, organizational clients, and others with

whom a psychologist works must be informed as early as feasible in the professional

or scientific relationship about the potential for such disclosures when it is reasonable

for the psychologist to anticipate that disclosures may be necessary (see

Standard 4.02, Discussing the Limits of Confidentiality).

Disclosures Mandated by Law

The standard permits psychologists to disclose confidential information without

consent when the disclosure is mandated by law.

􀀵 Following the Child Abuse Prevention and Treatment Act of 1976, all 50 states enacted

statutes mandating mental health professionals and, in at least 13 states, researchers

to report suspected child abuse or neglect, as members of the general citizenry (Liss,

1994). In addition, some states specifically require mandated reporters to alert child

protection agencies when they learn about child abuse from a client/patient who is no

longer a minor if other children are or may be at risk of being abused by the perpetrator

of the abuse. Most statutes protect mandatory reporters from liability claims,

including those for breach of confidentiality (http://childwelfare.gov/systemwide/

laws_policies/state/).

􀀵 The majority of states include psychologists as mandated reporters of elder abuse

variously defined as deliberate acts that can cause physical, emotional, or psychological

harm and nonintentional acts of neglect and self-neglect (Zeranski & Halgin, 2011).

􀀵 Some states have mandatory reporting laws for domestic abuse or situations in which

a practitioner has foreknowledge that a crime will be committed.

􀀵 Therapists are legally required at times to disclose confidential information by a court

order, even when they have informed the judge that the disclosure is inconsistent with

their ethical obligations to protect confidentiality (Standard 1.02, Conflicts Between

Ethics and Law, Regulations, or Other Governing Legal Authority).

FOR THE USE OF UNIVERSITY OF PHOENIX STUDENTS AND FACULTY ONLY.

NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

ANY AND ALL UNAUTHORIZED USE IS STRICTLY PROHIBITED.

150——PART II ENFORCEABLE STANDARDS

murdered Tatiana 2 months later. Her parents brought a successful suit against the

university, arguing that the therapist had a duty to warn Tarasoff.

Duty-to-protect laws typically require certain classes of health care providers to

inform a third party of the prospect of being harmed by a client/patient if the provider

has (a) a “special relationship” with the prospective assailant (i.e., a client–

therapist relationship), (b) the ability to predict that violence will occur (e.g., the

client/patient has made a credible threat against a third party), and (c) the ability

to identify the potential victim (i.e., the client/patient has named the potential victim).

However, state laws differ widely in psychologists’ Tarasoff-like obligations,

immunity from liability as long as the duty is discharged in good faith and, in the

case of minors, when psychologists can communicate concerns to parents

(Younggren, 2011). Some court decisions have broadened the third requirement to

a more generalized duty to protect third parties from foreseeable harm in the

absence of an identifiable victim. These cases typically involve the release from

hospitalization or the failure to commit for psychiatric treatment clients/patients

whose dangerousness to nonidentified others is foreseeable (Quattrocchi & Schopp,

2005). Psychologists are advised to keep up-to-date on evolving law in this area in

the state(s) in which they work.

Research

Psychologists should remain up to date on controversies as to whether duty-toprotect

laws apply to research or to situations involving a professional’s knowledge

of intentional or reckless transmission of HIV or other sexually transmitted diseases

to partners or other identified victims (Appelbaum & Rosenbaum, 1989;

Chenneville, 2000; Fisher, 2011; Fisher, Oransky, Mahadevan, Singer, Mirhej, &

Hodge, 2009). In addition, psychologists providing services or conducting research

over the Internet need to be familiar with state laws governing mandatory reporting

in jurisdictions where recipients of Internet services or Internet-administered

research instruments reside.

Need to Know: Assessing

Duty-to-Warn Obligations

In all situations suggesting potential harm to a third party, psychologists should carefully

consider whether the threat to harm actually meets the Tarasoff requirements described

above and consider the following questions suggested by Younggren (2011). Is there an

identifiable victim? Is the threat immediate? Is there an established scientific or clinical

basis for judging the probability of violence for the specific case (Standard 2.04, Bases

for Scientific and Professional Judgment)? Can the risk be reduced (Standard 3.04,

Avoiding Harm)? Does the psychologist have the risk management competencies

required? If not, what steps should be taken to ensure that the situation is handled competently

(Standard 2.01, Boundaries of Competence).

