Confidentiality in Rehabilitation Counseling: Boundaries and Ethical Exceptions

Confidentiality is not simply a professional courtesy in rehabilitation counseling – it is the ethical and legal foundation on which the entire therapeutic relationship is built. When a client shares their medical history, disability status, personal struggles, or vocational challenges, they are extending trust. That trust depends on a clear, enforceable commitment to privacy. Yet confidentiality is not absolute. Understanding where its boundaries lie – and when those boundaries must give way to broader obligations – is one of the most critical competencies a rehabilitation counselor can develop.

Why confidentiality matters in rehabilitation counseling 🔗

Confidentiality is the cornerstone of effective counseling and psychotherapy services. It builds trust and openness between client and counselor, making it easier for clients to share sensitive details about their lives, thoughts, and experiences. Without this assurance, many people would avoid seeking help altogether due to fear of stigma, embarrassment, or legal consequences.

In rehabilitation counseling specifically, clients often carry compounding vulnerabilities – disability, unemployment, social isolation, or past trauma. Privacy concerns can act as a genuine barrier to people who might otherwise seek help, and a legally enforced framework for protecting client information increases the likelihood that those who need support will actually reach out. The Commission on Rehabilitation Counselor Certification (CRCC) makes this explicit: trust is recognized as the cornerstone of the counseling relationship, and counselors are ethically bound to establish and uphold it through confidentiality.

Communicating confidentiality clearly – and culturally 🔗

Rehabilitation counselors are required to communicate the legal and ethical parameters of confidentiality to clients in a culturally competent manner. This is not a formality to handle at intake and forget. Privacy norms vary significantly across cultures – in some communities, information is considered shared property of the family or community rather than something belonging solely to the individual. A counselor who fails to account for this may inadvertently cause harm by treating confidentiality as a one-size-fits-all concept. Clients must understand from the outset what will be kept private, what will not, and under what circumstances disclosure might become necessary – explained in a way that is accessible, not buried in legal boilerplate.

Handling client information securely 🔗

Responsible confidentiality goes beyond verbal promises. Counselors are expected to collect private information from clients only when it is beneficial to the rehabilitation counseling process, and to ensure that records are stored securely, accessible only to authorized personnel. This principle of data minimization – collect what you need, protect what you collect – reduces both legal risk and ethical exposure.

The HIPAA minimum necessary standard requires that only the minimum amount of information be used or disclosed to achieve the purpose of a given interaction. In practice, this means a counselor discussing a client with a supervising team should share only the details directly relevant to the decision at hand, not the full scope of what the client has disclosed.

Electronic communications introduce additional vulnerabilities. Sending client information via unencrypted email, using non-secure telehealth platforms, or storing records on unsecured devices all constitute potential breaches. HIPAA requires covered entities to take appropriate steps to safeguard protected health information (PHI), and therapists who conduct electronic transactions are bound by these requirements. When in doubt, the standard is simple: if a communication method wouldn’t be acceptable for sharing a client’s most sensitive details, it should not be used for any client information.

Psychotherapy notes: a special category 🔗

Not all counseling records carry the same level of protection. Under HIPAA, psychotherapy notes – defined as notes recorded by a mental health professional documenting the contents of a private counseling session, kept separately from the main medical record – receive heightened protections and generally require patient authorization before disclosure for any reason. These notes are treated differently because they contain particularly sensitive material and are primarily for the treating professional’s own clinical use. This distinction matters: a client’s treatment plan or session attendance record is not a psychotherapy note and carries different disclosure rules.

Exceptions to confidentiality 🔗

Every counselor needs to know when they are not only permitted, but sometimes legally required, to breach confidentiality. The CRCC Code of Ethics is clear: the general requirement to keep information confidential does not apply when disclosure is required to protect clients or identified others from serious and foreseeable harm, or when legal requirements demand it. These exceptions exist not to undermine the therapeutic relationship, but to ensure that counselors do not become passive bystanders when lives are at risk.

The duty to warn: the Tarasoff principle 🔗

The most widely discussed exception to confidentiality is the duty to warn, which emerged from the landmark Tarasoff v. Regents of the University of California case. In 1969, a graduate student disclosed to his university counselor that he intended to harm a fellow student, Tatiana Tarasoff. The counselor notified campus police but did not warn Tarasoff directly. She was subsequently killed. The California Supreme Court’s ruling established that when a patient presents a credible threat to an identifiable third party, the therapist has a legal duty to use reasonable care to protect that person – whether by warning the potential victim, notifying police, or taking other appropriate steps.

The Tarasoff decision ultimately established that confidentiality and privilege are not absolute, especially when a patient communicates a seemingly legitimate threat that endangers a third party. Since then, most U.S. states have adopted some form of duty-to-warn or duty-to-protect legislation, though the specifics vary – some states impose a mandatory duty, others a permissive one. Rehabilitation counselors must know which framework applies in their jurisdiction.

It is also worth noting a critical clinical point: when faced with a potential duty-to-protect scenario, counselors should first address it as a clinical issue and consider an array of options before breaching confidentiality, as clinical interventions may eliminate the need to do so entirely.

Legal orders and mandatory reporting 🔗

Courts can compel disclosure of client information through subpoenas and court orders. In such cases, counselors are legally obligated to comply – though they should consult with legal counsel before doing so, and disclose only the minimum information the order requires. Separately, most jurisdictions mandate the reporting of suspected child abuse or neglect, elder abuse, and certain other forms of harm, regardless of client consent. Counselors are required to explain their obligation to report suspected abuse or neglect or foreseeable danger at the beginning of the counseling relationship, not after such a situation arises.

