Under HIPAA, which obligation may override client confidentiality?

• A. HIPAA
• B. Duty to warn third parties: exception to confidentiality
• C. Informed consent
• D. Mandatory reporting of abuse

Answer: (B)

Confidentiality isn’t absolute; safety concerns create a clear exception that allows disclosure to prevent harm. The key idea here is the duty to warn or protect third parties when a patient poses a credible, imminent threat. This principle, rooted in the Tarasoff decision, is reflected in HIPAA’s safety provisions, which permit clinicians to disclose enough information to warn the potential victim or to enable protective action. In practice, if someone’s threat is credible, you may reveal necessary details to avert harm, even without the patient’s consent.

HIPAA primarily provides privacy protections, not blanket permission to disclose. Informed consent is about obtaining permission before sharing information, not overriding confidentiality by itself. Mandatory reporting of abuse is a legal duty that may require disclosure under state law, but the question targets the specific HIPAA-related override to confidentiality, which is the duty to warn or protect third parties.