Doctor-Patient Confidentiality

Sections within this essay:

Background

The concept of "doctor-patient confidentiality" derives from English common law and is codified in many states' statutes. It is based on ethics, not law, and goes at least as far back as the Roman Hippocratic Oath taken by physicians. It is different from "doctor-patient privilege," which is a legal concept. Both, however, are called upon in legal matters to establish the extent by which ethical duties of confidentiality apply to legal privilege. Legal privilege involves the right to withhold evidence from discovery and/or the right to refrain from disclosing or divulging information gained within the context of a "special relationship." Special relationships include those between doctors and patients, attorneys and clients, priests and confessors or confiders, guardians and their wards, etc.

The Oath of Hippocrates, traditionally sworn to by newly licensed physicians, includes the promise that "Whatever, in connection with my professional service, or not in connection with it, I see or hear, in the life of men, which ought not to be spoken of abroad, I will not divulge, as reckoning that all such should be kept secret." The laws of Hippocrates further provide, "Those things which are sacred, are to be imparted only to sacred persons; and it is not lawful to impart them to the profane until they have been initiated into the mysteries of the science."

Doctor-patient confidentiality stems from the special relationship created when a prospective patient seeks the advice, care, and/or treatment of a physician. It is based upon the general principle that individuals seeking medical help or advice should not be hindered or inhibited by fear that their medical concerns or conditions will be disclosed to others. Patients entrust personal knowledge of themselves to their physicians, which creates an uneven relationship in that the vulnerability is one-sided. There is generally an expectation that physicians will hold that special knowledge in confidence and use it exclusively for the benefit of the patient.

The professional duty of confidentiality covers not only what patients may reveal to doctors, but also what doctors may independently conclude or form an opinion about, based on their examination or assessment of patients. Confidentiality covers all medical records (including x-rays, lab-reports, etc.) as well as communications between patient and doctor, and it generally includes communications be-tween the patient and other professional staff working with the doctor.

The duty of confidentiality continues even after patients stop seeing or being treated by their doctors. Once doctors are under a duty of confidentiality, they cannot divulge any medical information about their patients to third persons without patient consent. There are, however, exceptions to this rule.

Key Points

• There is no duty of confidentiality owed unless a bona-fide doctor-patient relationship exists or existed
• The scope of the duty of doctor-patient confidentiality, as well as the existence of a doctor-patient legal privilege, varies from state to state. No federal law governs doctor-patient confidentiality or privilege
• Generally, what is confidential is information that is learned or gained by a doctor, during or as a result of the doctor's communications with examination of you, or medical assessment of the patient
• The duty of confidentiality continues even after the patient stops seeing or being treated by the doctor
• The duty of confidentiality is not absolute. Doctors may divulge or disclose personal information, against the patient's will, under very limited circumstances

The Doctor-Patient Relationship

There must be a bona fide "doctor-patient relationship" between individuals and a physician before any duty of confidentiality is created. Generally speaking, individuals must voluntarily seek advice or treatment from the doctor, and have an expectation that the communication will be held in confidence. This expectation of confidentiality does not need to be expressed. It is implied from the circumstances.

If individuals meet a doctor at a party, and in the course of "small-talk"conversation, they ask the doctor for an opinion regarding a medical question that relates to them, the doctor's advice would most likely not be considered confidential, nor would the doctor be considered "the individuals doctor." Likewise, if individuals send an e-mail to an "Ask the Doctor" website on the Internet, the communication would not be considered confidential, nor would the person who responded to the e-mail be considered he sender's doctor. No doctor-patient relationship was established, and no duty is owed.

If individuals are examined by a physician at the request of a third party (such as an insurance company or their employer), no matter how thorough or extensive the examination, or how friendly the doctor, there is generally no physician-patient relationship and no duty of confidentiality is owed to the patients. This is because they did not seek the physician's advice or treatment, and the relationship is at "arm's-length."

In many states, the privilege is limited to professional relationships between licensed doctors of medicine and their patients. Other states extend the privilege to chiropractors, psychologists, therapists, etc.

