How to Keep Client Information Confidential

university-of-oregon-confidentiality-caseHow confidential is confidential information? Oregon is rolling in mental-health scandal issues right now. The one that’s most in the news is from the University of Oregon, where a rape victim went to the student mental health center, and when she accused some athletes of the crime, the University’s lawyers plucked her records out of her files. This was done without the consent of the patient or her therapist, by the psychologist in charge of the counseling center, whose job title, Vice President for Student Life, has thus become a sad joke. People at the center who protested had their jobs threatened.

No one has been arrested in either the rape or the theft of the documents. All that’s likely to happen is a disciplinary hearing in front of the Oregon State Bar regarding the University’s lawyers who asked for the documents, and one in front of the Oregon Board of Psychologist Examiners for the University vice president (who is a licensed psychologist) for handing them over.

None of this helps the victim, of course.

So How Do You Protect Your Clients?

Let’s assume that this level of cowardice and wrong-doing is typical, not only of the organizations, but even of clinicians in private practice. How can you ensure that you never make this kind of mistake? How can you make it hard for supervisors and coworkers to make this mistake behind your back?

I’ll cover:

  • Not handing over your records without a fight.
  • How to fight over handing over records.
  • My take on what to put into records.


Don’t Hand Over Records Without a Fight

Expect your coworkers and supervisors to be easily fooled or frightened, and will give your client records to anyone who wants them. People will often claim to have a firm policy about confidentiality, but then roll over as soon as someone in a suit demands the records. Don’t be that person!

So if you want to protect your clients from the malfeasance or cowardice of others, you need to be physically in control of the records. So keep ’em safe:

  • Keep your records under lock and key, and don’t give anyone the key. Two locks are better than one: my client records are in a locked filing cabinet in a locked office. Once in a while I forget to lock one or the other, but never both.
  • If you keep records electronically, use the electronic equivalent of lock and key. While the fine points of security are hard, the basics are pretty basic.
  • If you’re at an organization that stores records centrally,  see if you can bypass the process. If not, stay alert for a better job opening. I’d be tempted to have the central records contain the stuff it must contain (contact information, session schedule, billing codes), but I’d draw the line at actual descriptions of basically anything at all. Just a note saying, “See private notes.”

How to Resist Handing Over Records

This is actually quite simple.

  • If someone wants records, and your client hasn’t signed a release, you simply say that you release no client records, nor do you confirm that someone is your client, without a written release.
  • If someone wants records, and presents you with something purporting to be a release from your client, accept the release, then send them packing. Say you’ll be in touch. You don’t want them looming over you for the next part. After they’re gone, call your client and confirm that the release is genuine. If it is, discover what it’s for. If it seems legitimate, okay. Share no information that’s outside the scope of the client’s intended use.
  • Suppose you receive a subpeona for the records? Or a licensing board demands records? That’s what lawyers are for. Hand over nothing, discuss nothing. Simply say you always consult with your lawyer when dealing with legal issues or legal documents. Send them packing and say you’ll be in touch. Many things that purport to be a subpeona for client records have no force of law. Don’t be a sucker. Let your lawyer figure it out. If you don’t have a lawyer already, don’t worry, getting one is the easiest thing in the world, especially when you have something for them to do right away. Then let your lawyer do all your talking for you. Sometimes I think that having a lawyer handle all the stressful conversations is as valuable as their legal advice.
  • If your client doesn’t want these records divulged, ask your lawyer to get you off the hook. If you can’t be gotten off the hook, ask your lawyer to buy you (and your client) time. People sometimes drop cases or otherwise wander off if given time to do so. The legal process is surprisingly sloppy, so it’s good to give the other side a chance to drop the ball.
  • Basically you want to protect your client as much as you can, but not to the point of being held in contempt of court. Your lawyer knows how to play this game.

How Detailed Should Client Records Be?

One of the things I like about being an exempt practitioner is that I simply ignore the kinds of busywork that other people do. As a hypnotherapist, I’m doing short-term, solutions-based therapy. This means that there’s a lot of stuff  I don’t have to do:

  • I don’t take a detailed case history — or any case history, unless “How long have you been smoking?” counts as a case history. Clients come to see me for the problems they have now. Going back to the problem’s origin is one way of working with a problem, but it’s optional, and it’s irrelevant to my first sessions. It’s appalling that people say, “Hi, how are you, we’ve just met, tell me all your deepest, darkest secrets.”
  • I don’t do a diagnosis. It’s not just that, given the way I work, a diagnosis would be meaningless busywork that wastes the client’s time and money. It’s also that, if I’m going to burden a client with some kind of label, it’s damn well going to be a label that’s therapeutic in itself, and not some kind of scary mental disease diagnosis!
  • I make few notes. Why should I take detailed notes? During the session, I’m busy, and afterwards, my plan for the next session is always the same: reinforce progress, and do something new for those aspects of the problem that have shown little progress. The client, and not my notes, is the repository of what’s happening with the client. My notes often contain fewer than a dozen words per session, just a few key words or phrases that the client said, that I want to use verbatim later in the session, plus a telegraphic list of the processes we used.

The upshot is that, if someone wanted to hurt my client through stolen case notes, yeah — good luck with that.

On the other hand, I can use my notes to help a client. There’s enough there that I can confidently give testimony on a client’s behalf at some later time.

I’m not saying that this is the kind of note-taking that everyone should use. Licensed therapists have rules they’re supposed to follow, and you might as well follow them to the extent that they don’t expose your clients to harm. Nor am I familiar with every kind of therapy, so I can’t say whether some of them rely for on copious, frequently re-read notes for good therapeutic outcomes. If so, such notes should be especially well guarded.


Leave a Reply

Your email address will not be published. Required fields are marked *