Strategies for Documenting Information in the Medical Record: Managing Confidentiality, Privacy, and Staff Disagreements

Have you ever wondered whether and when it is appropriate to withhold or delete sensitive information from the medical record? Have you been uncertain about which information is considered sensitive (and to whom)? Have you struggled over whether and how to address disagreements among coworkers regarding a patient’s diagnosis and treatment in the medical record? If you have, the following case vignette and discussion should prove useful.

CASE VIGNETTE

Mr A, a 24-year-old Latino man, was urgently brought by police to the emergency department (ED) after sustaining stab wounds to his arm and abdomen and blunt force trauma to his head. He was alert and communicative in the ED, but his Glasgow Coma Scale score was 13. Signs of autonomic dysfunction were present (hypotension and tachycardia). Law enforcement reported that a neighbor had anonymously called 9-1-1 after witnessing a physical altercation involving Mr A and several other men. Mr A’s evaluation, which included a computed tomography scan of his head, revealed no skull fracture or intracranial hemorrhage.

Mr A, who had limited English proficiency, appeared frightened despite receiving reassurance that he would survive his traumatic injuries. When a Spanish interpreter became involved, Mr A continued to provide only brief answers, eg, “I don’t feel safe,” and his hesitancy to communicate prompted a psychiatric consultation.

Dr D, a native Spanish-speaking psychiatric consultant and hospital-approved bilingual care provider, observed that Mr A repeatedly glanced over at the police officer who was standing nearby, and Dr D asked the officer to leave the area, as Mr A had not been placed under arrest. Once they were alone, Mr A relaxed and explained that he was undocumented and hoped to apply for asylum after fleeing from gang violence, which had led to the murder of his older brother. Mr A believed that his assailants were affiliated gang members. Now, he was concerned that he will be arrested and deported or that the gang will retaliate against him for cooperating with the police. Mr A asked Dr D not to document his immigration status and if he could be registered as “sin nombre” (ie, without a name) in the medical record.

DISCUSSION

What Is the Purpose of the Medical Record, and How Has It Evolved Over Time?

Over the last decade, the medical record has transitioned from being a siloed record for health care providers to a shared communication tool among health care providers and their patients. Since the Health Insurance Portability and Accountability Act (HIPAA) guaranteed that patients can review and obtain copies of their medical records,¹ many clinicians now expect that their patients will review their own records after each clinical encounter.² This ready access to the observations and impressions by clinicians empowers patients and enhances their perception of having control over their health care.³

Electronic health records (EHRs) have been used as a defense against allegations of negligence,⁴ as a compliance instrument, and for quality assurance and improvement purposes. Most health care providers recognize that they should be transparent about the clinical care they provide. Unfortunately, this can create tension between the obligation to document information and to maintain patient privacy. When conflicts and discrepancies that involve documentation are revealed, clinicians can face unique medicolegal liabilities.⁵

To mitigate these risks, some clinicians have moved away from documenting sensitive details in the EHR. Increasingly, this is accomplished by alluding to, but not describing in detail, sensitive information (eg, immigration status, gender, employment status, collateral information) in clinical notes.⁴

Notes should focus on objective data; current or past injuries and illnesses should be recorded only insofar as they impact case formulation and treatment. In the case of Mr A (who was assaulted), the circumstances of the assault were relevant only insofar as they impacted his clinical care. Narratives about injuries should document the information as reported by the patient; clinicians are not expected to investigate and verify the details of injuries. Although the context and history of an event (eg, whether the patient was a victim or a perpetrator, whether psychiatric or substance-related issues were involved) may help to formulate a risk assessment, detailed accounts by the patient are rarely necessary; instead, the nature and sequelae of that event are more relevant.⁶ When explaining to patients that the medical record is confidential (unless the information suggests that there is an imminent risk of danger to the patient or to someone else), they should also be told that the medical record can be requested by the courts.

How (and When) Can the Limits of Privacy Be Discussed with Patients?

Clinicians can engage patients in conversations about the limits of privacy in clinical practice, especially when dealing with sensitive matters or information (eg, people who have been deceitful or who engage in self-injurious behaviors [such as with factitious illness, malingering]).⁷ Such communications can enhance a patient’s understanding of the legal implications of documentation and minimize surprise disclosures and ruptures of the therapeutic alliance.