Doctor-Patient Privilege

Once a bona-fide doctor-patient relationship is established, the duty of confidentiality"attaches," and in many states, the doctor can invoke a legal privilege, on the patient's behalf, when asked to disclose or divulge information the doctor may have or know about the patient.

Federal Rule of Evidence (FRE) 501 provides that any permissible privilege "shall be governed by the principles of common law" as interpreted by federal courts. However, in civil actions governed by state law, the privilege of a witness is also determined by the laws of that state. Most states recognize some form of doctor-patient privilege by express law (statute ), but over time, there have been many exceptions that have chipped away the use or scope of the privilege.

In recent years, many courts have held that doctors also owe duties to protect non-patients who may be harmed by patients. For example, without a patient's permission or knowledge, doctors may warn others or the police if the patient is mentally unstable, potentially violent, or has threatened a specific person. In some states, the duty to report or warn others "trumps" the right to confidentiality or privileged communication with a doctor. Courts will decide these matters by balancing the sanctity of the confidentiality against the foreseeability of harm to a third party.

Constitutional Right to Privacy

The fundamental right to privacy, guaranteed by the Fifth and Fourteenth Amendments to the U. S. Constitution, protects against unwarranted invasions of privacy by federal or state entities, or arms thereof. As early as in Roe v. Wade, 410 U. S. 113 (1973), the U. S. Supreme Court acknowledged that the doctor-patient relationship is one which evokes constitutional rights of privacy. But even that right is not absolute and must be weighed against the state or federal interest at stake.

For example, in Whalen v. Roe, 429 U.S. 589 (1977), a group of physicians joined patients in a lawsuit challenging the constitutionality of a New York statute that required physicians to report to state authorities the identities of patients receiving Schedule II drugs (controlled substances). The physicians alleged that such information was protected by the doctor-patient confidentiality, while the patients alleged that such disclosure was an invasion of their constitutional right to privacy. The Supreme Court did not disagree with the lower court's finding that "the intimate nature of a patient's concern about his bodily ills and the medication he takes … are protected by the constitutional right to privacy." However, the high court concluded (after balancing the state's interests) that "Requiring such disclosures to representatives of the State having responsibility for the health of the community, does not automatically amount to an impermissible invasion of privacy."

In the Whalen case (decided in 1977), the U. S. Supreme Court had (prophetically) added a note about massive computerized databanks of personal information. Said the Court:

"A final word about issues we have not decided. We are not unaware of the threat to privacy implicit in the accumulation of vast amounts of personal information in computerized data banks or other massive government files … The right to collect and use such data for public purposes is typically accompanied by a concomitant statutory or regulatory duty to avoid unwarranted disclosures … We … need not, and do not, decide any question which might be presented by the unwarranted disclosure of accumulated private data—whether intentional or unintentional—or by a system that did not contain comparable security provisions. We simply hold that this record [Whalen] does not establish an invasion of any right or liberty protected by the Fourteenth Amendment."

Waiver of Confidentiality or Privilege

A privilege belongs to the patient, not the doctor. Generally, only a patient may waive the privilege. A patient's written consent is needed before a doctor can release any information about the patient. But there are other ways in which a patient may "waive" the privilege of confidentiality. For example, if a patient brings a friend into the examination or consultation with the doctor, the friend may be forced to testify as to what transpired and what was said. (On the other hand, nurses or medical assistants in the room are "extensions" of the doctor for purposes of confidentiality and are covered by the privilege.) The patient may also waive the privilege by testifying about his or her communications with the doctor or about his or her physical condition at the time.

Another common way in which a patient waives the confidentiality of the privilege is by filing a law-suit or claim for personal injury. By doing so, the patient has put his or her physical condition "at issue" in the lawsuit. Therefore, the law presumes that the patient has waived all confidentiality regarding his or her medical condition, and there is an implied authorization to the patient's doctor for disclosure of all relevant information. If a patient fails to object to a doctor's testimony, the patient has waived the privilege as well.

