Privacy is a right you hold. Confidentiality is a duty someone else owes you. That single line resolves most of the confusion between confidentiality vs. privacy: privacy lets you decide who sees your personal information, enters your space, or learns about your choices, while confidentiality kicks in only after you’ve shared something sensitive with a specific person or organization, creating their obligation to keep it protected. Both shield personal information, but they come from different directions and carry different legal weight.
Privacy as a Right You Hold
Privacy is about control. It’s your ability to keep parts of your life out of public view and to decide who gets access to your personal information. It covers a wide territory: your body, your home, your communications, your data, and your personal decisions. It exists whether or not you’ve ever told anyone what’s inside it.
The U.S. Constitution doesn’t use the word “privacy,” but the Supreme Court has recognized a constitutional right to privacy rooted in several amendments. In Griswold v. Connecticut (1965), the Court held that a right to privacy could be inferred from the “penumbras” of the First, Third, Fourth, Fifth, and Ninth Amendments, which together create zones of protected personal autonomy.1Justia Law. Griswold v. Connecticut, 381 U.S. 479 (1965) The Fourth Amendment plays a particularly direct role by protecting people from unreasonable government searches and seizures, establishing what courts call a “reasonable expectation of privacy.”
Federal statutes build on that foundation for specific categories of information. The Privacy Act of 1974 regulates how federal agencies collect, store, and share personal information about individuals, and it gives people the right to access and correct their own records.2U.S. Department of Justice. Privacy Act of 1974 The Health Insurance Portability and Accountability Act (HIPAA) gives you the right to decide whether your health information can be used for purposes like marketing.3HHS.gov. Your Rights Under HIPAA The Children’s Online Privacy Protection Act (COPPA) requires websites and apps to get a parent’s verifiable consent before collecting personal information from children under 13.4eCFR. Part 312 Children’s Online Privacy Protection Rule Each of these laws treats privacy as something the individual owns and others must respect.
Confidentiality as a Duty Someone Owes You
Confidentiality is narrower. It arises when you share sensitive information within a particular relationship, and the person receiving it takes on an obligation not to disclose it. The duty can come from a professional code of ethics, a contract, or a statute, but it always flows from a relationship, not from an inherent right.
Healthcare is the most familiar example. Physicians have an ethical obligation to preserve the confidentiality of information gathered during patient care, and patients are entitled to decide whether and to whom their personal health information is disclosed.5AMA-Code. Confidentiality – Opinion 3.2.1 HIPAA reinforces this by prohibiting covered entities from using or sharing your health information without written authorization for most purposes, including giving it to your employer or using it for advertising.3HHS.gov. Your Rights Under HIPAA
Attorney-client privilege works similarly. Communications between a lawyer and client about legal advice are protected, covering conversations, emails, texts, and written correspondence. The privilege exists to encourage honest communication; you can’t get good legal advice if you’re afraid your lawyer will repeat what you say. It can also be lost. Federal Rule of Evidence 502 addresses how voluntary disclosure to a third party can waive the privilege, and courts have long recognized a “crime-fraud exception” that lifts protection when a client uses an attorney’s services to commit or plan a crime.6Legal Information Institute (LII) / Cornell Law School. Federal Rules of Evidence Rule 502 – Attorney-Client Privilege and Work Product
Non-disclosure agreements are the contractual side. When a business shares trade secrets, financial details, or proprietary processes, an NDA creates a binding obligation to keep that information secret. Unlike professional duties that arise automatically from the relationship, an NDA is negotiated and signed, making the scope of the duty explicit.
Other sectors carry their own confidentiality rules. Banks and credit unions must protect nonpublic personal information under the Gramm-Leach-Bliley Act, which prohibits them from sharing your personally identifiable financial information with unaffiliated third parties unless they’ve given you a privacy notice and an opportunity to opt out.7NCUA. Privacy of Consumer Financial Information (Regulation P) Schools protect student records under the Family Educational Rights and Privacy Act (FERPA), which generally bars release of education records without the student’s or parent’s consent, though FERPA does not give individuals a private right to sue; enforcement runs through the Department of Education.8Protecting Student Privacy. Family Educational Rights and Privacy Act (FERPA)
Where the Two Overlap and Where They Diverge
The two concepts overlap most visibly when you share private information with a professional. Your medical history is private; it belongs to you, and you decide who learns about it. The moment you share it with a doctor, confidentiality attaches. Your doctor now has an independent duty to protect that information. The privacy right and the confidentiality duty reinforce each other, which is why people often treat the terms as interchangeable.
