Client confidentiality is the duty that stops your lawyer, doctor, financial advisor, therapist, tax preparer, or clergy member from sharing what you tell them, or what they learn about you through your professional relationship. It is both an ethical obligation enforced by licensing bodies and, in many settings, a legal one backed by federal statute. It covers far more than the things you specifically ask to keep quiet, and it has a short, well-defined list of exceptions. Break it, and the professional can lose their license, face a civil suit, or in healthcare, trigger federal penalties reaching into the millions.
What the Duty Actually Covers
The protected zone is wider than most clients expect. It takes in every direct communication between you and the professional, whether spoken in a meeting, written in an email, or sent as a text. It takes in records and documents the professional creates or receives on your behalf, observations they make about you, and in many settings even the fact that you are a client at all. A therapist generally cannot confirm or deny that you are a patient without your permission.
How the information reached the professional does not matter. If your lawyer picks up something relevant to your case from a third party, or your accountant spots a pattern while reviewing your records, that information is still confidential. Anything connected to the professional relationship stays inside it unless an exception applies.
Which Professionals Owe You Confidentiality
Lawyers
Lawyers operate under some of the strictest confidentiality rules of any profession. The ABA Model Rules of Professional Conduct, which every state uses as a template, bar a lawyer from revealing any information related to representing a client unless the client gives informed consent, the disclosure is implicitly necessary to carry out the representation, or a specific exception applies.1American Bar Association. Rule 1.6: Confidentiality of Information That covers casual remarks at dinner, background research, notes in a file, and information picked up from witnesses.
The duty does not end when your case closes or when you change attorneys. A lawyer who represented you ten years ago still cannot reveal what you told them.
Healthcare Providers
Doctors, therapists, nurses, and other healthcare professionals are bound both by professional ethics and by the Health Insurance Portability and Accountability Act. HIPAA governs how providers, insurers, and related organizations handle your protected health information. Internal uses for treatment, payment, and healthcare operations generally don’t need your written authorization; most other disclosures do.
Financial Professionals
Financial advisors, accountants, banks, and brokers must protect your nonpublic personal information under the Gramm-Leach-Bliley Act, which requires financial institutions to explain their information-sharing practices and to safeguard your data.2Federal Trade Commission. Gramm-Leach-Bliley Act If an institution wants to share your data with unaffiliated third parties, it has to notify you and give you a chance to opt out.3Federal Trade Commission. How To Comply with the Privacy of Consumer Financial Information Rule of the Gramm-Leach-Bliley Act
Tax Practitioners
Federal law extends a privilege to communications between you and a federally authorized tax practitioner that mirrors the attorney-client privilege, but only in noncriminal tax matters before the IRS or in noncriminal federal tax proceedings.4Office of the Law Revision Counsel. 26 U.S. Code 7525 – Confidentiality Privileges Relating to Taxpayer Communications It does not cover tax shelter communications, and it does not protect you in a criminal tax investigation. On top of that, any person in the business of preparing tax returns who knowingly or recklessly discloses your return information faces criminal penalties: up to $1,000 and up to one year in prison, with the fine jumping to $100,000 for certain aggravated disclosures.5Office of the Law Revision Counsel. 26 USC 7216 – Disclosure or Use of Information by Preparers of Returns
Clergy
Virtually every state recognizes a clergy-penitent privilege for confidential communications made to a member of the clergy for spiritual guidance. Some states cover only formal confessions within a specific religious discipline; others sweep in any communication made to a minister, rabbi, imam, or similar figure acting in their professional capacity. In many states, the clergy member cannot waive the privilege without the communicant’s consent.
When Your Professional Can or Must Disclose
Confidentiality is strong, not absolute. A handful of recognized exceptions apply, and some of them require the professional to speak up whether you want them to or not.
Your Own Consent
The simplest exception is your permission. Informed consent lifts the barrier for the specific disclosure you authorize. Some consent is implied by the nature of the relationship: hiring a lawyer at a firm implicitly authorizes that lawyer to discuss your matter with colleagues working on it.1American Bar Association. Rule 1.6: Confidentiality of Information
Court Orders and Legal Mandates
A subpoena or court order can compel disclosure. The professional generally must comply, though a careful lawyer will challenge overbroad demands or assert any applicable privilege before producing anything. Regulatory reporting requirements can also override the duty.1American Bar Association. Rule 1.6: Confidentiality of Information
Preventing Serious Harm
A lawyer may reveal confidential information to prevent reasonably certain death or substantial bodily harm.1American Bar Association. Rule 1.6: Confidentiality of Information This is permissive. The rules say the lawyer “may” disclose, leaving the call to professional judgment, and the threat has to be serious and likely rather than speculative.
