The phone rings between sessions. A woman's voice, tight with worry: "I'm calling about my husband, David. He has an appointment with you on Thursday and he hasn't been himself lately. I just need to know if he's okay."

Your stomach drops a little. You may not even know if David exists as a client, and even if he does, you can't say so. But she sounds genuinely scared, and the human instinct is to reassure her. So what do you actually say?

This is one of the most common situations a solo therapist faces, and one of the easiest to get wrong. Let's walk through it properly.

The rule that surprises everyone

Here's the part that trips people up: you cannot even confirm or deny that someone is your client. Not "yes he's a patient but I can't discuss it." Not "I can't talk about whether he comes here." The fact that David is in therapy with you is itself Protected Health Information.

Acknowledging the relationship reveals that David is seeking mental health treatment. For many people that single fact is more sensitive than anything discussed in the room.

So the worried wife on the phone doesn't get a yes or a no. She gets a neutral, kind, completely non-confirming response. More on the exact wording in a moment.

Why "she's his wife" doesn't change anything

The caller will often lead with their relationship, as if being family unlocks the door. "I'm his mother." "I'm her partner of twelve years." "We're married."

None of that grants access on its own. HIPAA's permission for disclosures to family and others involved in a patient's care comes from 45 CFR § 164.510(b), and it has real conditions attached. It is not a blanket "family members are allowed" rule.

Under § 164.510(b), you may share PHI relevant to a person's involvement in the client's care or payment only when:

The client agrees, or is given the opportunity to object and does not, or
You can reasonably infer from the circumstances, using professional judgment, that the client would not object, or
The client is not present or is incapacitated, and you judge that disclosure is in their best interest, limited to information directly relevant to that person's involvement.

The key phrase is "relevant to that person's involvement in care." Even when disclosure is permitted, it is narrow. It does not turn into permission to discuss diagnosis, session content, or anything the family member is simply curious about.

And critically, when the client is a competent adult who has not authorized contact, an unsolicited call from a spouse does not meet any of these conditions. You have no agreement, no opportunity-to-object that was offered, and no incapacitation. The default is silence.

What to actually say when the phone rings

You need a response that is warm, professional, and reveals nothing. Practice it out loud until it's automatic, because in the moment your instinct to be helpful will fight you.

Something like:

"I understand you're worried, and I can hear how much you care about him. I'm not able to confirm or share any information about whether someone is or isn't a client here. That's true for everyone who contacts this practice, and it protects your husband's privacy too. What I can tell you is that if he is working with someone, the best thing you can do is talk with him directly and encourage him to reach out for support."

Notice what that does:

It validates her feelings without confirming anything.
It frames confidentiality as protection, not stonewalling.
It gives her a constructive next step.
It uses "if he is working with someone" — hypothetical, never confirming.

If she pushes — and she might — you stay on the same script. "I really do understand. I'm just not in a position to confirm anything about who does or doesn't come here." Repeat as needed. Calm and unmovable.

Common scenarios and how each one differs

A parent calls about their adult child

"I'm Sarah's mom. She's 24 and she lives at home and I'm paying for everything, so I think I have a right to know how she's doing."

Paying for treatment does not grant access to a competent adult's PHI. Once a client is 18 (or the age of majority in your state), the parent is, for HIPAA purposes, just another third party. Same non-confirming response.

The exception is when the adult client has signed an authorization naming the parent, or has invited the parent into the care in a way that satisfies § 164.510(b). Absent that, you treat the mother exactly as you'd treat a stranger.

A parent calls about their minor child

This one flips. For most minors, the parent is the personal representative under § 164.502(g) and generally has the right to access the child's PHI and to receive disclosures. But there are important state-law carve-outs — minors can often consent independently to mental health, substance use, or reproductive care, and in those situations the parent's access may be restricted.

So with minors, the answer is genuinely "it depends on your state and the type of treatment." Know your state's minor-consent rules before the call comes, not during it.

A partner calls claiming an emergency

"You don't understand, this IS an emergency. He took something. I think he's going to hurt himself and I need to know what he's on."

Now the calculus can change — but carefully. If you reasonably believe there is a serious and imminent threat to the client's health or safety, you have more latitude. We'll cover the duty-to-warn provision in the next section.

In a true acute emergency, the right move is usually not a long phone conversation about confidentiality. It's directing the caller to call 911 or take the person to an emergency room immediately. That advice reveals no PHI and is the most useful thing you can offer in the moment.

An attorney calls

"I represent the opposing party in a custody matter. I need to confirm your client is in treatment and ask a few questions."

Politely decline to confirm anything, and do not answer questions. A phone call from a lawyer carries no legal authority to compel disclosure. If they want records, they need a valid authorization from the client, a subpoena, or a court order — and even then there's a process. Tell them to submit any request in writing and end the call.

When duty to warn overrides confidentiality

There is a real exception for danger, and it lives in 45 CFR § 164.512(j) — disclosures to avert a serious and imminent threat. You may disclose PHI if you believe in good faith that it is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, and the disclosure is to someone able to prevent or lessen the threat.

This is the federal floor. Layered on top are your state's specific duty-to-warn or duty-to-protect statutes (the Tarasoff line of law), which vary widely — some mandate warning, some permit it, some specify exactly who must be notified. Your state rules govern the details.

A few guardrails:

The threat must be serious and imminent, not vague worry.
You disclose only what's necessary to address the danger — not the whole file.
You disclose to someone who can act — law enforcement, the intended victim, emergency services — not just whoever happens to be on the phone.
Document your reasoning: what you knew, why you judged it imminent, what you disclosed and to whom.

A scared spouse calling because David "hasn't been himself" does not meet the § 164.512(j) bar. A client who told you yesterday they have a specific plan to harm a named person might. The line matters, and it's a clinical judgment you should be ready to defend.

How to prepare before the call comes

You will handle this far better if you've decided in advance. A few concrete steps:

Write a script. The non-confirming response above, in your own words, printed and taped near the phone. When you're flustered, you read it.
Train anyone who answers your phone. If you use a virtual assistant or answering service, they need the exact same script. A well-meaning VA who says "Oh yes, David's appointment is Thursday at 2" has just caused a breach. This is a real risk and a common one.
Put a BAA in place with any answering service or VA who could be exposed to PHI, and document that they've been trained on confidentiality.
Know your state's rules for minors and for duty to warn, written down somewhere you can find them.
Decide your release process. If a client wants their partner looped in, that's their call to make — capture it as a signed authorization that names the person and the scope. Then you have clear permission on file instead of guessing on the phone.
Document contacts. When a third party calls, note it: who called, what they wanted, what you said. If anything ever escalates, that record protects you.

The goal isn't to be cold. It's to be the calm professional who protects your client's privacy even when — especially when — someone is pushing hard against it. The worried wife may not love your answer in the moment. But your client trusted you with something private, and holding that line is the job.

Not sure if your practice is covered?

Situations like these are exactly why having documented HIPAA policies matters. Yundra's free risk assessment identifies the specific gaps in your compliance — so you're prepared before something unexpected happens.

Check your compliance score →

A Client's Partner Just Called Your Office. What Can You Say?