Select Applications

Medical Records

In the past, physicians could physically secure and shield personal medical records from disclosure, absent consent from their patients. Electronic databanks changed all that (as foretold by the Supreme Court in Whalen, above). Patchy and varied state laws involving doctor-patient confidentiality left much to be desired. With the passage of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (which encouraged electronic transmission of patient data), Congress passed concurrent legislation for uniform protection of medical records and personal information. In December 2000, the Department of Health and Human Services (HHS) published its Privacy Rule (65 Fed. Reg. 82462), which became effective on April 14, 2001. The regulation covers health plans, health-care clearinghouses, and health-care providers that bill and transfer funds electronically. The regulation mandates a final compliance date of April 14, 2003 (small health plans have until April 14, 2004 to comply.) The Privacy Rule includes provisions for the following:

• Ensuring patient access to medical records, ability to get copies and/or request amendments
• Obtaining patient consent before releasing information. Health care providers are required to obtain consent before sharing information regarding treatment, payment, and health care operations Separate patient authorizations must be obtained for all non-routine disclosures and non-health related purposes. A history of all non-routine disclosures must be accessible to patients
• Providing recourse for violations through an administrative complaint procedure

Death Certificates

Under most state laws, birth and death certificates are a matter of public record. The advent of physician-assisted suicides in less than a handful of states (e.g., Oregon) created new concerns for the scope of doctor-patient confidentiality. Some states have addressed this issue by express legislation, e.g., permitting the registration of physician-assisted deaths directly to state offices rather than to local county offices of vital statistics. Others have permitted dual-systems that incorporate specific codes for "cause of death" on public records but more thorough explanations on private state records. Many doctors simply list innocuous language, such as "cardiac-respiratory failure," on public records, and leave blank the secondary or underlying cause. Similar issues of limited disclosure often arise on birth records. In some circumstances, personal details such as paternity, marital status, or information regarding a newborn's HIV status may warrant the filing of dual records (one requiring more disclosure than the other) for separate purposes and separate viewers, based on a "need to know" criterion.

Duty to Warn Others of Medical Conditions

Under most state statutes, doctors and healthcare providers generally have duties to report incidence of certain sexually transmitted diseases, child abuse, communicable diseases, HIV/AIDS, or other conditions deemed to be risks to the health and safety of the public at large. Some states have developed registries to track the incidence of certain conditions, (e.g., certain forms of cancer) that may later help researchers discover causes. In registry cases, personal data about the patients are released only to the necessary local, state, or federal personnel, and the data usually do not contain "patient identifiers."

Select State Disclosure Laws

ALABAMA: Medical records disclosing "notifiable diseases" (those diseases or illnesses that doctors are required to report to state officials) are strictly confidential. Written consent of patient is required for release of information regarding sexually transmitted disease. (Ch. 22-11A-2, 22).

ALASKA: Mental health records may be disclosed only with patient consent/court order/law enforcement reasons (Ch. 47.30.845). In cases of emergency medical services, records of those treated may be disclosed to specified persons.(Ch. 18.08.086). Express language permits disclosure of financial records of medical assistance beneficiaries to the Dept. of Social Services. (Ch. 47.07.074).

ARIZONA: Statutory privilege for physicians and surgeons (Ch. 12-2235). There are mandatory reporting requirements for malnourishment, physical neglect, sexual abuse, non-accidental injury, or other deprivation with intent to cause or allow death of minor children, but the records remain confidential outside judicial matters (Ch. 13-3620). Access to other medical records is by consent or pursuant to exceptions outlined in Ch. 36-664.

ARKANSAS: Arkansas has a special privilege permitting doctors to deny giving patients or their attorneys or guardians certain medical records upon a showing of "detrimentality" (Ch.16-46-106). Other-wise, access by patients and their attorneys are covered under Ch. 23-76-129 and 16-46-106.

CALIFORNIA: California's legal privilege expressly includes psychotherapists and psychiatrists (Section 1010 of Evidence Rules). Patients must expressly waive doctor-patient confidentiality when they become plaintiffs in civil lawsuits (Section 1016 of Evidence Rules). Doctors may withhold certain mental health records from patients if disclosure would have an adverse effect on patient. (H&S Section 1795.12 and.14).

