Patient health information is protected by HIPAA (Health Insurance Portability and Accountability Act) and by professional ethical standards. The general principle: patient privacy is the default. Disclosure requires either patient consent or a specific legal or ethical exception. Within disclosures, share the minimum necessary information for the purpose.
Patient consent for routine disclosures. When you communicate with the PCP, the therapist, family members — get a release. Document the release. Specify what can be shared, with whom, for what purposes. The release is the patient's; it can be revoked.
The minimum necessary principle. Even with authorized disclosure, share what serves the purpose, no more. The PCP needs to know the medication and clinical status; they don't necessarily need to know the patient's full trauma history or relationship details. The minimum necessary discipline protects the patient from over-disclosure.
Exceptions to consent requirements include: mandated reporting (child abuse, elder abuse, vulnerable adult abuse, sometimes specific threats — varies by jurisdiction). Imminent danger to self or others (you can break confidentiality to protect from harm). Court orders and subpoenas (consult institutional protocol; not all subpoenas require disclosure). Treatment, payment, healthcare operations (the standard HIPAA exception that allows internal information flow within healthcare systems).
Practical implementation: Locked offices, secure electronic systems, password-protected devices, encrypted communications, careful conversation locations. Privacy is physical, electronic, and conversational. The discussion in the hospital cafeteria about a specific patient is a HIPAA violation; the chart left open on the screen with the patient's room number visible is a HIPAA violation.
Patients asking about other patients: you cannot confirm or deny that a specific person is your patient without their consent. "I can't confirm or deny that I see this person as a patient. If they're a patient, they would need to contact us themselves."
Family caller without release: you can receive information from them (they don't need a release to give you information), but you can't share information back without the patient's authorization.
HIPAA violations have institutional and personal consequences. Know your institutional policy. Know your state's variations. When uncertain, consult before disclosing.