The fiduciary duty of confidentiality is the legal and ethical obligation that keeps a trusted professional from sharing nonpublic information they learn while serving you. It applies to lawyers, doctors, therapists, trustees, investment advisers, and corporate insiders, among others. The duty covers almost everything the fiduciary learns through the relationship, not just the items you explicitly label as secret, and breaking it can trigger lawsuits, professional discipline, and in some cases criminal prosecution.
What the Duty Actually Covers
The scope is deliberately broad. If information is nonpublic and the fiduciary obtained it through the relationship, it is almost certainly protected. That includes what you tell the fiduciary directly, what they learn from documents you provide, and what they discover from third parties while working on your matter. An attorney’s duty, for example, extends to “information relating to the representation” as a whole, not just statements made in a meeting.1American Bar Association. Rule 1.6 Confidentiality of Information
The categories that typically fall inside the duty include:
- Trade secrets and proprietary business information such as manufacturing processes, client lists, and pricing strategies.
- Personal financial records: bank statements, tax details, investment holdings, and estate plans.
- Medical information, including diagnoses, treatment records, and mental health history.
- Strategic plans like pending mergers, restructuring, product launches, or litigation strategy.
- Communications with an attorney about legal matters.
Information that is already public does not trigger protection. If a fact appears in a public filing, a news report, or an open court record, the fiduciary has no duty to treat it as confidential. The duty attaches to private information that would cause harm or loss of advantage if it reached the wrong hands.
Confidentiality Is Not the Same as Privilege
People often use the two terms interchangeably, but they do different work. The duty of confidentiality is an ethical and legal obligation that prevents the fiduciary from voluntarily sharing information. Privilege is a narrower evidentiary rule that stops anyone from forcing the fiduciary or the client to reveal certain communications in court. Privilege protects only the communication itself, not the underlying facts.2Legal Information Institute. Attorneys Duty of Confidentiality
So if you tell your lawyer about a transaction, a court can still ask you what happened in the transaction. What it cannot do is compel your lawyer to repeat what you said about it. The duty of confidentiality goes further than that: outside of court, your lawyer cannot share the information with anyone.
Who Owes This Duty
The duty attaches to any relationship where one person places trust in another’s expertise and shares private information to receive professional guidance.3Legal Information Institute. Fiduciary Duty The most recognized relationships each come with their own legal framework.
Attorneys
A lawyer cannot reveal anything related to representing a client unless the client gives informed consent or a specific exception applies. The duty exists so that clients will be candid enough for their lawyers to actually help them.
Healthcare Providers
Doctors, therapists, and other healthcare professionals owe confidentiality under common law fiduciary principles and federal statute. The HIPAA Privacy Rule prohibits covered providers from using or disclosing protected health information without the patient’s written authorization or a regulatory exception, and requires providers to limit any permitted disclosure to the minimum necessary for the purpose.4U.S. Department of Health and Human Services. Summary of the HIPAA Privacy Rule A billing department can share diagnosis codes with an insurer for payment but cannot send over the full medical record.
Trustees
A trustee manages assets for someone else and routinely handles sensitive financial details about the trust and its beneficiaries. The trustee’s fiduciary duty requires keeping asset values, distribution schedules, and beneficiaries’ personal financial circumstances private.
Investment Advisers
Registered investment advisers have a fiduciary duty that includes protecting confidential financial information. Federal law goes further and requires every SEC-registered adviser to establish and enforce written policies designed to prevent the misuse of material nonpublic information.5Office of the Law Revision Counsel. 15 USC 80b-4a Prevention of Misuse of Nonpublic Information The obligation covers the adviser personally and anyone associated with the firm.
Corporate Officers and Directors
Insiders don’t have a blanket duty to keep secrets the way an attorney does. Their obligation is more targeted: they cannot misuse material nonpublic information about the company. Federal securities law treats insider trading as a fraud that violates the fiduciary duty insiders owe shareholders.6Legal Information Institute. Insider Trading The prohibition reaches anyone who receives material nonpublic information and knows or should know it came from an insider.
When Disclosure Is Allowed
The duty is strong but not absolute. Courts and legislatures have carved out narrow exceptions.