COLORADO: Doctors are permitted to withhold from patients' psychiatric records that would have a significant negative psychological impact; in those cases, doctors may prepare a summary statement of what the records contain (Ch.25-1-801). There are mandatory disclosure requirements for certain diseases (Ch 25-1-122).

CONNECTICUT: There is limited disclosure of mental health records (Ch. 4-105) and limited disclosure to state officials (Ch.53-146h; 17b-225).

DELAWARE: Strict disclosure prohibitions exist about sexually transmitted diseases, HIV infections (Tit. 16-711). No physician-patient privilege exists in child abuse cases (Tit. 16-908).

DISTRICT OF COLUMBIA: D.C. Code 14-307 and 6-2511 address legal privilege of physicians and surgeons and mental health professionals except where they are outweighed by "interests of public justice." Public mental health facilities must release records to patient's attorney or personal physician (21-562).

FLORIDA: Florida Statutes Annotated 455-241 recognizes a psychotherapist-patient privilege. Mental health records may be provided in the form of a report instead of actual annotations (455-241). Patient consent is required for general medical records releases except by subpoena or consent to compulsory physical exam pursuant to Civil Rule of Procedure 1.360 (455-241).

GEORGIA: Legal privilege is extended to pharmacists and psychiatrists (Ch. 24-9-21, 9-40). Mandatory disclosure to state officials is required for child abuse and venereal disease. (Ch. 19-7-5; 31-17-2).

HAWAII: Hawaii Revised Statute 325-2 provides for mandatory disclosure to state officials for communicable disease or danger to public health. Names appearing in public studies such as the Hawaii Tumor Registry are confidential and no person who provides information is liable for it (324-11, et seq.).

IDAHO: Physician-patient privilege is found in the Idaho Code 9-203(4). There is mandatory disclosure for child abuse cases within 24 hours (16-1619) and sexually transmitted diseases (39-601). Both doctors and nurses may request protective orders to deny or limit disclosure (9-420).

ILLINOIS: Mandatory disclosure to state officials exists for child abuse and sexually transmitted diseases (325 Illinois Compiled Statutes Annotated 5/4).

INDIANA: Doctor-patient information is protected by Ch.34-1-14-5. Insurance companies may obtain information with written consent (Ch 16-39-5-2). Mandatory disclosure to state officials exists for child abuse and sexually transmitted diseases (31-6-11-3 and 4) (16-41-2-3).

IOWA: Mandatory disclosure to state officials exists of sexually transmitted diseases (Ch. 140.3 and 4).

KANSAS: State law recognizes doctor-patient privilege (Ch. 60-427) and psychologist-patient privilege (74-5323). Mandatory disclosure of AIDS (65-6002(c) to state health officials is required of AIDS (65-6002(c)).

KENTUCKY: Psychiatrists are included in privilege statute (Ch. 422-330). Either patient or physician may ask for protective order (422-315).

LOUISIANA: Louisiana Code of Evidence, Article 510 waives health-care provider-patient privilege in cases or child abuse or molestation. Mandatory disclosure of HIV information is required (Ch.1300-14 and 1300-15).

MAINE: Privilege covers both physicians and psychologists, except in child abuse cases (Ch. 22-4015). Doctors may withhold mental health records if detrimental to patient's health (22-1711). 20-A Maine Revised Statutes Annotated, Section 254, Subsection 5, requires schools to adopt local written policies and procedures.

MARYLAND: Both psychiatrists and psychologists are included in state's privilege statute (Cts. & Jud. Proc. 9-109). Physicians may inform local health officers of needle-sharing partners or sexual partners in cases of transmittable diseases (18-337).

MASSACHUSETTS: Any injury from the discharge of a gun or a burn affecting more than five percent of the body, rape, or sexual assault triggers mandatory disclosure law (Ch. 112-12A). No statutory privilege.

