Mandatory Reporting Requirements: Legal, Risk Management and Ethical Considerations
By: Anne Huben-Kearney, RN, BSN, MPA, CPHQ, CPHRM, CPPS, DFASHRM
Assistant Vice President, Risk Management Group

Psychiatrists, like other medical professionals maintain a legal and ethical obligation to their patients not to share personal or health information without the patient’s explicit, informed consent. Communications between a psychiatrist and a patient are considered “privileged” and many psychiatrists feel uncomfortable with the idea that information they obtain through conversations with patients may be used for purposes other than to help their patients. However, there are legally imposed limitations to confidentiality whereby psychiatrists have a “duty to warn” or a “duty to protect” if they receive information suggesting a patient may represent an imminent risk to themselves or others. For this reason, patients need to be informed of the limits of the psychiatrist’s confidentiality at the on-set of the physician-patient relationship and as needed thereafter.

All 50 U.S. states have statutes that identify those persons required to report suspected child abuse to an appropriate agency (e.g., child protective services (CPS), a law enforcement agency, or a state’s toll-free child abuse reporting hotline).1 Those required to report suspected child abuse typically include health care workers, mental health workers, teachers, clergy and law enforcement officers.

The U.S. Department of Health and Human Services provides state-by-state guidelines specifying when and how to report. Reports must not only include confirmed abuse but also the suspicion of abuse. Psychiatrists in all 50 states are also obligated to report known or suspected incidents of elder abuse. Several states have also adopted mandatory domestic violence reporting requirements. Likewise, most states impose some obligation to warn or protect intended victims and/or notify law enforcement when there is a reasonable probability that a patient intends to harm themselves or another person. Because state laws vary, psychiatrists should know the legal reporting requirements in the jurisdiction(s) in which they practice.

In 1996, the federal government passed the Health Insurance Portability and Accountability Act (HIPAA). HIPAA standardized the expectations of patient confidentiality surrounding Protected Health Information (PHI). However, HIPAA’s implementation regulations specify exceptions in which it is appropriate to break confidentiality, particularly in situations when a failure to do so could result in harm to a patient or to the public.

HIPAA requires that covered entities (CE) give patients written notice of their privacy rights. Under most circumstances, patients must give their authorization before the CE can share their information or records. CEs, which include psychiatrists, may disclose protected health information in order to report known or suspected child abuse or neglect, if the report is made to a public health authority or other appropriate government authority that is authorized by law to receive such reports. For instance, the social services department of a local government might have legal authority to receive reports of child abuse or neglect, in which case, the Privacy Rule would permit a CE to report such cases to that authority without obtaining individual authorization. Likewise, a CE could report such cases to the police department when the police department is authorized by law to receive such reports. See 45 CFR 164.512(b)(1)(ii). See also 45 CFR 512(c) for information regarding disclosures about adult victims of abuse, neglect, or domestic violence.

Psychiatrists must report to the appropriate authorities acts that meet the “minimum definitions” of child and sexual abuse described in the Child Abuse Prevention and Treatment Act (CAPTA). Under CAPTA,2 child abuse is considered any recent action resulting in imminent risk of serious harm, death, serious physical or emotional harm, sexual abuse, or exploitation:

  • Of a child (usually a person under the age of 18, but a younger age may be specified in cases not involving sexual abuse)
  • By a parent or caretaker who is responsible for the child’s welfare

Under CAPTA, sexual abuse is defined as:

  • Employment, use, persuasion, inducement, enticement, or coercion of any child to engage in, or assist any other person to engage in, any sexually explicit conduct or any simulation of such conduct for the purpose of producing any visual depiction of such conduct; or
  • Rape, and in cases of caretaker or interfamilial relationships, statutory rape, molestation, prostitution or other form of sexual exploitation of children, or incest with children.

The American Psychological Association (APA) and the American Association for Child and Adolescent Psychiatry (AACAP) address reporting of child abuse in their code of ethics and conduct, within APA Ethical Standard 4.05, Disclosures. APA also offers forms of guidance on the subject.3

Reports should be telephoned to the nearest child protective service agency. After hours or on weekends, reports should be called in to a hotline or other number, as available. Practitioners in all states should know the numbers to call in their state of practice. Psychiatrists should not wait to report abuse, instead they are encouraged to report as soon as they suspect, know or have reasonable cause to believe it exists. Some states require that a written follow-up report be sent to CPS within a defined amount of time following the telephone report of abuse or neglect. Psychiatrists should become familiar with the requirements in the state/s in which they practice.

It is also important to understand that a mandated reporter who fails to report actual or suspected abuse may be subject to a fine or other penalty. There have been cases where medical malpractice suits have been filed against health care professionals who failed to report their suspicions of abuse and/or neglect. When a child suffers egregious harm or death at the hands of an abuser, and it is learned or determined that a psychiatrist knew or suspected their patient was abusing a child, it would be extremely difficult to defend that psychiatrist’s failure to report.


There are many issues to consider when it is suspected that a patient may either be in an abusive relationship or might be abusing or has abused another individual. Psychiatrists are encouraged to call a risk management professional or attorney if they have questions about whether or not to report potential abuse or neglect. As a general rule, reporting a suspicion of abuse is preferable to not reporting. In the event of litigation, it is far easier to defend the practitioner who reported in good faith, even if the report is found not to have merit.

Risk Management Tips

  • Become familiar with the abuse and neglect reporting requirements in the state where you practice. Regulations and laws vary among each state.
  • Be aware of your ethical guidelines and obligations. Review APA and AACAP’s code of ethics and conduct.
  • Know the conditions which you are expected to report. Review the definitions of abuse and neglect as defined by the local Child Protective Services Agency.
  • Make patients aware of the limits of confidentiality imposed by federal and state laws when you first meet with the patient and as needed thereafter. Document this discussion in the patient’s record.
  • Contact a risk management professional or an attorney if you have questions about your reporting obligations or to assist you to determine whether a patient’s circumstances warrant a mandatory report.
  • Document all information, including patient disclosures and observations that you use to determine that a patient is being abused, neglected or has abused another individual.

1 Child Welfare Information Gateway. Mandatory reporters of child abuse and neglect. Washington, DC: US Department of Health and Human Services, Children’s Bureau; 2016.

2 Child Abuse Prevention and Treatment Act (CAPTA) (Jan. 1996 version), 42 U.S.C.5101, et seq.

3 American Psychological Association, Disclosing Confidential Information, Stephen Behnke, JD, PhD, MDiv, April 2014, Vol. 45, No.4.