For mental health professionals the duty is often mandatory. Following the 1976 California case Tarasoff v. Regents of the University of California, almost every state has enacted some form of “duty to warn” or “duty to protect” law requiring therapists and psychologists to alert potential victims or law enforcement when a patient poses a credible threat of violence.6National Conference of State Legislatures. Mental Health Professionals Duty to Warn
Preventing Financial Crimes
A lawyer may disclose confidential information to prevent a client from committing a crime or fraud that would cause substantial financial harm to someone else, particularly where the client has used the lawyer’s own services to further the scheme.1American Bar Association. Rule 1.6: Confidentiality of Information Financial institutions face a related obligation: federal law requires brokers, dealers, and many advisors to file Suspicious Activity Reports when they detect transactions that may involve money laundering or other financial crimes. Those reports are themselves confidential, and the institution is prohibited from telling you one was filed.7Financial Crimes Enforcement Network. FinCEN Suspicious Activity Report Electronic Filing Instructions
Mandatory Reporting of Abuse
Across professions, mandatory reporting laws require disclosure of suspected child abuse, elder abuse, or abuse of vulnerable adults. Healthcare workers, teachers, social workers, counselors, and law enforcement officers are among the most common mandatory reporters, though the exact list depends on your state. A therapist who learns during a session that a child is being harmed cannot hide behind patient confidentiality.
Self-Defense by the Professional
When a client sues their lawyer for malpractice, files a bar complaint, or raises any other claim arising from the representation, the lawyer may reveal confidential information to the extent needed to defend themselves.1American Bar Association. Rule 1.6: Confidentiality of Information The same principle applies in fee disputes. The exception is narrow: only what the defense genuinely requires.
What Happens When Confidentiality Is Breached
The consequences depend on the profession, the information disclosed, and whether the breach was intentional or careless.
Professional Discipline
For lawyers, an unauthorized disclosure can trigger a state bar investigation. Sanctions range from a private reprimand for minor or inadvertent violations to suspension and, in egregious cases, disbarment. Healthcare professionals face parallel discipline through state licensing boards, which can revoke or suspend medical licenses. Financial professionals can lose industry registrations and certifications.
Civil Liability
A client harmed by an unauthorized disclosure can sue. The specific theory varies by state, but claims generally require showing a confidential relationship, information meant to stay private, and disclosure without authorization. Courts can award monetary damages, and reckless or malicious conduct can support punitive damages on top of actual losses.
HIPAA Civil Penalties
HIPAA violations carry federal civil monetary penalties that scale with culpability. Under the 2026 inflation-adjusted schedule, the per-violation tiers are:
- No knowledge of the violation: $145 to $73,011
- Reasonable cause, not willful neglect: $1,461 to $73,011
- Willful neglect, corrected within 30 days: $14,602 to $73,011
- Willful neglect, not timely corrected: $73,011 to $2,190,294
All categories are subject to a calendar-year cap of $2,190,294 for violations of the same provision.8Federal Register. Annual Civil Monetary Penalties Inflation Adjustment The penalties reach providers, insurers, clearinghouses, and their business associates. Criminal violations involving the knowing misuse of health information bring additional fines and possible imprisonment.
Financial and Tax Penalties
Gramm-Leach-Bliley privacy violations can mean fines for both institutions and individuals, with imprisonment possible for knowing violations. Tax return preparers who disclose your information face misdemeanor charges carrying up to $1,000 and one year in prison, rising to $100,000 for disclosures tied to identity theft or other aggravated offenses.5Office of the Law Revision Counsel. 26 USC 7216 – Disclosure or Use of Information by Preparers of Returns
Confidentiality Is Not the Same as Attorney-Client Privilege
People use “confidentiality” and “attorney-client privilege” interchangeably. They are different tools, and mixing them up can produce unpleasant surprises in litigation.
Confidentiality is the broad ethical duty described above. It covers all information related to the representation, whatever the source, at all times. A lawyer who gossips about your case at a cocktail party has breached their ethical duty.
Attorney-client privilege is narrower and more powerful. It is a rule of evidence that blocks anyone from forcing disclosure of confidential communications between you and your lawyer when those communications were made to get legal advice. The privilege lets you quash a subpoena, shut down a deposition question, or keep a document out of trial. Confidentiality has no courtroom enforcement mechanism of that kind.
The practical differences:
- Scope. Confidentiality covers everything connected to the representation, including facts your lawyer learned independently. Privilege covers only direct communications between you and your attorney made for the purpose of seeking legal advice.
- Enforcement. Confidentiality is enforced through professional discipline and civil lawsuits. Privilege is enforced by objecting in court to block compelled testimony or document production.
- Who can waive it. Privilege belongs to you. Your lawyer cannot waive it without your consent. But you can destroy it by sharing the communication with outsiders, and if a third party who is not essential to the attorney-client relationship is present during the conversation, the privilege may never attach at all.
- Duration. Both survive the end of the professional relationship. Attorney-client privilege also survives the client’s death; the U.S. Supreme Court confirmed this in Swidler & Berlin v. United States.
The Crime-Fraud Exception
One critical limit applies specifically to the privilege. Communications made to further an ongoing or planned crime or fraud are not protected, even if they would otherwise qualify. The focus is on your intent as the client: if you sought legal advice to help carry out or conceal wrongdoing, the privilege does not attach. The attorney’s knowledge or intent is not the question. A party trying to pierce the privilege under this exception has to present enough evidence to show you were engaged in or planning criminal or fraudulent activity and that the communications were meant to advance it.