MICHIGAN: MCL 600.2157 recognizes a physician-patient privilege. Mandatory disclosure to state officials exists for communicable diseases (MCL.333.5117).

MINNESOTA: Minnesota Statutes Annotated 144.335 authorizes withholding of mental health records if information is detrimental to well-being of patient. Legal privilege expressly includes nurses and psychologists (595-02).

MISSISSIPPI: Mississippi is one of the few states that includes dentists, as well as pharmacists and nurses, in its statutory provisions for privilege (Ch. 13-1-21). Patient waiver is implied for mandatory disclosures to state health officials. Peer review boards assessing the quality of care for medical or dental care providers may have access to patient records without the disclosure of patient's identity (41-63-1, 63-3).

MISSOURI: Physicians, surgeons, psychologists, and dentists are included in Missouri's privilege statute (Ch. 491.060).

MONTANA: Doctor-patient privilege is found at Ch.26-1-805, and a psychologist-client privilege is recognized at Ch. 26-1-807. Mandatory Disclosure to state officials is required for sexually transmitted disease. (Ch. 50-18-106).

NEBRASKA: Nebraska Revised Statutes 81-642 requires reporting of patients with cancer for the Dept. of Health's Cancer Registry. The Dept. also maintains a Brain Injury Registry (81-651). Mandatory Disclosure to state officials is required for sexually transmitted disease. (71-503.01).

NEVADA: An express doctor/therapist-patient privilege is recognized under Nevada Statutes (Ch. 49-235 and 248). Mandatory Disclosure to state officials is required for communicable disease. (441A.150).

NEW HAMPSHIRE: The state has a statutorily-recognized doctor-patient privilege (Ch. 329:26) and psychologist-patient privilege (330-A:19). Mandatory Disclosure to state officials is required for communicable disease (141-C:7).

NEW JERSEY: Doctor-patient privilege is found at Ch. 2A:84A-22.1, and a psychologist-client privilege is recognized at Ch. 45:14B-28. Mandatory Disclosure to state officials is required for child abuse (9:6-8.30), pertussis vaccine (26:2N-5), sexually transmitted disease.(26:4-41), or AIDS (26:5C-6).

NEW MEXICO: Doctor-patient privilege (including psychologists) is found in Rules 11-509Ch. 26-1-805 New Mexico, through its 6 N.M. Administrative Code 4.2.3.1.11.3.2(d) requires the supervisory school nurse to develop and implement written policies and procedures for clinical services, including the administration of medication.

NEW YORK: The state includes dentists, as well as doctors and nurses, in its statutory provisions for privilege (Civ. Prac. 4504). Records concerning sexually transmitted disease or abortion for minors may not be released, not even to parents (NY Pub. Health 17).

NORTH CAROLINA: North Carolina General Statute 130A-133, et seq. provides for mandatory disclosure to state officials for communicable disease.

NORTH DAKOTA: Statute 31-01-06 and Rule of Evidence No. 503 provides for a physician/ psychotherapist-patient privilege. Mandatory Disclosure to state officials is required for child abuse, communicable diseases, or chronic diseases that impact the public (23-07-01, 50-25.1-01).

OHIO: Doctor-patient privilege is found at Ch. 2317-02(B). Mandatory Disclosure to state officials is required for child abuse (2151-421), occupational diseases (3701.25), contagious disease including AIDS (3701.24), or cases to be included on the Cancer Registry (3701.262).

OKLAHOMA: Title 12, Section 2503 and Title 43A, Section 1-109 cover physician and psychotherapist-patient privileges. Mandatory Disclosure to state officials is required for child abuse, and for communicable or venereal diseases (23-07-01, 50-25.1-01).

OREGON: Oregon Revised Statute 146-750 provides for mandatory disclosure of medical records involving suspected violence, and for physical injury with a knife, gun, or other deadly weapon.

PENNSYLVANIA: Pennsylvania has an express physician-patient privilege limited to civil matter only (Title 42-5929).

