Florida Laws and Rules: Social Worker, Counselor, & MFT

FS 456.082 Disclosure of confidential information

- Florida Legislature. (2025). Chapter 456 Disclosure of confidential informationt. Health Professions and Occupations: General Provisions. 456.072 Retrieved February 1, 2026. Retrieved from https://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0400-0499/0456/Sections/0456.072.html

Disclosure of Confidential Information
Application Example...
Ethical Boundaries Related to Informed Consent

♦ #1 HIPAA Requirements
The first ethical boundary related to informed consent is HIPAA requirements. Although this may feel like a review from section 1, I felt we needed to go over the basics before dealing with such issues as readability. 

As you have already encountered many times before, clients must be presented with a Notice of Privacy Practices or NPP's in which he or she is informed of the HIPAA policies regarding client’s rights and the disclosure of information such as medical records. The client must then sign, initial, or otherwise acknowledge that they have received the notice. 

In this way, the client’s rights are protected and the practitioner is also not at risk for becoming liable if a client does not agree with the policies later on in the treatment. According to HIPAA, these NPPs or Notices of Privacy Practice must be written in "plain English" in order to facilitate the client’s comprehension. The legislation maintains that "the more understandable the NPP is, the more confidence the public will have in the covered entity's commitment to protecting the privacy of health information." 

Therefore, it is highly recommended that NPP’s are written in such a way that most if not all clients will have a sufficient grasp of the concepts laid out with little or no interpretation. This can be difficult when many mental health professonals, such as myself, receive their NPP’s from private companies or professional associations and adapt them to individualize the form with relevant information about the particular practice. 

♦ #2 Readability
The second ethical boundary related to informed consent is the readability of the NPP forms. As stated earlier, HIPAA requires that the NPP forms be written in "plain English" in order to optimize the comprehension of a maximum amount of clients. 

Therefore, the level of readability of the majority of NPP’s should correspond to the average reading level of the population, right? 

Keeping this in mind, it may not surprise you to know that about fifty percent of the adult population reads at or below a ninth grade reading level. Therefore, for the NPP’s to be comprehended by at least fifty percent of the population, the readability level should correspond to close to a ninth grade reading level. However, according to a study conducted by Steven Walfish and Bryan Ducey, ninety-six percent of States circulate NPPs above a ninth grade reading level. 

What does this signify for the client? I t signifies that many if not most clients do not initially understand the NPP and most probably do not bother to ask their mental health professional due to embarrassment or apathy. If this is true, many clients are not being adequately informed of their rights which also leaves the mental health professional open to liability should a lawsuit ensue. 

Maggie, age 14, was being sexually abused by her father, Joe. She felt she was needing to talk to someone, Maggie told her case worker, Helen about the abuse, but asked her to keep it, as she put, "secret". Helen, according to the law, then filed a court order against the father who was arrested. Terrified to testify in court in front of her hostile parents, Maggie retracted her statement and felt that Helen had betrayed her. 

During their sessions, she would cuss, scream, and threaten Helen whenever sexual abuse was brought up. Helen then tried to inform Maggie that what Helen had done was in accordance with law and the informed consent form, signed by her, indicated that Helen was allowed to disclose to the courts about sexual abuse. Maggie screamed, "I didn’t understand a god damn word of that bullshit paper! You told me to sign, so I signed!" Because Maggie had not understood the implications of sharing such delicate information to her case worker, the client-clinician relationship deteriorated. 

Can you think of a client who may have not understood the NPP you provided them? Do you need to reevaluate the wording of your own NPP?

♦ #3 Confirming Comprehension
In addition to HIPAA guidelines and readability, the third ethical boundary related to informed consent is confirming comprehension. Because HIPAA requires that NPP’s be written in "plain English" and clearly this is not being accomplished by cookie-cut forms, I have found that discussing rights with the client can help me know that they understand their rights. 

For clients with a very low reading level, I read it through with them and summarize the key points so that they can hear from me a more comprehensive interpretation. Sometimes, I make revisions to NPP forms that are much too difficult for most of my clients. These makes it easier to distribute and becomes less taxing on my time. Listen to the following excerpt from an NPP.

"In performing such functions, we may rely on certain business associates to assist us. We will share with our business associates only the minimum amount of personal health information necessary for this purpose."

This particular sentence was long and contained several clauses that may confuse the less educated client. It received a grade level of 12.0. The sentences were then revised to fit a grade level of 6.6. Listen closely and see if you can hear a difference:

In doing so we may rely on certain business associates to help us. We will share your health information with them. But we will only share the minimum amount that is needed."
The second set of sentences used many smaller sentences and less clauses. Also, it replaced more difficult words with less difficult ones. Think of your NPP forms. Could they be rewritten to optimize client comprehension?

3 HIPAA Guidelines Related to Minors

♦ Guideline #1 - Autonomy
The first concept related to ethical HIPAA boundaries regarding minors is autonomy. Respective of individual State regulations, the age of autonomy may vary. For many States, the age of maturation is no earlier than 17 or 18. After the attainment of this age, a parent or guardian ceases to make decisions for the client, and the client becomes independent of the parent or guardian. 