FOR THE USE OF UNIVERSITY OF PHOENIX STUDENTS AND FACULTY ONLY.

NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

ANY AND ALL UNAUTHORIZED USE IS STRICTLY PROHIBITED.

Chapter 7 Standards on Privacy and Confidentiality——151

School Violence

In response to the rise in public awareness of school violence, statutory and case

laws are increasingly recognizing the need to balance the interest of the state

(school) in fulfilling its duty to protect the rights of individual children and to

maintain order and ensure pupil safety. In many states, school personnel are

required or permitted to detain and question students suspected of planning acts

of violence. If a student poses a threat to a minor child, school psychologists may

notify the threatened student’s parents, supervise the potentially violent child in the

school setting, take reasonable steps to encourage out-of-school supervision, and

ensure that the student does not have access to weapons.

Systematic assessments of foreseeable school violence may include (a) a student’s

past violent, menacing, or stalking acts and the precipitants to those acts;

(b) recent events that might instigate violent behavior; (c) cognitive and physical

capability of following through on violent intentions (e.g., availability of weapons);

and (d) protective factors in place within and outside the school to prevent violence

(Jacob & Hartshorne, 2007; Reddy et al., 2001).

Privileged Communications,

Subpoenas, and Court Orders

In treatment and assessment contexts, the ethical responsibility to maintain or

disclose confidential information belongs to the psychologist, but in legal settings,

this information is classified as “privileged communications,” and the decision to

maintain or disclose such information rests with the client/patient or his or her

legal guardian. There are exceptions. Therapeutic communications are often not

privileged when clients/patients decide to make their mental health part of litigation

or when the court has ordered psychological examinations, civil commitment

hearings, or custody cases.

Practicing psychologists need to be knowledgeable about how to ethically and

legally respond to subpoenas or compelled testimony for client records or test data

(APA Committee on Legal Issues, 2006). A subpoena is issued by an attorney

instructing the psychologist to provide documents or appear for oral testimony.

Psychologists are required to respond to a subpoena, but when the subpoena asks

for “privileged communications,” psychologists cannot release confidential information

without a signed client/patient release or authorization. If no release is

forthcoming, psychologists should advise the requesting party that they are waiting

for further instruction from the presiding judge (Bennett et al., 2006). A court

order to provide documents or oral testimony is issued by a presiding judge, who

has the power to waive client/patient privilege and legally require that mental

health records be released. A court order does not preclude psychologists from

communicating to the judge their confidentiality obligations under the Ethics Code

and requesting limitations on the information released (see Standard 1.02, Conflicts

Between Ethics and Law, Regulations, or Other Governing Legal Authority). If such

requests are denied, Standard 4.05b permits psychologists to disclose records

requested.

FOR THE USE OF UNIVERSITY OF PHOENIX STUDENTS AND FACULTY ONLY.

NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

ANY AND ALL UNAUTHORIZED USE IS STRICTLY PROHIBITED.

152——PART II ENFORCEABLE STANDARDS

Disclosures Permitted by Law

Standard 4.05b also permits psychologists to disclose confidential information

without consent if the disclosure is permitted by law and the disclosure is for a valid

purpose. Valid purposes include those initiated to provide needed professional

services; obtain appropriate professional consultation; protect the client/patient,

psychologist, or others from harm; or obtain payment for services.

􀀵 It is ethically appropriate to disclose personally identifiable confidential information

to another professional or family member if such notification is required to

hospitalize or otherwise protect clients/patients, research participants, students,

or others who have indicated credible suicidal intent or who psychologists believe

to be engaged in activities that are likely to result in imminent and substantial

harm.

􀀵 Irrespective of whether the jurisdiction in which a psychologist works has a dutyto-

protect law, Standard 4.05b permits psychologists to disclose confidential

information obtained by clients/patients or research participants to protect others

from harm.