RHODE ISLAND: Mandatory Disclosure to state officials is required for occupational disease (Ch. 23-5-5), and for communicable or venereal diseases (23-8-1, 23-11-5).

SOUTH CAROLINA: Mandatory Disclosure to state officials is required for sexually transmitted disease (z016744-29-70). There is also express privilege for mental health provider-patient relationships under Ch. 19-11-95.

SOUTH DAKOTA: Physician-patient privilege is expressly recognized in Ch. 19-2-3, but is waived for criminal proceedings or if physical or mental health of person is at issue. Mandatory Disclosure to state officials is required for venereal disease (34-23-2) and for child abuse or neglect (26-8A-3).

TENNESSEE: Tennessee Code Annotated 24-1-207 and 63-11-213 provide express psychiatrist-patient and psychologist-patient privileges, respectively. There are also requirements for mandatory disclosure to state officials for communicable disease (68-5-101) or sexually transmitted diseases (68-10-101).

TEXAS: There are mandatory disclosure requirements for bullet or gunshot wounds (Health & Safety 161.041), certain occupational diseases (Health & Safety 84.003), and certain communicable diseases (Health & Safety 81.041).

UTAH: Utah Code Annotated 78-24-8(4) provides for doctor-patient privilege. There are mandatory disclosure requirements for suspected child abuse (62A-4A-403), and for communicable and infectious diseases (including HIV and AIDS) (26-6-3).

VERMONT: The state includes dentists, doctors, nurses, and mental health professionals in its statutory provisions for privilege (Title 12-1612). Records concerning sexually transmitted disease require reporting (Title 18-1093). Any HIV-related record of testing or counseling may be disclosed only with a court order evidencing "compelling need" (Title 12-1705).

VIRGINIA: Virginia extends legal privilege to any duly licensed practitioner of any branch of the healing arts dealing with the patient in a professional capacity (Ch. 8.01-399). Mental health professionals may withhold records from patient if release would be injurious to patient's health. (8.01-413).

WASHINGTON: Physician-patient privilege is expressly recognized in Ch. 5.60.060 and psychologist-patient privilege is at 18.83.110. Mandatory Disclosure to state officials is required for sexually transmitted disease (70.24.105), child abuse (26.44.030), and tuberculosis (70.28.010).

WEST VIRGINIA: Mandatory Disclosure to state officials is required for venereal, communicable disease (Ch. 16-4-6; 16-2A-5; 26-5A-4), suspected child abuse (49-6A-2), and gunshot and other wounds or burns (61-2-27).

WISCONSIN: Wisconsin Statute 905.04 recognizes privilege for physicians, nurses, and psychologists. There are mandatory reporting requirements for sexually transmitted diseases (252.11), tuberculosis (252.07), child abuse (48.981) and communicable diseases (252.05).

WYOMING: Rather than expressly create a statutory privilege, Wyoming addresses the matter by limiting doctors' testimony to instances where patients have expressly consented or where patients voluntarily testify themselves on their medical conditions (putting their medical conditions "at issue") (Ch. 1-12-101). There are mandatory reporting requirements for sexually transmitted diseases, child abuse, and communicable diseases (14-3-205, 35-4-130, 35-4-103).

Additional Resources

"Confidentiality of Death Certificates." Issues in Law & Medicine, Winter 1998.

"Malpractice Consult." Johnson, Lee J.,. Medical Economics, 21 June 1999.

"Medical Records." National Survey of State Law, 2nd ed., Richard A. Leiter, Ed. Gale:, 1997.

The Oath of Hippocrates. Available at http:/www.ftp/std.com/obi/Hippocrates/Hippocratic.Oath.

Privacy Rule. 65 Fed. Reg/ 82462, 2001. Available at http://gov.news/press/2001pres/01fsprivacy.html.

"'Shrinking' the Right to Everyman's Evidence: Jaffe in the Military (A)." Brenner-Beck, Dru, Air Force Law Review,, 1998.

Whalen v. Roe. 429 U.S. 589 (1977). Available at http://caselaw.lp.findlaw.com/scripts/getcase.