Domain 1 · Professional Practice & Ethics · Lesson 3 of 11

Confidentiality, privileged communication, and the duty to warn and protect

11 min read · Dr. Andrew WichtermanCACREP: Professional Orientation & Ethics

Last reviewed September 2026 by Dr. Andrew Wichterman · Aligned to the current NCE blueprint. Valid for exams through June 30, 2027.

AI-narrated overview made with Google NotebookLM. The written lesson below is by Dr. Andrew Wichterman.

Downloads Lesson notes (PDF) Slides (PDF)

Confidentiality is the most heavily tested single topic in the ethics domain. The items are usually scenarios: something has been disclosed, and you must decide whether it stays in the room.

Before you read: three questions

Try to answer each from memory first, even if you have to guess. Guessing before reading makes the answer stick; reveal only after you have tried.

What is Confidentiality?Ethical duty not to disclose.
What is Privileged communication?Legal right, belongs to the client, exists by statute.
What is Tarasoff?Duty to protect an identifiable third party.

Confidentiality is an ethical duty: the counselor does not disclose what the client shares. Privacy is the client's broader right to control information about themselves. Privileged communication is a legal concept: a client's right to prevent their counselor from testifying in court. Privilege belongs to the client, not the counselor, and it exists only where a statute grants it. The client can waive it; the counselor cannot assert it against the client's wishes.

The standard exceptions

Confidentiality yields when there is serious and foreseeable harm to the client or others; when abuse or neglect of a child, elder or dependent adult is suspected, which is a mandated report in every state; when a court orders disclosure; when the client gives informed written consent; and, with limits, when the client has a life-threatening communicable disease and a third party is at demonstrable risk, which the Code permits but does not require after confirming the diagnosis and that the client has not informed the partner.

Exceptions are exactly that. The default is silence, and each exception is narrow.

Tarasoff and the duty to warn and protect

Tarasoff v. Regents of the University of California (1976) established that a therapist who knows or should know that a client poses a serious danger to an identifiable third party has a duty to take reasonable steps to protect that person. The 1976 ruling is often summarized as the duty to warn; the court's language was broader, a duty to protect, which may be met by warning the victim, notifying police, or hospitalizing the client.

State laws differ. Some mandate action, some permit it, a few have no statute. The exam's answer generally follows the Code and Tarasoff: assess the threat, consult, and take the least intrusive step that protects the third party.

Minors and families

Minors have an ethical right to confidentiality but often not a legal one; parents or guardians generally hold the legal right to information. The Code asks counselors to balance the minor's need for privacy with the guardian's rights, to explain the limits at the outset, and to involve the minor in decisions about disclosure where possible. In couples and family counseling, the counselor must clarify at the start who the client is and what will be shared; secrets policies vary and must be stated.

Records, HIPAA and subpoenas

HIPAA governs protected health information for covered entities and sets standards for storage, transmission and client access to records. Clients generally have a right to access their records; the counselor may limit access when it would harm the client and must document the reason. A subpoena is a request, not an order; the appropriate response is to consult with an attorney and the client, assert privilege if it applies, and release only what a court order compels.

Deceased clients and groups

Confidentiality survives the client's death. In group counseling, the leader explains that confidentiality cannot be guaranteed because members are not bound by the Code, and sets group norms about it. Both facts are common single-fact items.

Exam tip. When a scenario contains a threat, the exam almost never wants "immediately call the police" or "do nothing." It wants assessment of the threat's seriousness and imminence, consultation, and then the least intrusive protective step.
Report a problem with this lesson
Two-minute brain dump

Without scrolling up, write everything you remember from this lesson. Then check yourself against the key terms. Recalling the whole lesson once, right after reading it, does more than reading it twice.

Confidentiality Privileged communication Tarasoff (1976) Mandated report Subpoena HIPAA
Keep going

Ten more questions from the whole domain, with an explanation after each answer.

Practice the whole domain