What Problems Can Arise When Too Much or Too Little Documentation Is Provided?

Providing too little documentation can interfere with establishing a diagnosis and a treatment plan. Excessive documentation can increase the risks of patient harm⁵ and conflicts.⁴ Clinicians should appreciate that all data documented in the medical record are subject to a subpoena and may be used as testimony in a court of law and be challenged by patients. Thus, subjective impressions, notations about nonadherence, or suspicions of deception should be phrased precisely and with legally defensible language.

The failure to explicitly inform the patient about how detailed information will be recorded, and the specific ways in which the record might be deployed (eg, for child custody, disability reviews, durable power of attorney proceedings, competency decisions, testimony), constitutes a failure to uphold the principles of informed consent.⁷

One consequence of open access to the EHR, particularly in mental health, is rupture of the therapeutic alliance.⁵ Since documentation of a patient’s affect, presentation, or personality is highly subjective, it is susceptible to misinterpretation, anger, and disappointment when reviewed by patients.

Documentation of collateral information (eg, information shared by family members, caregivers, coworkers) can raise additional issues. When a patient accesses their record and learns that family members have shared sensitive information about them, intense reactions may be precipitated that worsen their psychiatric status.⁴ However, patients are not entitled to access collateral information that has been entered into their medical records. Moreover, some providers may withhold specific details from the EHR if their disclosure would result in serious mental harm to the patient or would be likely to harm another person.⁴

When information has been restricted or withheld, providers should inform their patient of their right to apply to the relevant governing body for an order to compel the release of the information. This process transfers the disclosure liability from individual providers to those on recognized legal boards.⁴ Table 1 provides the relationship between the categories of documentation, their consequences, and strategies to mitigate harm.^2,4,5,8

What Might Be the Consequences of Documenting (Certain) Details in the Medical Record?

Managing risk around disclosure involves proactively addressing the limits of confidentiality with patients. This should be done at the beginning of clinical encounters.^7,8 This discussion goes beyond signing an informed consent form (especially for the care of adolescents).⁹ This discussion serves as a real-time agreement, rather than an administrative form that merely requires a signature.^9,10 Clinicians should be familiar with local legal standards, such as “Gillick competence” in the United Kingdom, which allow minors under the age of 16 years to consent to treatment if they possess the requisite capacity, potentially overriding parental objections.¹¹

Conditions like malingering and factitious illness pose ethical and practical challenges to confidentiality.¹² Diagnosing factitious illness is extremely difficult because patients seek to dupe health care providers. Obtaining a comprehensive medical history, which is vital for identification, is often made “hard or even impossible” by privacy laws that protect patients who use multiple providers, hospitals, or aliases.¹³

When clinicians suspect that a patient is not being truthful, the approach to communication should be nonaccusatory, which mitigates anger and treatment refusal. Clinicians should focus on objective inconsistencies and request permission to gather health records to complete the diagnostic picture.¹³

Preemptive discussions about the limits of confidentiality are essential for patients with unstable relationships or affective instability (eg, those with borderline personality disorder).^1,14 Furthermore, discussions of informed consent should cover how a diagnosis might affect future endeavors (eg, assessments for military service or legal competence).

In an emergency, or when specific information suggests that there is an imminent danger to the patient or to others, relaxation of confidentiality is legally and ethically justifiable.^8,11 Table 2 provides recommendations on proactive confidentiality communications.^1,7,8,15,16

What Can Health Care Systems Do to Enhance Meaningful Documentation and Avoid Unforced Errors?

The understanding of complex concerns surrounding documentation varies among health care providers¹⁰; therefore, EHR data entry protocols should be standardized (eg, for testing of sexually transmitted diseases).⁷ Institutions should move away from overly detailed (especially psychiatric) documentation and emphasize concise, fact-based documentation within standardized formats, which are tailored to systems that offer easy patient access. Institutions should develop internal procedures to designate and segregate collateral information and other data that is deemed harmful. Moreover, institutions should have mandatory continuing education and knowledge-translation strategies to close the gaps in providers’ knowledge about medical documentation.¹⁰

Ultimately, navigating the tensions in documentation and disclosure requires ethical discourse on a day-to-day basis.¹⁷ Clinicians should be equipped with practical, values-based tools to manage complex situations.¹⁷ This approach can strengthen therapeutic alliances in an era of mandated transparency.