Of course, there are exceptions in the case of physical or mental handicaps, but in general, this is the norm. Once the client has reached an autonomous age, he or she also inherits the decision-making for the disclosure of medical and mental health records. Subsequent to this, the client’s parents or guardians no longer have the right to the client’s medical or mental health records without the client’s authorization. 

However, the client may achieve autonomy through emancipation when he or she has become married, had a child, or prove to be a mature minor. Once the minor has been emancipated from his or her parent or guardian, they gain the same rights as a matured adult. However, this law is also relative to State regulations. 

Joseph, age 16, had a pregnant girlfriend, Tammy. Deciding to take on a full-time job to pay for Tammy and their wedding, Joseph decided to become emancipated from his parents, who had been gaining access to his bank account and taking out money. Once he had become emancipated, Joseph became the sole decision-maker for his records. When his parents came to me and asked me to divulge what Joseph had confided in me about them, I refused, stating that he had become an independent and that they no longer had privilege to that information. 

Think of your Joseph. Has he or she become autonomous? Would mitigating circumstances prompt you to suggest your client take steps to be emancipated?

♦ Guideline #2 - State Laws vs. HIPAA
The second concept related to ethical HIPAA boundaries regarding minors is State laws vs. HIPAA. In the case of minors, a State law almost always preempts HIPAA regulations regardless of whether they prohibit, mandate or allow discretion about a disclosure. (Read this next sentence slowly) While HIPAA generally allows preemption by state privacy laws only where they are "stricter," this is an area of almost total deference. (Read this next sentence slowly) 

However, if the State is not clear or silent on their policies towards disclosure of minor records, a licensed health care professional has discretion to provide or deny a parent with access to the minor’s health information, if doing so is consistent with state or other applicable law. 

Joanna, age 14, had been living with her father for over two years because her mother, who maintained legal guardianship, was incarcerated for fraud. Joanna, prior to her move-in with her dad, had started to self-mutilate by cutting with a paper clip. Once her father had discovered this, he recommended her for treatment. Her mother, however, was released on probation and demanded the notes the therapist, Bonnie, had taken. The mother stated, "She’s my daughter, and I know he’s brainwashing her! I’m going to take her away from him, that bastard, he is turning her against me! He’ll never see her again!" 

Bonnie’s state had no regulation regarding this type of situation, and Joanna did not want her mother in her life. Joanna stated, "She’s very controlling, and I think she might be the reason I started cutting. I can’t express myself in her house!" Because Joanna’s mother was the root cause of her self-mutilation, Bonnie decided not to disclose records to Joanna’s parents. 

What is your State’s laws regarding the disclosure of a minor’s medical records to parents or guardians?

♦ Guideline #3 - Exemptions
In addition to autonomy and State laws vs. HIPAA, the third concept related to ethical HIPAA boundaries on minors is exemptions from State and HIPAA laws. If State and HIPAA laws both require that a parent be informed of their child’s session notes, there are certain circumstances that bypass both regulations. Most especially, "if a provider has a ‘reasonable belief’ that a child has been, or may be, subject to abuse or neglect, or that providing information to a parent or personal representative could endanger the minor, the provider may choose not to disclose." 

Obviously, this would not benefit the minor if his or her abuser had access to delicate files. Also, a provider may withhold information from a parent or personal representative if ‘in the exercise of professional judgment,’ it is decided that ‘it is not in the best interest of the individual to treat the person as the individual’s personal representative.’" Much like Bonnie’s case discussed earlier, the minor’s interests must always be at the forefront during a decision being made about the disclosure of notes. If a parent or guardian pose an imminent or potential threat to the client, it is ethically acceptable to deny them rights to the client’s records. 

Think of your minor client. Does his or her guardian or parent pose a threat? Would it be beneficial for the client if this parent or guardian does not have access to medical or mental health records?
Reviewed 2026

Peer-Reviewed Journal Article References:
Conrad, M. (2019). Moving upstream in the post-Hoffman era: When ethical responsibilities conflict with the law. Professional Psychology: Research and Practice, 50(6), 407–418.

Franeta, D. (2019). Taking ethics seriously: Toward comprehensive education in ethics and human rights for psychologists. European Psychologist, 24(2), 125–135.

Harris, S. E., & Robinson Kurpius, S. E. (2014). Social networking and professional ethics: Client searches, informed consent, and disclosure. Professional Psychology: Research and Practice, 45(1), 11–19.

Hill, C. E., Knox, S., & Pinto-Coelho, K. G. (2018). Therapist self-disclosure and immediacy: A qualitative meta-analysis. Psychotherapy, 55(4), 445–460.

Moss, L. S. (2017). Collaboration, confidentiality, and care. Psychological Services, 14(4), 443–450.

Online Continuing Education QUESTION 4
Any officer, employee, or person under contract with the department, or any board therein, or any subject of an investigation shall be prohibited from doing what? Record the letter of the correct answer the CE Test.