􀀵 Psychologists are permitted to report to appropriate law-enforcement agencies

credible threats to their welfare or to the welfare of their family or colleagues

made by clients/patients, students, research participants, or others with whom they

work.

􀀵 When a client/patient or organizational client fails to pay for a psychologist’s services,

the psychologist may disclose information to a bill collection agency to

obtain payment. The information must be limited to the individual’s or organization’s

name, contact information, amount of payments still outstanding, number of

sessions or billable hours for which payment is due, and other factual information

necessary to collect outstanding funds. Psychologists should not disclose to bill

collection agencies a client’s/patient’s diagnosis, the nature of treatment, or other

personal information. Nor should they disclose the purpose or nature of their work

for a company or organization (see also Standard 6.04e, Fees and Financial

Arrangements).

􀀵 In most states, school psychologists do not have a legal obligation to report student

substance abuse or criminal acts committed by students or their parents that do not

involve child abuse. However, disclosure of such information to parents or others in

authority is permissible under Standard 4.05b and, in most cases, legally permissible

(Jacob & Hartshorne, 2007).

􀀵 School psychologists are mandated by their state laws to report suspected child abuse

to the appropriate authorities; the responsibility to confirm or disconfirm the suspected

abuse is the responsibility of the child protection service not school personnel

(Jacob, Decker, & Hartshorne, 2011).

􀀵 Military psychologists may disclose sensitive patient health information of military

personnel without a client’s/patient’s signature for release to officers and

employees in the DoD when the record is needed in the performance of their

duties, such as referring military personnel for evaluation (Jeffrey, Rankin, & Jeffrey,

1992; W. B. Johnson et al., 2010).

FOR THE USE OF UNIVERSITY OF PHOENIX STUDENTS AND FACULTY ONLY.

NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

ANY AND ALL UNAUTHORIZED USE IS STRICTLY PROHIBITED.

Chapter 7 Standards on Privacy and Confidentiality——153

Suicidal Intent

Under Standard 4.05b, psychologists are permitted to disclose confidential information

to protect clients/patients from self-harm. Client/patient suicidality is a stressful

experience for practitioners and a frequent cause of malpractice suits (Bennett

et al., 2006). Good ethical practice in response to indications of suicidal intent

requires (a) competence to recognize, manage, and treat suicidality (Standard 2.01,

Boundaries of Competence); (b) identification of community resources for client/

patient emergencies outside the treatment setting; (c) development of consultative

relationships with other professionals (e.g., prescribing psychologists or psychiatrists)

to assist in case management (Standard 3.09, Cooperation With Other Professionals);

and (d) understanding of legal principles and institutional policies regarding voluntary

or involuntary commitment (Jobes, Rudd, Overholser, & Joiner, 2008).

Implications of HIPAA

Standard 4.05b is consistent with the HIPAA regulations under 45 CFR 164.512.

The Privacy Rule permits disclosure of PHI without authorization (a) when

required by law; (b) for public health activities, such as for preventing or controlling

disease, injury, or disability; (c) for individuals who the covered entity reasonably

believes to be victims of abuse, neglect, or domestic violence; (d) for health

oversight activities, such as audits, criminal investigations, or licensure or disciplinary

actions; (e) for judicial or administrative hearings; and (f) for activities deemed

necessary by appropriate military command to ensure the proper execution of the

military mission.

In some instances, HIPAA regulations may be more permissive of disclosure

without client/patient consent than either state law or the Ethics Code. For example,

HIPAA permits disclosure of information without consent for law enforcement

purposes such as reporting wounds or other physical injuries, when issued a courtordered

subpoena, or when the information sought is relevant and material to a

legitimate law enforcement inquiry. In such instances, psychologists should follow

the Ethics Code as the more stringent standard (Standard 1.02, Conflicts Between

Ethics and Law, Regulations, or Other Governing Legal Authority).