They diverge in three important ways.
- Relationship. Privacy can exist without any relationship. You have privacy in your home whether or not you’ve told anyone what’s inside it. Confidentiality requires a relationship and a transfer of information.
- Who carries the burden. You control your privacy directly by choosing what to share and with whom. Confidentiality, once established, puts the burden on someone else. If a hospital employee reads your chart without authorization, that’s a confidentiality breach by the hospital. If a stranger peers through your window, that’s a privacy violation, and no confidential relationship is needed.
- Source of protection. Privacy rights typically come from constitutional principles, broad statutes, and societal expectations about personal autonomy. Confidentiality obligations come from specific relationships, contracts, professional ethics codes, and targeted regulations.
A useful shorthand: privacy is the lock on your door; confidentiality is the promise your guest makes not to repeat what they heard inside.
When Confidentiality Can Legally Be Broken
Confidentiality is not absolute, and this is worth knowing before you rely on it. Several situations legally require or permit professionals to disclose information they’d otherwise be obligated to protect.
The most significant exception involves threats of serious harm. Under HIPAA, a healthcare provider who believes a patient presents a serious and imminent threat to themselves or others may disclose patient information to law enforcement, family members, or anyone reasonably able to prevent or lessen the threat.9HHS.gov. HIPAA Privacy Rule and Sharing Information Related to Mental Health Many states impose an affirmative duty to warn potential victims, meaning a therapist who fails to disclose could face liability.
Child abuse reporting is another area where confidentiality gives way. HIPAA explicitly allows healthcare providers to report child abuse or neglect to any law enforcement official authorized to receive such reports, without the patient’s agreement.10HHS.gov. When Does the Privacy Rule Allow Covered Entities to Disclose Protected Health Information to Law Enforcement Officials State mandatory reporting laws typically extend this obligation to teachers, social workers, and other professionals who work with children.
Court orders and subpoenas can also override confidentiality. Under Federal Rule of Civil Procedure 45, courts must quash a subpoena that demands privileged or protected material if no exception or waiver applies, but where an exception does apply, the privilege gives way.11Legal Information Institute (LII) / Cornell Law School. Federal Rules of Civil Procedure Rule 45 – Subpoena Even trade secrets and confidential business information can be compelled if the party requesting them demonstrates a substantial need that can’t be met any other way.
What Happens When Either Is Violated
Consequences depend on who did the violating and which law applies.
HIPAA violations carry tiered civil penalties that scale with the violator’s culpability. For 2026, the minimum penalty per violation starts at $145 for unknowing violations and climbs to $73,011 for willful neglect that goes uncorrected. The maximum calendar-year penalty for all violations of a single HIPAA provision can reach $2,190,294. Covered entities that discover a breach of unsecured health information must notify affected individuals within 60 calendar days.12eCFR. 45 CFR 164.404 – Notification to Individuals
The Privacy Act of 1974 takes a different approach. A federal employee who willfully discloses individually identifiable information in violation of the Act can be charged with a misdemeanor and fined up to $5,000.13U.S. Department of Justice. Overview of the Privacy Act of 1974 – Criminal Penalties These provisions are purely criminal; they don’t create a private right for individuals to sue, meaning enforcement depends on government action.
All 50 states and the District of Columbia now have data breach notification laws requiring organizations to alert affected individuals when their personal data is compromised. About 20 states set specific numeric deadlines, typically between 30 and 60 days after discovery. The remainder require notification “without unreasonable delay.” Individuals in some states can also pursue statutory damages under state consumer protection laws, with typical ranges running from $1,000 to $5,000 per violation depending on the jurisdiction.
For professionals, breaches of confidentiality carry consequences beyond fines. A doctor who improperly discloses patient information may face discipline from a state medical board. A lawyer who violates attorney-client privilege risks disbarment. Those professional stakes often matter more than monetary penalties, because they threaten the person’s ability to work in the field at all.