The best time to explain confidentiality is at the very start of your first session, before the client shares anything personal. This conversation sets the foundation of trust for everything that follows, and getting it right means being clear, specific, and honest about both what you will protect and what you legally cannot.
Most clinicians cover confidentiality in writing through intake forms, but the written version alone isn’t enough. Walking through it verbally, in plain language, gives your client the chance to ask questions and actually absorb what they’re agreeing to. Here’s how to do it well.
Start Before They Start Talking
Confidentiality should be the first substantive thing you discuss. Before your client tells you why they’re there, explain what happens to the information they share. This order matters: if someone discloses something that triggers a mandatory report in the first five minutes, and you haven’t yet explained that obligation, you’ve damaged the relationship before it began.
A natural way to open is to reference the intake paperwork. You might say something like: “Before we get into what brought you here, I want to walk through a few things from the forms you signed, especially around privacy. I want you to know exactly what I can and can’t keep between us.” This frames the conversation as collaborative rather than legalistic. You’re giving them information they need to make choices about what they share and when.
Explain the Rule, Then the Exceptions
Start with the broad protection. Everything your client says in session is private. You won’t confirm or deny to anyone that they’re your client. If a parent, partner, employer, or professor calls your office, you can’t even acknowledge that you know the person. If someone outside your practice wants information, you need the client’s written permission before releasing anything. This is the baseline, and it helps to state it plainly so the exceptions don’t overshadow the rule.
Then walk through the situations where you’re legally required to break that protection. These vary somewhat by state, but the core exceptions are consistent across the U.S.:
- Risk of harm to self. If a client presents an imminent risk of serious injury to themselves, you’re obligated to take steps to ensure their safety. That may mean contacting emergency services or a designated support person, but you’d release only the minimum information necessary.
- Risk of harm to others. If a client makes a credible threat of serious harm to another person, you have a duty to act to protect that person. Again, only the information needed to ensure safety gets shared.
- Abuse or neglect of vulnerable people. Mandatory reporting laws require you to report suspected abuse or neglect of children, and in most states, of elderly or disabled individuals as well. Some states extend this to intimate partner abuse. The report goes to the appropriate state or local agency.
Keep the language concrete. Rather than saying “I’m a mandated reporter,” which many clients won’t fully understand, try: “If I learn that a child is being hurt or neglected, I’m required by law to report that to child protective services. I don’t have a choice in that situation, even if you ask me not to.” Being direct here actually builds trust. Clients may not love hearing the exceptions, but they respect knowing about them upfront.
Use Language Your Client Actually Understands
Legal and ethical codes use phrases like “limits to confidentiality” and “extraordinary circumstances.” Your client doesn’t think in those terms. Translate everything into the simplest version of itself. Instead of “I’m bound by HIPAA regulations regarding your protected health information,” try: “There’s a federal law that protects your health information. It means I can’t share your records without your permission, and I’m required to keep your information secure.”
Watch for the glazed-over look. Many clients nod through the confidentiality discussion the way people click “I agree” on a software update. Slow down. Ask if they have questions. Give a concrete example: “So if your mom calls and asks how therapy is going, I’d say I can neither confirm nor deny that you’re a client here. That’s true even if you’ve told her you’re coming to see me.” Examples like this make abstract protections feel real.
Addressing Court Orders and Third-Party Referrals
If a court orders the release of records, you’re generally required to comply, though the scope of what gets released can sometimes be narrowed. Clients involved in legal proceedings, custody disputes, or workplace complaints should know this. A simple explanation works: “If a judge orders me to provide your records or testify, I may be legally required to do so. I’d let you know if that ever came up.”
When a client is referred by a third party, such as an employer, a school, or a court, clarify the arrangement right away. The APA Ethics Code specifically calls for psychologists to explain who the client is, what role the clinician is playing, and how the information may be used. If you’re doing a fitness-for-duty evaluation, for example, your client needs to understand that your report goes back to the referring party and that this isn’t a traditional therapy relationship with the same privacy protections.
Confidentiality With Minors
Working with adolescents means navigating a three-way relationship between you, the young person, and their parents or guardians. The specifics depend on your jurisdiction, but the general principle is this: as a minor matures, their right to privacy grows.
Many jurisdictions place the responsibility on the clinician to assess whether a particular adolescent has the maturity to make decisions about their own health information. When a young person is considered a “mature minor,” they can consent to keeping their health records private. Some jurisdictions set specific age thresholds. In Quebec, for instance, adolescents 14 and older control access to their medical records. In Newfoundland and Labrador, that right begins at 16.
The practical approach is to have this conversation with both the teen and the parent present at the start. Explain to the parent that therapy works best when the young person feels safe to speak freely, and outline what you will and won’t share. Most clinicians tell parents they’ll provide general updates on progress without revealing the content of sessions, unless one of the standard safety exceptions applies. Then, with the teen alone, reinforce that what they say stays between you, with those same exceptions. Both the adolescent and the parent should leave that first meeting knowing exactly where the boundaries are.
Telehealth Adds Extra Layers
If you’re providing remote sessions, confidentiality isn’t just about what you do with information. It’s also about the physical and digital environment on both ends of the call. Your client needs to understand risks that don’t exist in an office setting.
On the environmental side, the biggest issue is being overheard. A client in a small apartment or a large household may not have a private room. Someone could walk in mid-session. Ask your client where they plan to be during sessions and whether they can use headphones. These small practical steps matter more than any written disclosure.
On the technology side, explain that while you use a secure, encrypted platform, no digital system is completely immune to technical errors or connectivity issues. Email is not a secure messaging system, so you won’t send confidential information that way. If you use a client portal or secure messaging feature, explain how that differs from regular email. And if your client wants appointment reminders by text or email, let them know those messages won’t reference the nature of the appointment.
Put It in Writing, Then Revisit It
Your verbal explanation should be backed by a written document. Federal law requires covered health care providers to give clients a Notice of Privacy Practices, make that notice available on any website they maintain, and provide a copy to anyone who asks. Starting in February 2026, providers who handle substance use disorder records will also need to include specific information about how those records are protected.
But the conversation shouldn’t happen once and never again. Revisit confidentiality whenever circumstances change: if a client begins discussing a custody battle, if you start couples sessions, if a new person enters the treatment (like a psychiatrist you’d like to coordinate with), or if your client’s living situation changes and affects telehealth privacy. Each of these moments is a chance to reinforce what’s protected and what isn’t.
Some clinicians also find it useful to check back in periodically even when nothing has changed. A brief “Do you have any questions about how your privacy works here?” a few sessions in can catch concerns your client didn’t think to raise on day one, when they were already processing a lot of new information.
Sample Language You Can Adapt
Here’s a template for the verbal explanation at your first session. Adjust the details to match your state laws and practice setting:
“Everything we talk about in here is confidential. I won’t share it with anyone without your written permission. If someone calls asking about you, I won’t even confirm that I know you. There are a few exceptions I’m required to tell you about. If I believe you’re in immediate danger of hurting yourself, I’ll take steps to help keep you safe, and that might mean contacting someone. If you tell me you plan to seriously harm another person, I’m required to act to protect them. And if I learn that a child, elderly person, or someone with a disability is being abused or neglected, I’m required by law to report that. Outside of those situations, what you say here stays here. Do you have any questions about that?”
This version is clear, takes under a minute to say, and covers the essentials without burying your client in legal language. It also ends with an invitation to ask questions, which turns a monologue into a conversation.