Consent
The simplest exception: the person who owns the confidence can waive it. A signed release lets an attorney share documents with a third party. A patient’s written authorization lets a healthcare provider disclose protected health information.4U.S. Department of Health and Human Services. Summary of the HIPAA Privacy Rule Consent has to be informed and specific. A vague blanket authorization usually does not satisfy the legal standard.
Preventing Serious Harm
Under ABA Model Rule 1.6, a lawyer may reveal client information to prevent reasonably certain death or substantial bodily harm, and may disclose to prevent a client from committing a crime or fraud that would cause substantial financial injury to someone else, particularly where the client has used the lawyer’s services in the scheme.1American Bar Association. Rule 1.6 Confidentiality of Information The healthcare analog is similar. A therapist who believes a patient poses a credible threat to an identifiable person may have a duty to warn the potential victim, a concept traced to the Tarasoff case in California and adopted in some form by most states.
Mandatory Reporting Laws
Every state requires certain professionals to report suspected child abuse, and most impose similar obligations for elder abuse. These laws override confidentiality by design. Healthcare workers, teachers, social workers, and in many states clergy and attorneys are designated as mandatory reporters, with criminal penalties for failing to report in nearly every state.
Court Orders and Subpoenas
A valid court order can compel disclosure. A lawyer served with a subpoena for client records must comply if the court orders production, though the lawyer is generally expected to assert privilege first and let the court rule. ABA Model Rule 1.6(b)(6) explicitly permits disclosure to comply with other law or a court order.1American Bar Association. Rule 1.6 Confidentiality of Information
The Duty Doesn’t End When the Relationship Does
The obligation continues after the professional engagement is over. A retired attorney is still bound by what a former client shared decades earlier. A financial adviser who leaves the industry cannot start discussing former clients’ portfolios. The U.S. Supreme Court held in Swidler & Berlin v. United States that attorney-client privilege survives even the death of the client, reasoning that people would hold back critical information during their lifetimes if they feared posthumous disclosure.7Legal Information Institute. Swidler and Berlin v United States The ethical duty of confidentiality follows the same logic, with narrow exceptions for settling the client’s estate.
The practical effect: former employees who had access to trade secrets remain bound at their new jobs, and a doctor who retires still cannot discuss a former patient’s diagnosis in casual conversation. The passage of time doesn’t dissolve the duty, because the information may be just as sensitive twenty years later.
What Happens When the Duty Is Breached
Consequences range from professional embarrassment to prison time, depending on the context and the severity of the breach.
Civil Liability
A fiduciary who discloses confidential information without authorization can be sued for the resulting financial harm. Compensatory damages cover actual losses. Courts can also order disgorgement, forcing the fiduciary to surrender any profits gained from the unauthorized disclosure. Injunctive relief is often the most urgent remedy: a court order prohibiting further disclosure and sometimes requiring the return or destruction of improperly shared materials. Specific statutes can expand on this. Under ERISA, a plan fiduciary who breaches any duty is personally liable to make the plan whole and must return any profits made through misuse of plan assets.8Office of the Law Revision Counsel. 29 US Code 1109 – Liability for Breach of Fiduciary Duty
Professional Discipline
Attorneys who violate confidentiality face discipline from their state bar, including suspension or disbarment. Doctors and therapists risk losing their licenses. Investment advisers face SEC enforcement actions, which can include fines and industry bars. These professional consequences often sting more than a civil judgment, because they end careers.
Criminal Penalties
In healthcare, HIPAA violations carry escalating criminal penalties. Knowingly obtaining or disclosing protected health information can result in fines up to $50,000 and a year in prison. If the violation involves false pretenses, the maximum rises to $100,000 and five years. Where the intent is to sell or use health information for commercial advantage or malicious purposes, penalties reach $250,000 and ten years.4U.S. Department of Health and Human Services. Summary of the HIPAA Privacy Rule HIPAA also imposes tiered civil monetary penalties scaled to culpability, ranging from $100 per incident for an unknowing violation up to $50,000 per violation for willful neglect that goes uncorrected, with an annual cap of $1.5 million for repeated violations of the same requirement. Corporate insiders who trade on confidential information face securities fraud charges. The pattern is consistent across contexts: the more deliberate the breach, the harsher the consequences.