How Can Data Be Gathered and Recorded in Less-Than-Private Settings?

Clinicians are often involved in scenarios where confidentiality is expected.¹⁸ Unfortunately, care is often delivered in settings with shared rooms and open clinical areas; this lack of privacy makes discussions of sensitive information problematic. Thus, effort should be made to conduct interviews in a manner that maximizes the privacy of their patients (eg, moving to a more private area, using a sound machine to mask voices, speaking quietly, standing closer to the patient, closing the door). Even if a roommate is still in the room, it is easier to “tune out” a quietly conducted conversation. Interviews can also incorporate hypothetical events,¹⁸ since answers overheard by law enforcement personnel cannot be used against them. The risks and benefits of continuing the interview should be discussed when privacy cannot be guaranteed, so that clinicians and patients can agree on how to proceed. Extremely sensitive parts of the interview can often be delayed until a more private setting becomes available.

What Information Should Be Obtained, What Should Be Documented, and What Should Be Withheld From the EHR (and Why)?

Information obtained from the patient should include the chief concern (or complaint), the history of the present illness, the past medical and psychiatric history, social history, family history, medication list, and allergies.¹⁹ In addition, the mental status examination and findings from laboratory testing and the physical examination should be documented. When formulating cases, the 8P model (with presentation, predisposing factors, precipitating factors, patterns, perpetuating factors, protective/positive factors, prognosis, and plans) can organize the components of the history.¹⁹ The information provided should be relevant to the formulation of the diagnosis, the workup, the treatment, and the prognosis; extraneous information should be eliminated.

What Conditions Must Be Reported in the Medical Record?

The conditions that must be reported are driven by federal and state agencies; however, they vary from state to state. The pediatrician Dr C. Henry Kemp and colleagues in 1962 published “The Battered Child Syndrome” (in the Journal of the American Medical Association), which highlighted the physical abuse of children and the need for clinicians to detect and report such cases.²⁰ See Table 3 for a timeline of relevant laws and regulations around mandated reporting of diseases and abuse.^21,22

Table 4 outlines the conditions that require physician reporting (ie, what must be reported and to whom, per national and state standards). Typically, clinicians must document the required elements in the medical record before submitting a report; therefore, they should be familiar with state-specific requirements and reporting deadlines.

Which Information Is Sensitive, Private, or Protected Health Information?

Under privacy guidelines, a patient’s personal health and social information can be sensitive, private, or protected. When contemplating what to document in the EHR, clinicians should consider who may receive or have access to the information, what is necessary to document to provide effective clinical care, and whether the information may expose the patient to risks (eg, discrimination, stigma, or personal harm).

Protected health information (PHI), under the 1996 HIPAA, is individually identifiable health information²³ that relates to the individual’s past, present, or future physical or mental health, the provision of health care (eg, medical encounters, procedures, medications), or the payment for health care services or includes at least one of the identifiers that can be used (alone or in combination) to identify the person. See Table 5 for identifiers that can identify an individual along with health-related information considered as PHI in the EHR²³ and Table 6 for medical information with additional safeguards for patient protection, which generally requires written consent or patient authorization for disclosure.²³

Additional consideration is paid to sensitive information (eg, reproductive health, sexual orientation, gender identity, preferred pronouns, and immigration status), as it may convey politically and socially meaningful information that may be used to discriminate against the patient (eg, in employment, legal action, housing, or public services). Patients may be hesitant to disclose such sensitive information to clinicians for these reasons and may be deterred from seeking care. The information is protected as part of PHI; however, some states have imposed additional reporting bans for patient protection. Disclosure is limited to the treatment team, and it requires patient consent for other uses. When linked to the EHR, this information is also protected as PHI under HIPAA, and it can be shared for treatment, but patient authorization is required for additional disclosures.

At present, no case law directly addresses whether immigration status constitutes PHI.²⁴ However, this information cannot be released for purposes other than treatment, payment, or hospital operations without the patient’s consent and may not be released to any authority (including federal government officials). Exceptions allow the release of PHI absent the patient’s authorization and for public health activities or are applicable to specific situations as outlined above under reporting conditions. “Crime on premises” is an additional exception (ie, an entity may disclose to a law enforcement official PHI that the entity believes in good faith constitutes evidence of criminal conduct that occurred on the premises).²⁴ Table 7 features questions to assist clinicians in weighing the risks and benefits of inclusion of certain information in the medical record.²³

How Might Unconscious Bias Shape Documentation in the Medical Record?