Life-threatening communicable diseases 🔗

Communicable diseases present a distinctive ethical challenge. State law generally requires the reporting of certain communicable or infectious diseases to public health authorities – and this obligation overrides the client’s right to privacy in those specific cases. The rationale is straightforward: society’s interest in containing a serious public health threat can outweigh an individual’s right to confidentiality.

HIV/AIDS has historically been the most debated example. Public health regulations have often concluded that confidentiality can be compromised in certain circumstances, mandating the reporting of HIV-positive individuals to public health authorities in the interest of accurate epidemiological information and community safety. However, disclosure must always be carefully weighed – many public health experts also recognize that overly broad breaches of confidentiality can discourage at-risk individuals from seeking testing or treatment in the first place, ultimately worsening public health outcomes.

Using ethical decision-making models 🔗

None of these exceptions are mechanical triggers. Each situation requires careful professional judgment. The CRCC Code of Ethics requires counselors to use a credible ethical decision-making model that can withstand public scrutiny, and to consult with supervisors, legal and ethical experts, and colleagues when legal and ethical standards appear to conflict. When unsure about the validity of an exception to confidentiality, counselors are expected to seek supervision or consultation and document the recommendations they receive. This documentation is not just good practice – it is a professional safeguard.

Confidentiality in group counseling 🔗

Group counseling introduces a layer of complexity that individual counseling does not: a counselor cannot control what other group members do with the information they hear. Rehabilitation counselors are required to advise group members of the limitations of confidentiality and to make clear that confidentiality among group members themselves cannot be guaranteed.

In practice, this means establishing explicit group agreements at the outset – every member acknowledges the expectation of mutual confidentiality, even though the counselor cannot legally enforce it on their behalf. These agreements should be discussed openly, not simply signed and filed away. The goal is to build a group culture where privacy is treated as a shared ethical responsibility, not a rule imposed from outside. Clients who are aware of these limitations from the beginning can make informed decisions about what to share and with whom.

Confidentiality in couples and family counseling 🔗

When a rehabilitation counselor works with couples or families, the question of who the client is becomes genuinely complex. Is it the individual? The couple as a unit? The family system? The CRCC Code of Ethics requires counselors to clearly define who the clients are in couples and family counseling, to discuss the expectations and limitations of confidentiality with all involved parties, and to document in writing each individual’s agreed-upon right to confidentiality.

A particularly sensitive issue arises when one partner discloses something privately to the counselor – a secret, a concern, or a disclosure that the other partner is not aware of. Counselors must clearly define whether they will or will not share information communicated privately by one party with other family members, and this position must be established and agreed upon before any such disclosure occurs. Without a clear policy, the counselor risks becoming entangled in the couple’s or family’s dynamics in ways that compromise both therapeutic effectiveness and ethical integrity.

Written informed consent that spells out these boundaries is not optional – it is essential. It protects the client, the counselor, and the therapeutic relationship. And it signals to everyone involved that confidentiality in this context is a serious, actively managed commitment, not a vague assumption.

Confidentiality as ongoing practice, not a one-time disclosure 🔗

One of the most common mistakes in counseling practice is treating confidentiality as a box to check at intake. In reality, the boundaries of confidentiality need to be revisited throughout the counseling relationship – when new sensitive information surfaces, when a client’s situation changes, or when legal or ethical circumstances shift. Regular confidentiality reviews build transparency and trust in the therapeutic relationship, creating an environment where clients feel comfortable sharing openly.

Rehabilitation counselors who handle confidentiality well do more than protect client data. They actively strengthen the therapeutic relationship with every honest conversation about what privacy means in the context of that client’s care. That ongoing commitment – transparent, culturally informed, and ethically grounded – is what transforms confidentiality from a legal requirement into a genuine act of professional care.

What do you think? If a client in a rehabilitation counseling setting discloses information that puts a third party at risk, how should a counselor weigh the duty to warn against the potential damage to the therapeutic relationship? And in group or couples counseling, where the counselor cannot fully guarantee privacy, how much does that limitation change what clients should reasonably be expected to share?

References

1. https://www.mentalyc.com/blog/exceptions-to-confidentiality-in-counseling
2. https://www.goodtherapy.org/for-professionals/software-technology/hipaa-security/article/hipaa-for-mental-health-professionals-the-basics
3. https://crccertification.com/code-of-ethics-4/
4. https://www.usf.edu/cbcs/cfs/documents/crc-code-of-ethics.pdf
5. https://www.hipaajournal.com/hipaa-for-therapists/
6. https://blog.hushmail.com/blog/hipaa-therapists
7. https://www.hhs.gov/hipaa/for-professionals/faq/2088/does-hipaa-provide-extra-protections-mental-health-information-compared-other-health.html
8. https://www.ncbi.nlm.nih.gov/books/NBK542236/
9. https://psychiatryonline.org/doi/10.1176/appi.ajp-rj.2018.130402
10. https://www.psychiatrictimes.com/view/psychiatric-malpractice-grand-rounds-tarasoff-dilemma
11. http://depts.washington.edu/bhdept/ethics-medicine/bioethics-topics/articles/confidentiality
12. https://www.practicalbioethics.org/professional-education-and-clinical-ethics/patient-physician-relationship/case-study-tatiana-tarasoff-a-duty-to-warn/
13. https://crccertification.com/wp-content/uploads/2023/04/2023-Code-of-Ethics.pdf
14. https://www.naadac.org/code-of-ethics
15. https://www.michigan.gov/-/media/Project/Websites/leo/Documents/WDCA-VOC-REHAB/wca_vr_code_ethics.pdf?rev=ab3d35c5cc394a2f8c87eb2a5ced1c6a