Need to Know: Disclosure in

Response to Nonsuicidal Self-Injury

in Adolescents and Young Adults

Nonsuicidal self-injury (NSSI) has become a public health problem for mental health practitioners

working with clinical and nonclinical samples of adolescents and young adults in

school and college settings (Klonsky, 2011). NSSI is defined as deliberate harm to the body

in order to reduce psychological stress without suicidal intent (Muehlenkamp & Gutierrez,

2004; Walsh, 2008). Irrespective of the client’s/patient’s degree of psychopathology,

FOR THE USE OF UNIVERSITY OF PHOENIX STUDENTS AND FACULTY ONLY.

NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

ANY AND ALL UNAUTHORIZED USE IS STRICTLY PROHIBITED.

154——PART II ENFORCEABLE STANDARDS

4.06 Consultations

When consulting with colleagues, (1) psychologists do not disclose confidential information that

reasonably could lead to the identification of a client/patient, research participant, or other person

or organization with whom they have a confidential relationship unless they have obtained the

prior consent of the person or organization or the disclosure cannot be avoided, and (2) they

disclose information only to the extent necessary to achieve the purposes of the consultation. (See

also Standard 4.01, Maintaining Confidentiality.)

Consultation with colleagues is an important means of ensuring and maintaining

the competence of one’s work and the ethical conduct of psychology. Standard 4.06

permits discussion of confidential information with colleagues without prior consent

as long as the identity of the client/patient, research participant, organizational

client, or other person with whom they have a confidential relationship can be

decisions regarding whether to disclose self-injurious behaviors to school officials, medical

practitioners, or family members requires the competencies necessary to (a) understand

the relationship of NSSI to suicidality; (b) assess the specific behaviors within the context

of the client’s/patient’s current mental health status, environmental (e.g., academic) and

interpersonal (e.g., family) stressors, and peer influences; and (c) have a developed plan

for disclosure in place to ensure the client’s/patient’s safety and promote future treatment

effectiveness (Walsh, 2008). Additional factors to be considered include the following (see

Andover, Primack, Gibb, & Pepper, 2010; Lieberman, Toste, & Heath, 2008; Nock, Joiner,

Gordon, Lloyd-Richardson, & Prinstein, 2006; Walsh, 2008):

For each case of self-injury (e.g., cutting on extremities) clearly distinguish NSSI from

suicidal behavior (e.g., cutting of arms or legs vs. the carotid artery or disclosure of

plan to use lethal methods). While NSSI is distinct from suicidal intent, the behaviors

may co-occur and a percentage of NSSI patients have a history of suicidality.

Become familiar with the ways in which young men and women differ on age of

onset, degree of medical injury, and NSSI methods.

When self-injury involves atypical areas of the body such as face, eyes, or genitals

that have been associated with psychotic decompensation—be able to distinguish

these from body piercing that may be peer rather than pathology related.

Recognize when self-injury requires medical attention and become knowledgeable

about local emergency medical services so that protective interventions can be

immediately initiated.

Even when self-injury is common, has a low risk of lethality, and does not require

medical attention, psychologists working in schools should consider whether the

self-injury can be best addressed through a referral to outpatient treatment; in

most instances parents should be informed.

When disclosing self-injuring behavior to parents, while it is helpful to distinguish

between self-harm and suicidality, it is also important to make them aware of the

possibility of future suicidal behaviors.

Psychologists working in schools should be aware of the possibility of contagion,

identify members of the at-risk peer group, and assess each student individually.

FOR THE USE OF UNIVERSITY OF PHOENIX STUDENTS AND FACULTY ONLY.

NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

ANY AND ALL UNAUTHORIZED USE IS STRICTLY PROHIBITED.

Chapter 7 Standards on Privacy and Confidentiality——155

adequately protected. In some instances, the obligation to provide the highest quality

service or to address an ethical problem may require consultation that reveals a person’s

or organization’s identity without prior consent. Standard 4.06 permits such

actions only if the disclosure cannot be avoided and the psychologist only discloses

information that is necessary to achieve the purposes of the consultation. The following

is an example of how a psychologist might comply with this standard:

􀀵 A psychologist was hired by a bank to conduct crisis counseling for employees who

had witnessed a recent armed robbery. During the course of counseling, the psychologist

came across information suggesting that one of the employees helped plan the

robbery. The psychologist consulted with a colleague and an attorney to help determine

whether the psychologist was ethically or legally required to report this information

to the company or law enforcement. Because the bank robbery had been highly

publicized, the psychologist was unable to disguise the bank’s identity. However,

during each consultation, the psychologist took specific steps to avoid mentioning the

gender, job title, or any other details about the employee in question that could lead

to personal identification.

