Therapist confidentiality with minors: When to break it and how to handle consent
Releasing information to third parties and granting staff or billers access to private client data are routine parts of a therapist's role. However, it isn’t always clear how to safeguard client privacy while disclosing the needed information.
The HIPAA minimum necessary rule, a federal standard, was established to address these privacy concerns.
What is the HIPAA minimum necessary rule?
The HIPAA minimum necessary rule, also known as the HIPAA minimum necessary standard, is a key component of the HIPAA Privacy Rule. It requires healthcare providers and their business associates who are covered by HIPAA to limit the use, disclosure, or request of protected health information (PHI) to the minimum amount necessary for a specific purpose.
According to the U.S. Department of Health and Human Services (HHS), this standard safeguards client privacy by ensuring sensitive health data is accessed or shared only when essential.
How the HIPAA minimum necessary rule applies to your practice
The minimum necessary rule applies to covered entities, such as therapists who bill insurance electronically, and to their business associates. It covers how your practice uses PHI internally (for example, which staff can open a chart), what you disclose to others, and what you request about a client.
The HIPAA minimum necessary rule may be especially important in a psychotherapy practice. Because mental health records involve deeply sensitive disclosures, limiting the release of (or access to) this information prevents unnecessary exposure of a client’s private thoughts and personal histories.
HIPAA minimum necessary rule examples
Some common minimum necessary rule examples are:
Insurance billing and invoicing: Administrative and billing personnel should only access the essential demographic and service data needed for processing claims (such as Current Procedural Terminology (CPT) codes, diagnosis codes, and service dates). They do not need access to session notes. Additionally, superbills should omit unnecessary information, such as diagnostic descriptions.
Reception and scheduling: Staff that manage appointment calendars, contact details, or payment processing should not be able to view clinical notes.
Peer consultation or supervision: When consulting with colleagues or a supervisor about a case, therapists should de-identify client information whenever possible by removing names and other identifying details. Consultations about a client's care are generally exempt from the rule (see below), but sharing only what's needed is still best practice.
These minimum necessary rule examples share one principle: access follows job function.
Exceptions to the HIPAA minimum necessary rule
The HIPAA minimum necessary rule does not apply in the following situations, according to HHS:
Treatment: Disclosures, requests, and communications between healthcare providers for the direct treatment, coordination, or consultation of a client are exempt from the HIPAA minimum necessary rule. In these cases, a therapist can use their clinical judgment in choosing what to share with another clinician.
Other exceptions:
Client access: Disclosures made directly to the client who is the subject of the records.
Client authorization: Situations where the client signs a written release.
Required by law: Disclosures mandated by law, e.g., abuse reporting.
HHS investigations: Disclosures made to HHS for compliance and enforcement.
HIPAA Administrative Simplification: Uses required to comply with standard HIPAA transaction rules. A standard transaction (for example, an electronic claim) requires specific data—such as diagnostic codes, client identifiers, and treatment dates—to be processed by a health plan. The therapist does not violate the HIPAA minimum necessary rule when submitting claims because transmitting these exact fields is legally required by the HIPAA Transactions and Code Sets Rule.
6 common HIPAA minimum necessary rule violations
The rule sounds simple—“do not share more information than required.” So why do HIPAA minimum necessary rule violations remain so frequent?
The following minimum necessary rule examples show where practices most often go wrong with the minimum necessary standard and related privacy requirements:
Lack of role-based access: Small practices often grant all staff full access to their electronic health record (EHR) or to a shared Google Drive. When administrative or billing staff can view clinical notes, or therapists can view other clinicians' records, the practice may be out of compliance by failing to make reasonable efforts to restrict access according to job responsibilities.
Releasing full charts unnecessarily: When third parties request records regarding a specific issue, clinicians sometimes send the client’s entire file, which can be in violation of the HIPAA minimum necessary rule.
Detailed voicemail or text messages: A common minimum necessary rule example violation is leaving messages that reveal clinical details or that confirm a client’s therapy status. For example, saying, “This is Jane Jensen, Tom's social worker, calling to confirm his therapy appointment” may improperly disclose protected health information.
Improperly sharing psychotherapy notes: Unlike standard progress notes, psychotherapy notes contain a therapist’s private session reflections. HIPAA provides heightened protection for these notes when they're kept separate from the official record. In most cases, they can't be released without a separate client authorization.
Responding to online reviews: Responding to reviews on platforms like Google or Yelp can breach confidentiality. Replying with details like “We tried to accommodate your scheduling requests for marriage counseling, but you missed your appointments” improperly confirms client status and details of care.
Oversharing in waiting areas: Discussing private matters where others can overhear creates a privacy risk and may be a HIPAA minimum necessary rule violation. Loudly asking, "Have you had any panic attacks since our last session?" in a waiting area is the kind of careless disclosure the rule is meant to prevent. However, HHS guidance permits basic sign-in sheets or calling names in waiting rooms.
