Treatment, payment, operations
HIPAA permits disclosure without written authorisation for these three purposes — and for nothing else that merely feels compassionate. Confirming that a named person is on a psychiatric unit is itself protected information.
Psychotherapy notes
A therapist’s separately kept process notes need specific written authorisation for nearly all disclosures, including to insurers. Medication records, session times, modalities, frequency, test results and treatment summaries are not psychotherapy notes.
42 CFR Part 2
Records from federally assisted substance use disorder programmes carry consent rules stricter than HIPAA — because disclosure can cost a person a job, custody or housing.
Duty to warn and protect
Tarasoff: a serious threat of violence against a reasonably identifiable person creates a duty of reasonable care to protect. The nurse elicits, keeps the environment safe, notifies the provider and supervisor, and documents verbatim — the nurse does not decide alone.
Mandated reporting
Suspected abuse or neglect of a child, an older adult or a dependent adult is reported on reasonable suspicion, not proof, regardless of the person’s wishes. HIPAA expressly permits disclosures required by law.
Minors and consent
Adolescents hold independent consent rights for certain services in many states — commonly mental health, substance use, contraception and sexually transmitted infection care. Say what you must share before the disclosure, not after.