Unconscious bias refers to the automatic and unintentional negative attitudes or stereotypes a health care provider may have about a patient, based on myriad characteristics (eg, race, ethnicity, religion, gender, socioeconomic status, medical or psychiatric conditions).²⁵ In one investigation, the prevalence of stigmatizing language used in hospital admission notes, across all medical conditions, appeared more frequently in the notes of non-Hispanic Black patients, while less experienced clinicians were more likely to use stigmatizing language.²⁶

Unfortunately, unconscious bias influences the judgment, behavior, and decision-making of health care providers about patients, and it affects documentation in the medical record, diagnoses made, treatment outcomes, quality of care, and trust in health care providers.^27,28 In one study of the transmission of bias through the medical record, investigators assessed trainee attitudes and decision-making based on the use of stigmatizing or neutral descriptions of a patient with sickle cell disease.²⁹ They demonstrated that stigmatizing language was associated with clinicians’ negative attitudes toward patients and with less aggressive pain management approaches, emphasizing the need to raise awareness on this phenomenon and to advocate for greater objectivity and fewer value judgments.²⁹

Unconscious bias that has been embedded within the EHR can also arise from sources outside of clinical care. For example, the EHR can be trained on, and analyzed using, biased datasets. Patient data that are incomplete or absent can introduce bias; thus, patient referrals and the admission process can reflect such bias.³⁰

When and How Should Disagreements Among Health Care Providers Be Documented in the Medical Record?

All health care providers should learn how to manage disagreements within and beyond the confines of the EHR, as inappropriate entries can jeopardize patient safety, continuity of clinical care, medicolegal integrity, and professional respect.^31,32 Hostile or defamatory charting regarding other clinicians and the care they provide can be libelous (eg, involving a written defamatory statement) and be applied in malpractice cases or employment disputes, further compounding the liability of health care providers and health care organizations.³³ Defamatory statements can also damage a clinician’s reputation.³³ Moreover, “chart warfare” (a colloquial term that refers to the practice in which clinicians document their disputes with one another in the EHR) often interferes with patient care and damages professional relationships.³⁴ Statements by health care providers about the care delivered by others can be subtle, occurring in written comments about one’s judgment.

When health care providers disagree, the disagreement should be identified. However, accusatory, derogatory, or discriminatory remarks about another clinician should not be incorporated into a patient’s medical record.^31,32 Conflicts should be addressed directly, such as through the appropriate chain of command. For instance, if clinicians differ in their thoughts about a patient’s care, it is reasonable to discuss it with their supervisor or contact the colleague in question directly.^31,32 Approaches that do not directly relate to patient care (eg, filing an incident report or making a referral to legal counsel) should not be included in the EHR.³¹ If a health care provider comes to a different diagnosis from that of a colleague and wishes to document the alternative diagnosis or recommended treatment, their opinion and the rationale for it should be stated factually and objectively.^30,33 The acronym “READ” serves as a useful reminder for specific steps to follow: “R” stands for respecting the patient in documentation; “E” stands for eliminating words that reflect bias; “A” stands for advocating for patients when disagreements arise (with consultants through discussion with supervisors); and “D” stands for documenting respectfully.³²

What Happened to Mr A?

Mr A underwent exploratory laparotomy after which he was transferred to the surgical service for postoperative care and observation. Dr D continued to meet with Mr A during his hospital stay. Mr A registered at the hospital using his own name and was assured that his privacy would be protected. Given that his immigration status was not deemed relevant to his medical care, Dr D and the other members of his treatment team did not include this information in his medical record. However, Dr D provided Mr A with information about local immigration resources and connected him with the surgical service’s social worker who gave provided additional resources for social support. In addition, the social worker located one of Mr A’s relatives who lived nearby; he was willing to have Mr A stay with him while he sought asylum in the United States.