Consultation Over the Internet

The Internet is a continuously evolving medium in which psychologists may consult

with colleagues via e-mail, professional chat rooms, or listservs to (a) provide

clients/patients with the best standard of care, (b) obtain referral or placement recommendations,

career planning or academic problems, and (e) address unexpected research participant

challenges. Psychologists seeking or offering advice over the Internet must abide

by the same ethical standards currently used in in-person or other traditional forms

of consultations. To do so, psychologists should consider the following before receiving

or providing consultation over the Internet (Behnke, 2007).

Both consultants and consultees utilizing e-mail or listservs should explicitly

acknowledge that they are engaged in the professional activity of consultation

(Principle B: Fidelity and Responsibility).

Psychologists giving advice over the Internet should only do so within the

boundaries of their professional competence and state the nature and limitations

of their expertise (Standard 2.01, Boundaries of Competence).

Psychologists requesting advice over the Internet should consider the qualifications

of those offering recommendations (Standard, 2.04, Bases for

Scientific and Professional Judgments).

E-mail communications between professionals for client/patient treatment is

part of the client’s/patient’s record and should be appropriately documented

and maintained (Standard 6.01, Documentation of Professional and Scientific

Work and Maintenance of Records). Whether listserv communications also

fall under this category will depend on the educative versus consultative

FOR THE USE OF UNIVERSITY OF PHOENIX STUDENTS AND FACULTY ONLY.

NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

ANY AND ALL UNAUTHORIZED USE IS STRICTLY PROHIBITED.

156——PART II ENFORCEABLE STANDARDS

nature of the correspondence and whether the correspondence influenced

treatment decisions.

Psychologists utilizing e-mail to obtain professional consultation from a specific

identified professional must make reasonable efforts to ensure that the

consultant has sufficient e-mail security protections, obtain appropriate consent

or permission if the disclosure of identifying information is unavoidable,

and disclose the minimal amount of information necessary for the consultation

(Standards 3.11, Psychological Services Delivered To or Through

Organizations; 4.02; Discussing the Limits of Confidentiality; 4.04, Minimizing

Intrusions on Privacy; 4.06, Consultations).

Since neither the confidentiality practices of members nor the Internet security

of listservs can be verified, psychologists seeking advice through these

sites do not disclose confidential information that could reasonably lead to

identification of a person or organization (Standards 3.11, Psychological

Services Delivered To or Through Organizations; 4.01, Maintaining

Confidentiality).

Since client/patient, organizational or other information provided on listservs

for consultation purposes is often incomplete or out of context, those

responding will not have an adequate basis for their assessment of the problem

and should acknowledge these limitations when providing recommendations

(Standard 9.01, Bases for Assessments).

Comments on listservs are public statements and psychologists are prohibited

from making statements that are knowingly false, deceptive, or fraudulent

(Standard 5.01, Avoidance of False or Deceptive Statements).

4.07 Use of Confidential Information

for Didactic or Other Purposes

Psychologists do not disclose in their writings, lectures, or other public media, confidential, personally

identifiable information concerning their clients/patients, students, research participants,

organizational clients, or other recipients of their services that they obtained during the course of

their work, unless (1) they take reasonable steps to disguise the person or organization, (2) the

person or organization has consented in writing, or (3) there is legal authorization for doing so.

Professionals, students, and the public benefit when psychologists use case material

and other examples from their scientific or professional work to illustrate

knowledge, concepts, challenges, and techniques in psychology. Psychologists must

guard against harms that can occur when such materials contain confidential, personally

identifiable information disseminated without the permission of the client/

patient, student, research participant, organizational client, or other service recipients.

Material relevant to this standard must be both confidential (the information

was shared with the psychologist under expectations that it would not be released

to others) and personally identifiable (the identity of the specific person or organization

described could be recognized by others).

