If a therapist breaks confidentiality without legal justification, they can face licensing board discipline, civil lawsuits, and federal privacy penalties. But the answer gets more complicated because therapists are sometimes legally required to break confidentiality, and those situations are not violations at all. Understanding the difference matters, whether you’re concerned about something your therapist disclosed or you’re trying to figure out what protections you actually have.
When Therapists Are Required to Break Confidentiality
Therapists don’t have absolute discretion over your information. Several situations legally compel them to disclose what you’ve shared, and refusing to do so in these cases would itself be an ethical violation.
The most clear-cut mandate involves child abuse. If a therapist suspects a client under 18 is being abused, they must call and file a written report with Child Protective Services. As the American Psychological Association puts it, “there is no choice in the matter of reporting.” The same applies if a client discloses child abuse or child sexual assault involving any minor, not just a child they’re treating. Elder abuse follows similar rules: therapists must report suspected physical abuse of anyone over 65, and in many states they may (but aren’t always required to) report emotional abuse of older adults.
Threats of harm trigger another set of obligations. If you express a clear intention to kill or seriously injure a specific, identifiable person, your therapist has a legal duty to act. This principle dates back to the 1976 Tarasoff ruling, which established that therapists must protect foreseeable victims from foreseeable danger. The legal standard requires that the threat be clear, the victim identifiable, and the danger imminent. A therapist may also break confidentiality if you present an immediate danger to yourself, such as expressing suicidal intent with a plan.
Even a family member’s report can trigger a disclosure. If someone in your family tells your therapist that you seriously intend to harm another person, that can be enough to override confidentiality.
How the Duty to Warn Varies by State
Not every state handles the duty to warn the same way. Twenty-three states, including California, Colorado, New York’s neighbors New Jersey and Massachusetts, and others like Ohio and Virginia, have laws that specifically mandate therapists to report threats. Ten states, including Georgia, Pennsylvania, and North Carolina, impose a duty to warn through common law rather than statute. Eleven states and Washington D.C. give therapists discretion, allowing but not requiring them to warn. Six states, including Arkansas, Kansas, and Nevada, have no guidance on the issue at all.
This patchwork means your therapist’s obligations depend partly on where you live. In a mandatory state, failing to warn a potential victim can expose the therapist to liability. In a permissive state, the therapist has more room for clinical judgment about whether disclosure is warranted.
Court Orders and Subpoenas
A subpoena for your therapy records is not the same as a court order, and the distinction has real consequences for your privacy. Most subpoenas are signed by attorneys, not judges, and a therapist who receives one cannot simply hand over your files. They need your written consent first, because federal and state law recognizes a psychotherapist-patient privilege that belongs to you, the client.
If you refuse consent or can’t be reached, the therapist’s next step is to contact the requesting attorney and explain that they can’t release confidential information. If that doesn’t resolve things, the therapist can ask a judge for guidance. Importantly, a therapist cannot even confirm that you are their client when responding to a subpoena without your authorization.
A true court order, signed by a judge, is different. In most states, therapists must comply with a valid court order even without client consent. These orders are relatively rare, and the document will typically identify itself as a court order on the first page. Therapists cannot ignore any subpoena, though. Even an attorney-issued subpoena requires a written response, and failing to respond can result in contempt of court.
Consequences for Unauthorized Breaches
When a therapist discloses your information without legal justification or your consent, several layers of accountability exist.
Licensing Board Discipline
State licensing boards can impose a range of penalties. A study of disciplinary actions against professional counselors between 2009 and 2013 found that the most common penalties were fines (about 54% of cases), mandatory continuing education (45%), and formal reprimands (28%). More serious consequences included indefinite license suspension (19%), probation (19%), and full license revocation (about 13%). In some cases, therapists voluntarily surrendered their licenses rather than face a board hearing. A small percentage were permanently barred from practice.
Civil Lawsuits
You can sue a therapist for breach of confidentiality as a malpractice claim. To succeed, you need to establish four things: that a therapist-client relationship existed, that the therapist’s conduct fell below the accepted standard of care, that this conduct directly caused you harm, and that you suffered an actual injury. The hardest part for most plaintiffs is proving recoverable damages. Emotional distress from a breach is real, but courts generally require you to show concrete harm, such as job loss, relationship damage, or worsening mental health symptoms that can be documented.
Federal Privacy Penalties
Therapists who accept insurance or transmit health information electronically are covered by HIPAA, the federal health privacy law. HIPAA violations carry tiered penalties that range from hundreds of dollars for unknowing violations to tens of thousands per incident for willful neglect. Criminal penalties, including potential imprisonment, apply in cases of intentional misuse of patient information.
How to File a Complaint
If you believe your therapist improperly disclosed your information, you can file a complaint with your state’s licensing board. The process is straightforward but not anonymous. You’ll need to identify the therapist by name, describe the violation, and sign the complaint. Most boards will not investigate anonymous reports.
Once a complaint is filed, it gets assigned to an investigative member of the board who reviews the evidence and may contact you and any witnesses for more information. After the investigation, the board member recommends a course of action, which can range from dismissing the complaint for lack of evidence to issuing a reprimand, imposing license conditions, suspending the license, or revoking it entirely. The full board votes on the recommendation in a public meeting, and both you and the therapist are notified of the outcome in writing.
You can also file a HIPAA complaint with the U.S. Department of Health and Human Services Office for Civil Rights if the breach involved electronically stored or transmitted health records. For therapists who belong to professional organizations like the American Psychological Association or American Counseling Association, those organizations have their own ethics complaint processes that can result in membership sanctions or expulsion.
The Impact on Your Treatment
Beyond the legal and professional consequences for the therapist, a confidentiality breach can do lasting damage to you. Research shows that people who experience a breach of therapeutic trust often refuse to disclose important information in future sessions, or they stop treatment altogether. Some develop a broader reluctance to seek mental health care at all.
This effect is especially pronounced for young people. Minors who fear their therapist will tell their parents about sensitive topics like sexual activity, contraception, or substance use are more likely to avoid seeking care entirely. Studies have found that this avoidance leads to higher rates of risky behavior and a greater long-term risk of developing mental health conditions.
For adults, the consequences are subtler but still significant. Keeping secrets from a therapist because you no longer trust the process is associated with increased stress, more worry, and lower overall well-being. The therapeutic relationship depends on honest disclosure, and once that trust is broken, some people carry the reluctance into every future clinical relationship, making it harder to benefit from treatment even with a different provider.