Is releasing an entire client record ever permitted?
Yes, in limited situations. HHS says the rule doesn't prohibit requesting or releasing an entire record for payment or health care operations, as long as the specific justification is documented. Disclosures for treatment, such as coordinating care with another treating provider, are exempt from the rule altogether.
State laws and ethics codes can be stricter than HIPAA
When releasing information, clinicians must pay close attention to state laws. Although the HIPAA minimum necessary rule sets a federal baseline, state laws that are more protective of client privacy generally take precedence over HIPAA.
Some state laws require written client authorization for mental health disclosures, even for treatment purposes, which can narrow HIPAA's treatment exception for therapists. For instance, California’s Confidentiality of Medical Information Act (CMIA) sets stringent limits on sharing mental health records.
Also, ethics codes from professional associations may demand that therapists restrict disclosures to the minimum necessary. The American Psychological Association’s Ethical Standard 4.05(b) limits when psychologists may disclose confidential information without consent, and its standards on consultations and payment disclosures call for sharing only what is necessary for the purpose.
Consequences of HIPAA minimum necessary rule violations
Therapists facing a HIPAA minimum necessary rule violation may encounter serious financial, professional, and legal ramifications, depending on the severity and intent behind the violation.
Civil fines from the Office for Civil Rights (OCR) are tiered by level of culpability. As of the January 2026 inflation adjustment, they range from $145 to $2,190,294 per violation, with annual caps that depend on the tier. Corrective action plans that mandate policy overhauls, staff retraining, and external audits may be required. State licensing boards investigate complaints, which may result in reprimands, probation, license suspension, or revocation. When a provider knowingly obtains or discloses PHI in violation of HIPAA, especially for personal gain or malicious intent, they may face criminal charges, fines, and imprisonment.
The HIPAA minimum necessary rule: Administrative safeguards
Put administrative safeguards in place to support compliance with this rule. Administrative safeguards are the written policies, procedures, and staff training that guide how your practice protects PHI. Use these steps to help prevent the problems above.
Establish written policies: Document procedures regarding PHI access, disclosures, and exceptions for staff and contractors, and re-evaluate these policies at least annually.
Configure EHR controls: Utilize role-based access control (RBAC) to restrict non-clinical staff from browsing full records, and set up your EHR program so that access is limited according to role. If your EHR lacks this ability, contact their support desk. Ensure superbills/encounter forms display only coded data (e.g., CPT/ICD-10) rather than clinical narrative text.
Avoid unsecured file sharing: Don’t store client files in a shared folder, such as Google Drive, unless you have a business associate agreement (BAA) with the provider and access is limited by role.
Limit disclosures and use secure channels: Keep standard email and texts to scheduling details only, and share clinical information through an encrypted client portal or HIPAA-compliant email.
De-identify case data: Redact client identifiers during case consultations, training, or reviews.
Train staff and audit: Provide ongoing HIPAA policy training to staff, and regularly audit compliance. To support your training and audits, use SimplePractice’s HIPAA compliance for therapists checklist.
Conclusion
The HIPAA minimum necessary rule asks psychotherapists to share only the information needed for a given purpose and to limit access to sensitive client information to the people who need it to do their jobs.
However, respecting the rule isn't just about HIPAA compliance for therapists—it's about honoring the trust clients place in us. While HIPAA sets the baseline, real privacy protection comes from being thoughtful about how we handle records, keeping client confidentiality at the heart of our everyday work.
Sources
American Psychological Association. (2017). Ethical principles of psychologists and code of conduct.
Justia. (2025). Confidentiality of Medical Information Act (Civil Code sections 56-56.37).
U.S. Department of Health and Human Services. (n.d.). HIPAA Privacy Rule.
U.S. Department of Health and Human Services. (n.d.). Minimum necessary requirement.
U.S. Department of Health and Human Services. (n.d.). Other administrative simplification rules.
U.S. Department of Health and Human Services. (2013). HIPAA administrative simplification: Regulation text.
U.S. Department of Health and Human Services. (2022). May physician’s offices use patient sign-in sheets or call out the names of their patients in their waiting rooms?
U.S. Department of Health and Human Services. (2026). Annual civil monetary penalties inflation adjustment. Federal Register.
How SimplePractice streamlines running your practice
SimplePractice is HIPAA-compliant practice management software with everything you need to run your practice built into the platform—from booking and scheduling to insurance and client billing.
If you’ve been considering switching to an EHR system, SimplePractice empowers you to run a fully paperless practice—so you get more time for the things that matter most to you.
Try SimplePractice free for 30 days. No credit card required.