FOR THE USE OF UNIVERSITY OF PHOENIX STUDENTS AND FACULTY ONLY.

NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

ANY AND ALL UNAUTHORIZED USE IS STRICTLY PROHIBITED.

Chapter 7 Standards on Privacy and Confidentiality——157

Informed Consent to Clinical Writing

Psychologists are permitted to reveal confidential information if the person or

organization has consented in writing or there is legal authorization for doing so,

such as the material being authorized for release at a public hearing. However, asking

a client’s permission to use his or her personal experiences in a public forum

can have significant effects on the therapeutic process. For example, therapists

should consider whether the request reflects a conflict of interest on the part of the

psychologist that can impair his or her effectiveness, lead to client/patient exploitation,

or otherwise harm the client (Standard 3.06, Conflict of Interest). Sieck (2012)

recommends considering the following questions when determining whether

informed consent to clinical writing is ethically appropriate: Does the client have

sufficient ego strength to engage in a thorough clinical writing informed consent

process? Are you concerned that the clinical writing consent process will reinforce

dysfunctional client behaviors? Is there insufficient time to devote to the clinical

writing informed consent process and its potential aftermath?

In many instances, clients/patients will be providing consent to clinical writing

that adequately disguises their identity. If a client/patient refuses to consent to the

psychologist’s request, it would be unethical to proceed with a disguised case

(Principle B: Fidelity and Responsibility, and Principle C: Integrity).

Disguising Information

Often, obtaining informed consent for clinical writing will be clinically contraindicated

for current or former clients/patients. In such situations, psychologists

must take reasonable steps to adequately disguise the identity of the person or

organization. When disguising information, simply using a pseudonym is insufficient

when other aspects of the case described contain details that make the individual

or organization easily identifiable. Psychologists may wish to consider

HIPAA’s policy on de-identifying private health information (see 45 CFR 164.514),

which excludes names, birthdates, and locations smaller than a state. Alterations in

names and place should be distinct from the real names (e.g., do not use the

client’s/patient’s initials in creating a pseudonym). Psychologists should also consider

changing the season or year of an event or modifying details of family composition

and other social networks that are not essential to the didactic goal.

Disguising information should not change characteristics critical to the phenomena

being portrayed (VandenBos, 2001). For example, gender or ethnicity should

not be changed if they play an important role in the services or research analyses

described. Psychologists should keep in mind that in many cases the unique nature

of each client’s/patient’s personal history and interpersonal relationships cannot be

easily de-identified, and composite cases or refraining from public presentations of

the case may be the only ethical alternative (Duffy, 2010).

The term reasonable steps in Standard 4.07 recognizes that sometimes, despite

acceptable efforts to disguise information, an individual or organization might be

recognized by others.

FOR THE USE OF UNIVERSITY OF PHOENIX STUDENTS AND FACULTY ONLY.

NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

ANY AND ALL UNAUTHORIZED USE IS STRICTLY PROHIBITED.

158——PART II ENFORCEABLE STANDARDS

Privacy can also be violated when psychologists describe individuals living in

small or distinct populations who can be readily identified by others in the community

in which they live.

􀀵 A psychologist gave a public lecture on dream analysis that included a case example

in which the occupation, family constellation, city of residence, and other patient

characteristics were disguised. However, a friend of the patient in the audience was

able to identify the patient because the patient had told the dream to her friend.

􀀴 A psychologist published ethnographic data on spiritual concerns, job stressors, and

psychological distress facing gay and lesbian teachers working in religious schools. In

the published report, the psychologist described the school where data were collected

as a prestigious Catholic school affiliated with his university. The school was readily

recognized by individuals who lived in the community, and many were able to correctly

identify respondents from the specific narratives described in the report.

HOT TOPIC

Confidentiality and Involvement of Parents in Mental

Health Services for Children and Adolescents

Involvement of parents is often a key factor in engaging children and adolescents in psychotherapy (Dailor &

Jacob, 2011; Oetzel & Scherer, 2003; Weisz & Hawley, 2002). At the same time, establishing the boundaries of

client/patient confidentiality is critical to establishing a trusting relationship among psychologist, child client/

patient, and parents (Principle B, Fidelity and Responsibility; Standard 4.01, Maintaining Confidentiality). While

federal and state laws grant minors limited access to mental health services without guardian consent, they

often permit (and sometimes require) parents to be involved in their child’s treatment plan, provide parental

access to treatment records, and permit disclosure of information to protect the child or others from harm

(English & Kenney, 2003; Weithorn, 2006).