CONCLUSION

Recently, the medical record has transitioned from being a siloed record for health care providers to a shared communication tool among health care providers and their patients. As a result, clinicians have realized that they need to be more transparent about the care they provide, and this has created tension between the obligation to document information and the ethical responsibility to maintain patient confidentiality. Since clinicians have differing levels of experience and comfort in managing complex concerns, standardized protocols for documentation are apt to become increasingly utilized. Documentation that is either too sparse or overly inclusive, and ripe with moral judgments, can interfere with clinical care and jeopardize the doctor-patient relationship. Precision-focused documentation and use of practical, values-based tools can strengthen the therapeutic alliance in an era of mandated transparency in medical care.

Real-world institutional variability in EHRs includes differences in clinical workflows and data structure across organizations. Some EHR systems are now using artificial intelligence tools to listen to and view doctor/patient exchanges and then produce an EHR entry that the clinician can edit. This evolving technology might create further complexity (eg, poor accuracy and contextual issues). Some practices use dictation to generate EHR entries; completing this task at the end of visits with the patient present is a valuable technique that allows correction of misstatements, builds trust, and conveys respect.

For behavioral health and other sensitive information in primary care, one potential approach is to record only information that other team members can use in follow-up contacts. The value of information is often embedded in the disclosure of it to a specific clinician and the related therapeutic alliance. Unless required, this information might be omitted from the EHR. For instance, documentation of a 20-minute interaction concerning uncertainty of sexual identity of a patient can be coded with a brief entry: “Extended 20-minute (time documentation as required for billing) discussion of behaviors, risks, and decision making.”

When disagreements arise among clinicians, they are wise to avoid using hostile or defamatory comments in the EHR, as such comments can be libelous (and damaging to one’s reputation) and be applied in malpractice cases or employment disputes, further compounding the liability of health care providers and health care organizations.

Article Information

Published Online: May 7, 2026. https://doi.org/10.4088/PCC.25f04146
© 2026 Physicians Postgraduate Press, Inc.
Submitted: November 24, 2025; accepted January 26, 2026.
To Cite: Rustad JK, Nadkarni A, Amkieh S, et al. Strategies for documenting information in the medical record: managing confidentiality, privacy, and staff disagreements. Prim Care Companion CNS Disord. 2026;28(3):25f04146.
Author Affiliations: Geisel School of Medicine at Dartmouth, Lebanon, New Hampshire (Rustad); Larner College of Medicine, University of Vermont, Burlington, Vermont (Rustad); Burlington Lakeside VA Community Based Outpatient Clinic, Burlington, Vermont (Rustad); White River Junction VA Medical Center, White River Junction, Vermont (Rustad); Department of Psychiatry, Harvard Medical School, Boston, Massachusetts (Nadkarni, Bains, Donovan, Levy-Carrick, Stern); Brigham Psychiatric Specialties, Brigham and Women’s Hospital, Boston, Massachusetts (Nadkarni); Department of Psychiatry, Mass General Brigham, Boston, Massachusetts (Nadkarni, Bains, Donovan, Levy-Carrick, Stern); Geisel School of Medicine at Dartmouth, Hanover, New Hampshire (Amkieh). Rustad, Nadkarni, Amkieh, Bains, Donovan, and Levy-Carrick are co-first authors; Stern is the senior author.
Corresponding Author: James K. Rustad, MD, Department of Psychiatry, Geisel School of Medicine at Dartmouth, Dartmouth-Hitchcock Medical Center, One Medical Center Dr, Lebanon, NH 03756 ([email protected]).
Financial Disclosure: Dr Rustad is employed by the United States Department of Veterans Affairs, but the opinions expressed in this presentation do not reflect those of the Department of Veterans Affairs. Dr Stern has received royalties from Elsevier for editing textbooks on psychiatry. Drs Nadkarni, Bains, and Donovan and Dr Levy- Carrick and Mr Amkieh have nothing to disclose.
Funding/Support: None.

Clinical Points

• Documentation in the electronic health record should remain objective and relevant, especially when cases are psychosocially complex.
• Providing too little documentation can interfere with establishing the correct diagnosis and a safe and effective treatment plan. Excessive documentation (while it can be a defense against malpractice claims) increases the risks of patient harm and conflicts.
• Preemptive discussions of the limits of confidentiality are essential, and the limits of confidentiality should be raised at the outset of treatment.
• The acronym “READ” reminds clinicians about strategies for appropriate documentation: “R” (respecting the patient in the documentation); “E” (eliminating words that reflect bias); “A” (advocating for patients when disagreements arise); and “D” (documenting respectfully).