Updated
Patient Confidentiality in Healthcare: Rules, Exceptions, Examples
Patient confidentiality is the duty to protect what a patient shares in the course of care. The AMA Code of Medical Ethics says patients generally decide whether and to whom their health information is disclosed, with three exceptions: others caring for the patient, authorities when the law requires it, and people who can reduce a serious threat to the patient or to an identifiable person. Any other sharing needs consent.
Laws differ by state, so treat this as an orientation, not legal advice (sources read October 31, 2026).
What confidentiality protects, and why
The AMA puts the reason plainly: patients need to trust that physicians will protect what they share, so they feel free to disclose everything their physician needs to help them. Physicians in turn have an ethical obligation to keep that information confidential (AMA Code). The duty covers electronic communication too, and it generally continues after a patient dies.
Privacy is the wider idea. The AMA Code describes four kinds: physical privacy (personal space), informational privacy (personal data), decisional privacy (personal choices, including cultural and religious affiliations) and associational privacy (relationships with family and other intimates).
When you can share without consent
When information is shared, the AMA asks physicians to limit it to the minimum necessary and to tell the patient when feasible. These are the situations where specific consent is not required:
| Who can be told | Example | Basis |
|---|---|---|
| Other clinicians caring for the patient, or health care operations | Example: Handing over to the night team, or a quality review of a case. | Basis: AMA Code |
| Authorities, when the law requires it | Example: Reportable infectious diseases or suspected child abuse, under your state's laws. | Basis: AMA Code |
| Someone who can reduce a serious threat | Example: A patient says he will hurt a named coworker. The physician may warn the person or the police. Whether that is required depends on state law. | Basis: AMA Code and HHS |
| Anything else | Example: A relative calling for an update, an employer, a journalist. | Basis: Ask the patient (or surrogate) first |
What HIPAA says
HIPAA's Privacy Rule is the federal law behind most of this. The basics:
- Who it covers. Covered entities are health plans, health care clearinghouses and health care providers who transmit health information electronically in covered transactions (45 CFR 160.103).
- What it protects. Protected health information (PHI) is individually identifiable health information, in any form or medium (45 CFR 160.103).
- Treatment, payment and operations. PHI can be used and disclosed to carry out treatment, payment and health care operations (45 CFR 164.506).
- Minimum necessary. Other uses and disclosures must be limited to the minimum necessary for the purpose. The rule does not apply to disclosures to a provider for treatment (45 CFR 164.502).
- Serious and imminent threats. Disclosure is permitted when it is necessary to prevent or lessen a serious and imminent threat to a person or the public, to someone reasonably able to prevent it (45 CFR 164.512). HHS says that can include family, friends, caregivers and law enforcement, and that HIPAA defers to health professionals' judgment (HHS).
- Enforcement. Violations can bring civil money penalties, with amounts updated annually (45 CFR 160.404).
Duty to warn and Tarasoff
The best-known limit on confidentiality comes from Tarasoff v. Regents of the University of California (1976), which held that a therapist must use reasonable care to protect a patient's foreseeable victim (the opinion). NCSL says most states now either require or permit mental health professionals to disclose information about patients who may become violent, but the rules differ by state (NCSL). The case, the state-by-state differences and how HIPAA fits are covered in duty to warn and Tarasoff.
For an interview you do not need the statute. Know that a specific, serious threat to an identifiable person changes the answer, and that you would involve the supervising clinician right away.
Everyday confidentiality breaches
Most breaches are not dramatic. These are the ones that happen on ordinary days:
- Talking about a patient in the elevator or the cafeteria.
- Looking up a friend's or a celebrity's chart out of curiosity.
- Posting a photo from the unit where a whiteboard or a face is visible.
- Telling a patient's family more than the patient agreed to share.
- Leaving a screen with patient information open in a shared space.
How MMI and interview stations test confidentiality
Expect a friend who asks about a mutual acquaintance's diagnosis, a teenager who asks you not to tell her parents, a colleague who posts about a patient, or a patient who threatens someone. Interviewers want three things: that you value the patient's trust, that you know the exceptions, and that you act within your role and get the right person involved. Practice with the question-bank scenario of a 12-year-old who asks for birth control. The four pillars of medical ethics and ethical dilemmas in medicine give you the wider frame.
Practice question: a teenager asks you to keep a secret
Why promising to keep the secret is the trap
Many applicants start by promising to keep what she says private, then have to break that promise. The stronger move is to be honest from the start about what you can and cannot keep, which protects both her safety and her trust.
“A 16-year-old patient tells you, a volunteer, that she has been thinking about ending her life, and begs you not to tell her parents. What do you do?”
The classic confidentiality station. A strong answer takes her seriously, is honest about what you cannot keep secret and gets her to the right help quickly.
Example answer written by Confetto (the applicant is invented)
The first thing I would do is take her seriously and thank her for telling me, because that took courage. I would stay with her and keep her safe while I get help, so I would not leave her alone.
I would be honest with her right away. I would say I care about her and I cannot keep this a secret, because her safety comes first, but that I will only tell the people who need to know to help her, starting with the nurse and the doctor on her team. I would not promise anything I cannot keep.
Then I would get the nurse or physician immediately. As a volunteer I am not the person to assess her risk or decide what her parents are told. That is for the clinical team, who know the law and the hospital's policy for minors.
Confidentiality matters, and keeping her trust matters too. That is why I would tell her what I was doing and why, rather than going behind her back. But when someone may seriously harm themselves, ethics guidance allows sharing with the people who can prevent it.
Sources: the AMA Code of Medical Ethics, HHS, the HIPAA Privacy Rule (eCFR), NCSL and the Tarasoff opinion, linked throughout and checked October 31, 2026.
Frequently asked questions
What is patient confidentiality?
The duty to protect what a patient shares in the course of care. The AMA Code says patients need to trust that information will be protected so they can disclose everything their physician needs to help them. Read the AMA opinion on confidentiality.
When can confidentiality be broken?
Without the patient's specific consent, information can go to others caring for the patient, to authorities when the law requires it, and to people who can reduce a serious threat to the patient or an identifiable person. Anything else needs consent.
What is the duty to warn?
A legal duty that grew from Tarasoff v. Regents of the University of California (1976), where California's Supreme Court held that a therapist must use reasonable care to protect a patient's foreseeable victim. Whether a duty is required, only permitted or not imposed at all depends on the state. See duty to warn and Tarasoff.
What is the difference between privacy and confidentiality?
Privacy is broader. The AMA Code describes physical, informational, decisional and associational privacy. Confidentiality is the duty to protect the information a patient shares with you.
Does confidentiality end when a patient dies?
No. The AMA Code says patients are generally entitled to the same confidentiality after death as in life, with a few exceptions. See the AMA Code.