In making confidentiality and disclosure decisions, psychologists should be aware that parent’s perceptions

of confidentiality may differ from those of their children (Byczkowski, Kollar, & Britto, 2010). Psychologists must

also consider practical issues such as the parent withdrawing the child from therapy for lack of access to

information or children’s misuse of confidentiality as a weapon in their conflict with parents. Psychologists

working with children and adolescents thus need to anticipate and consistently reevaluate how they will

balance confidentiality considerations with parental involvement in the child’s best interests.

Establishing Confidentiality Limits at the Outset of Therapy

The nature of information that will be shared with parents should begin with a consideration of the child’s

cognitive and emotional maturity, presenting problem, treatment goals, and age-appropriate expectations

regarding the role parents can play in facilitating treatment (D. J. Cohen & Cicchetti, 2006; Morris & Mather, 2007).

FOR THE USE OF UNIVERSITY OF PHOENIX STUDENTS AND FACULTY ONLY.

NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

ANY AND ALL UNAUTHORIZED USE IS STRICTLY PROHIBITED.

Chapter 7 Standards on Privacy and Confidentiality——159

For example, younger children’s cognitive limitations and dependence on significant adults suggest that

maintenance of strict confidentiality procedures may hinder treatment by failing to reflect the actual contexts

in which children grow and develop. By contrast, increasing protection of private thoughts and feelings may

facilitate treatment by demonstrating respect for older children’s developing autonomy, comprehension of the

nature and purpose of therapy, and ability to take a self-reflective perspective on their own thoughts and

feelings (Hennan, Dornbusch, Herron, & Herting, 1997).

The Consent Conference

Engaging parents and children in discussion about the nature and rationale for confidentiality and disclosure

policies is the first step to creating a trusting relationship. This can be accomplished during the consent

conference when psychologists

explain their ethical and legal responsibilities, describe the benefits of confidentiality or information

sharing relevant to the child’s developmental status and treatment plan, and provide age-appropriate

examples of the type of information that will and will not be confidential;

obtain feedback from and address client’s/patient’s and parent’s concerns; and

tailor a confidentiality policy to the cultural and familial context in which information sharing is viewed

by parent and child.

Parental Requests for Information

There will be times when parents request information the psychologist had not previously considered

appropriate for disclosure. The first response should be to determine whether the parents’ request relates to an

issue that does not require confidentiality consideration. While parental demands should never supersede

ethical, legal, and professional responsibilities to protect client/patient confidentiality, they should always be

given the following respectful considerations (Fisher et al., 1999; Mitchell, Disque, & Robertson, 2002; L. Taylor &

Adelman, 1989):

Employ empathic listening skills and convey respect for parental concerns.

Assume, unless there is information to the contrary, that parents’ queries reflect a genuine concern

about their child’s welfare.

Avoid turning parental requests for information into a power struggle among psychologist, parent, and

client/patient.

Guard against taking on the role of therapist or counselor to the parent (Standard 3.05, Multiple

Relationships).

Help the parent reframe confidentiality in terms of (a) the child’s developing autonomy, (b) encouraging

the child to share information with parents by choice rather than requirement, and (c) maintaining

therapeutic trust.

If appropriate, suggest that the parent ask the child about the desired information or, with the parent’s

knowledge, explore with the child about clinically indicated ways in which information might

be shared.

Disclosing Confidential Information

in Response to Client/Patient Risk Behavior

Psychologists working with children and adolescents often become aware of behaviors hidden from parents

that place the child at some physical, psychological, or legal risk. Sexual activity, alcohol and drug use, gang

involvement, truancy, and vandalism or theft are some of the “secret” activities that require consideration for

FOR THE USE OF UNIVERSITY OF PHOENIX STUDENTS AND FACULTY ONLY.

NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

ANY AND ALL UNAUTHORIZED USE IS STRICTLY PROHIBITED.

160——PART II ENFORCEABLE STANDARDS

the protection of others or whether confidentiality or disclosure is in the best therapeutic interests of the child

(Standard 4.05, Disclosures).

For example, disclosures can lead to physical protections for a child who is beginning to show signs

of an eating disorder or involvement in gang behavior through increased parental monitoring of

behaviors in and outside the home. Alternatively, sharing such information with parents may damage the

therapeutic alliance or place the child at greater risk if parental reactions can be predicted to be

physically violent or emotionally abusive. For example, the consequences of disclosing to parents highrisk

sexual activity of lesbian, gay, bisexual, transgendered, and questioning youth (LGBTQ) who have not

discussed their sexual orientation with their parents are more complex and potentially more hazardous

than would occur when disclosing information regarding a minor’s heterosexual activities (Ginsberg et al.,

2002; Lemoire & Chen, 2005).

Psychologists must also consider how entering into a secrecy pact with a minor client can adversely affect

the therapeutic alliance and be wary when assuming that minor clients expect and desire confidentiality when

they reveal during therapy that they are engaging in high-risk behaviors (Fisher, 2003a).

Steps to consider in deciding whether and how to disclose confidential information when clients/patients

are engaging in high-risk behaviors include the following.

Step 1: Assess and Clinically Address Risk Behaviors

Confirm that the child is actually engaging in the risk behavior and whether it is an isolated incident or

a continuing pattern.

Evaluate the danger of the behavior to the client/patient or others.

Assess developmental, psychological, and situational factors that might impair the child’s ability to

terminate or reduce behaviors.

Conduct intervention strategies to help the client/patient terminate or reduce risk levels of behavior.

Monitor whether the client/patient has terminated or limited the behavior.

Step 2: Consider Options if Client/Patient Is Unable or Unwilling to Terminate or Reduce Behaviors

Know federal and state laws on reporting requirements regarding prior or planned self-harming, illegal,

or violent client/patient behavior.

Weigh legal, therapeutic, social, and health consequences of confidentiality and disclosure for the client/

patient.

Anticipate, to the extent possible, parents’ ability to appropriately respond to disclosure.

Consult with other professionals regarding alternatives to disclosure (Standard 3.09, Cooperation With

Other Professionals).

Step 3: Prepare Client/Patient for Disclosure

Frame the current need to disclose information in terms of the limits of confidentiality discussed during

informed consent and the psychologist’s responsibility to protect the welfare of the client/patient

and others.

Respond to the child’s feelings and concerns while focusing discussion on the process of disclosure and

not on ways to avoid it.

Evaluate the client’s/patient’s willingness and ability to disclose information to parents.

When appropriate, go over the steps that will be taken to share the information with parents and

involve the client/patient as much as possible.

FOR THE USE OF UNIVERSITY OF PHOENIX STUDENTS AND FACULTY ONLY.

NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

ANY AND ALL UNAUTHORIZED USE IS STRICTLY PROHIBITED.

Chapter 7 Standards on Privacy and Confidentiality——161

Step 4: Disclosing Information to Parents

Involve the client/patient as much as clinically appropriate in the disclosure discussion.

Focus on the positive actions parents can take to help their child and, whenever feasible, to place the

child’s actions within the context of continued treatment progress.

Discuss additional treatment options such as joint parent–child or more frequent goal-setting sessions.

Identify appropriate referral sources for parents to help them address their child’s behaviors following

disclosure.

Empathize with and respond to the parent’s feelings and concerns, and refer the parent to individual

counseling if it appears necessary.

Schedule one or more follow-up meetings with parents and clients/patients to monitor their reactions

to the disclosure and the steps taken to reduce the risk behaviors and provide additional recommendations

if necessary.

If the risk increases or remains at dangerous levels, consider other therapeutic, community, and legal

options.

FOR THE USE OF UNIVERSITY OF PHOENIX STUDENTS AND FACULTY ONLY.

NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

ANY AND ALL UNAUTHORIZED USE IS STRICTLY PROHIBITED.