California mental-health confidentiality and the duty to warn: how it layers on HIPAA

Mental-health information gets extra protection in California, and the rules come from more than one place. On top of HIPAA, a California practice is dealing with the psychotherapist-patient privilege (Evidence Code § 1014), confidentiality in the public and community mental-health system (Welfare and Institutions Code § 5328), and a codified duty to protect — the Tarasoff rule at Civil Code § 43.92. This article maps those layers and the narrow point at which confidentiality gives way to a warning.

Key takeaways

• The psychotherapist-patient privilege (Evidence Code § 1014) lets a patient refuse and prevent disclosure of confidential communications with a psychotherapist.¹
• California's public and community mental-health records carry added confidentiality under Welfare and Institutions Code § 5328.²
• Civil Code § 43.92 codifies a duty to protect: it is triggered only by a communicated serious threat of physical violence against a reasonably identifiable victim.³
• The duty is discharged by making reasonable efforts to communicate the threat to the victim(s) and to a law enforcement agency.³
• Psychotherapy notes need a separate authorization under HIPAA (45 CFR § 164.508(a)(2)); keep them out of the general record.⁴

The psychotherapist-patient privilege (§ 1014)

California's Evidence Code Article 7 establishes the psychotherapist-patient privilege. Section 1014 provides that, subject to limited exceptions, "the patient, whether or not a party, has a privilege to refuse to disclose, and to prevent another from disclosing, a confidential communication between patient and psychotherapist."¹ This is an evidentiary privilege — it governs what can be compelled in legal proceedings — and it reinforces the confidential character of therapy communications that the CMIA and HIPAA also protect.

Public and community mental-health records (§ 5328)

Welfare and Institutions Code § 5328 provides that information and records obtained in the course of providing services under specified divisions of that code — California's community mental-health and involuntary-treatment system, including services under the Lanterman-Petris-Short Act — "are confidential," disclosable only in enumerated situations.²

The scope matters. Section 5328 attaches to services provided under those specified divisions — the public and community mental-health system. A purely private outpatient practice, with no county or LPS-program nexus, is generally governed by the psychotherapist-patient privilege, the CMIA, and HIPAA rather than by § 5328. Providers that do operate within the county/community system should treat § 5328 as directly applicable.

The duty to protect (§ 43.92)

The best-known California mental-health rule is the duty to protect — the statutory descendant of the Tarasoff decision. Civil Code § 43.92 does two things:

• It limits liability. There is "no monetary liability" and "no cause of action" against a psychotherapist for failing to protect against a patient's violent behavior except where "the patient has communicated to the psychotherapist a serious threat of physical violence against a reasonably identifiable victim or victims."³
• It defines how the duty is discharged. When that threat is communicated, the psychotherapist "discharges" the duty "by making reasonable efforts to communicate the threat to the victim or victims and to a law enforcement agency."³

Two features are worth emphasizing. First, the trigger is narrow: a communicated, serious threat of physical violence against a reasonably identifiable victim — not a vague or generalized concern. Second, discharging the duty requires notifying both the potential victim(s) and law enforcement. This is the specific, bounded exception where California law directs a disclosure that would otherwise be confidential.

Psychotherapy notes and HIPAA

HIPAA singles out psychotherapy notes for heightened protection. Under 45 CFR § 164.508(a)(2), a covered entity generally must obtain a separate authorization to use or disclose psychotherapy notes, apart from any general authorization, with narrow exceptions.⁴ California's privilege and confidentiality rules run in the same direction. The practical rule: keep psychotherapy notes physically and logically separate from the rest of the record, and never release them on a general authorization.

How the layers fit together

For a California mental-health provider, confidentiality is the default and it is reinforced from several directions — the privilege, § 5328 (where it applies), the CMIA, and HIPAA. Disclosure happens only where a specific rule permits or requires it: a valid CMIA authorization (see the authorization article in this series), an enumerated § 5328 exception, the § 43.92 duty-to-protect situation, or another lawful basis. When those rules point in different directions, the more protective one generally controls, and a close call belongs with counsel.

What this means for your documentation

These rules land on your release workflow and your written procedures — where they meet HIPAA's separate authorization requirement for psychotherapy notes at 45 CFR § 164.508(a)(2), the serious-threat disclosure permission at § 164.512(j), and the policies and procedures § 164.530(i) requires a practice to maintain. A California mental-health practice should:

1. Separate psychotherapy notes in your systems and your release workflow, consistent with 45 CFR § 164.508(a)(2).
2. Write a duty-to-protect procedure that mirrors § 43.92 — what a communicated serious threat is, and the steps to notify the identifiable victim(s) and law enforcement.
3. Determine whether § 5328 applies to your practice based on your program relationships, and document the answer.
4. Reflect these in your written policies as part of the confidentiality obligations your practice documents.

Turning that into policies and procedures a regulator would find defensible is the work itself — specific, citation-heavy, and easy to get wrong from a blank page. CoreFolio HIPAA walks through each step and produces that documentation with the structure already in place.

Sources

Footnotes

1. Cal. Evid. Code § 1014 (psychotherapist-patient privilege — the patient's privilege to refuse to disclose, and to prevent another from disclosing, a confidential communication between patient and psychotherapist; Article 7, §§ 1010–1027). California Legislative Information: https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=EVID&sectionNum=1014. ↩ ↩²

2. Cal. Welf. & Inst. Code § 5328 (confidentiality of information and records obtained in the course of providing services under specified divisions of the code, including the Lanterman-Petris-Short Act; enumerated disclosure exceptions). California Legislative Information: https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=WIC&sectionNum=5328. ↩ ↩²

3. Cal. Civ. Code § 43.92 (psychotherapist's duty to protect — no monetary liability or cause of action except where the patient has communicated a serious threat of physical violence against a reasonably identifiable victim; the duty is discharged by making reasonable efforts to communicate the threat to the victim or victims and to a law enforcement agency). California Legislative Information: https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=43.92. ↩ ↩² ↩³ ↩⁴

4. 45 CFR § 164.508(a)(2) (HIPAA — a separate authorization is generally required to use or disclose psychotherapy notes, with narrow exceptions). Electronic Code of Federal Regulations: https://www.ecfr.gov/current/title-45/section-164.508 ↩ ↩²