Therapist Confidentiality Statement: Filled Example and Template

The example is filled so you can hear the tone and see the decisions a client needs to understand. Do not hand it out unchanged. Replace the practice identity, describe the channels you actually use, name the records-request process, and have the person responsible for privacy and compliance review the final version.

Adapt the statement before you publish it

Use the table as a short handoff between the filled example and your practice review. Keep the client-facing sentences plain; keep your state and license research in the policy file behind the statement.

Section	What it says	What to adapt
Privacy promise	Information is handled privately and access is limited	Name your practice, workforce, vendors, and actual access workflow
Limits	Some disclosures may be required or permitted	Confirm your license, state reporting duties, court-process language, and safety workflow
Records	A clinical record exists and can be requested	Confirm the designated-record-set process, retention policy, fees, and custodian
Electronic communication	Channels carry different privacy risks	Name the portal, email, text, video, response window, and urgent-care alternative
Questions and rights	Clients can ask before sharing and request privacy materials	Add your privacy contact, notice of privacy practices, and records-request route

This table is a drafting map, not a national checklist. Keep every sentence true of your practice. If you do not offer texting, do not promise a text policy. If you work in more than one state, check the statement against each applicable license and client location.

What confidentiality means in the room

Tell the client what you will do, not only what you will not do. Explain who may access the record for treatment, payment, operations, supervision, or technology support; which disclosures are covered by your privacy process; and how the client can ask questions. The ACA Code of Ethics calls for counselors to explain confidentiality and its limits.

Use the words you can follow in practice. A promise such as “no one will ever see your information” is too broad for a team practice, a supervised setting, a billing workflow, or a practice that uses an electronic health record. A narrower sentence that names the people and purposes involved is more useful to the client and easier for your staff to honor.

Your statement should sit beside, not replace, the informed consent form for counseling clients and the practice’s notice of privacy practices. If you are deciding whether a proposed disclosure needs permission, compare the workflow with the HIPAA consent form sample and the authorization process rather than stretching this statement into a release.

State-specific limits need their own review

Do not publish one national sentence that suggests every therapist has the same reporting or warning duty. Use the client’s location, your professional license, the facts, and current law as prompts for a jurisdiction-specific review. Research your own jurisdiction’s current rules rather than copying a statement from another state.

Before you finalize the page or handout:

1. Identify the license and every state where you provide care or maintain a client relationship.
2. Check the current reporting, court-order, subpoena, and safety-disclosure rules for that license and location.
3. Ask whether minors, guardians, couples, families, schools, employers, or probation conditions change who can receive information.
4. Confirm the practice’s process for documenting a disclosure decision and consulting a supervisor, privacy officer, carrier, or counsel.
5. Replace broad promises with the narrow, accurate language your team can use consistently.

The statement cannot make a disclosure lawful by itself. If a situation is urgent or legally complex, follow your safety and consultation procedure instead of improvising from a handout.

Records and electronic communication

A confidentiality statement earns trust when it answers ordinary operational questions. State whether you use a portal, email, text, voicemail, video platform, paper forms, or an outside billing or scheduling service. Tell clients what to use for clinical details, what not to use for urgent concerns, and how to correct a wrong address or mistaken recipient. Keep the public statement consistent with your actual vendor agreements, access controls, retention schedule, and breach-response process.

For HIPAA-covered practices, explain the relationship between this client-facing statement and the HIPAA Privacy Rule. The rule governs uses and disclosures of protected health information; it does not turn a short handout into a complete notice of privacy practices. Keep the 45 CFR 164.520 requirements and your current notice in the privacy file, and have the responsible reviewer confirm that the public explanation matches both.

A records promise also needs a real process. Name who receives a request, how identity is verified, where the request is logged, how the practice handles amendments or corrections, and when the client receives a response. Do not write a retention period into this handout unless your license, state law, payer contract, and practice policy support the number you publish. Your client confidentiality and records guide covers the broader workflow.

Download the template

Use the one-page therapist confidentiality statement template as your working copy. Fill the practice and contact fields, then compare every sentence with your actual privacy, records, electronic communication, and state-review process.

This template is an educational starting point, not legal advice or a substitute for informed consent, a notice of privacy practices, or a state-specific review. If your practice serves clients across state lines or uses a group, supervisor, school, or outside vendor, include those roles in the review.

References

• American Counseling Association. (2014). ACA Code of Ethics.
• Legal Information Institute. (n.d.). 45 CFR § 164.502—Uses and disclosures of protected health information.
• Legal Information Institute. (n.d.). 45 CFR § 164.520—Notice of privacy practices for protected health information.