Sharing Confidential or Privileged Information in Indiana

Sharing confidential or privileged information in Indiana can expose you to civil damages, infractions, misdemeanor charges, professional discipline, and federal penalties, and the specific consequence depends on what kind of information was shared and the circumstances. Indiana law also requires disclosure in some situations, such as suspected child or elder abuse, and permits it in others, such as a mental health provider’s duty to warn an identifiable victim. The rules below walk through what is protected, when you must or may disclose anyway, and what happens if you get it wrong.

What Counts as Confidential or Privileged

Indiana’s protections come from several different statutes and rules, and the source matters because each one has its own remedies.

Trade Secrets

Indiana’s Uniform Trade Secrets Act at Indiana Code 24-2-3 protects business information that derives value from being kept secret, including formulas, processes, and customer lists, provided the owner takes reasonable steps to keep it confidential.¹

Medical and Mental Health Records

Under Title 16, Article 39, providers own the physical records but the information belongs to both provider and patient. Providers may use records internally for billing, collections, quality assurance, and litigation defense without written patient permission; releasing records to outside parties generally requires patient consent.²

Mental health records get an extra layer. Indiana Code 16-39-2-3 makes them confidential and permits disclosure only with the patient’s consent or through specific statutory channels covering court orders, certain emergencies, and authorized third-party releases.³ Providers must keep mental health records for at least seven years.⁴ Federal HIPAA sits on top of these rules as a national floor; where Indiana law is stricter, Indiana controls.

Testimonial Privileges

Indiana Code 34-46-3-1 identifies four relationships in which one party cannot be compelled to testify about confidential communications:⁵

Attorney and client, covering confidential communications and legal advice during the professional relationship.
Physician and patient, covering matters communicated during treatment and the medical advice given.
Clergy and penitent, covering confessions made under church discipline and confidential communications made to clergy acting as spiritual advisors.
Spouses, covering communications made to each other during the marriage.

Each privilege belongs to the person who made the communication, and voluntarily disclosing a significant part of the information waives it. The statute opens with “except as otherwise provided by statute,” so other Indiana laws (mandatory abuse reporting is the main one) can override these protections.

Attorney Confidentiality Outside Court

The testimonial privilege only blocks compelled testimony. Indiana Rules of Professional Conduct Rule 1.6 goes further, prohibiting attorneys from revealing any information related to representing a client unless the client gives informed consent or a recognized exception applies.⁶ The rule governs what a lawyer can say in any setting, from casual conversation to public statements.

Rule 1.6(b) permits disclosure when reasonably necessary to prevent death or substantial bodily harm; to stop a client from committing a crime or fraud that would seriously injure another person’s finances when the client has used the lawyer’s services to further it; to get advice on the lawyer’s own ethical obligations; to defend against claims by the client; or to comply with a court order or other law. Even then, the lawyer may reveal only what is reasonably necessary.⁶

Student Education Records

The federal Family Educational Rights and Privacy Act restricts how schools receiving federal funds handle student records. Personally identifiable information cannot be released without written consent from the parent or eligible student, subject to exceptions for school officials with a legitimate educational interest, officials at transfer schools, financial aid processing, and authorized audits of federally funded programs.

When Disclosure Is Required or Permitted

Child Abuse Reporting

Indiana law requires anyone who has reason to believe a child is being abused or neglected to report it, and this duty overrides professional confidentiality for physicians, therapists, clergy, and every other profession.⁷ Knowingly failing to report is a Class B misdemeanor, punishable by up to 180 days in jail and a fine of up to $1,000.⁸

Endangered Adult Reporting

Under Indiana Code 35-46-1-13, a person who believes or has reason to believe an endangered adult is a victim of battery, neglect, or exploitation must report to the Division of Aging, adult protective services, or law enforcement. Knowingly failing to report is a Class B misdemeanor.⁹

Mental Health Duty to Warn

Indiana Code 34-30-16 gives mental health providers a duty to warn only when a patient communicates an actual threat of violence against a reasonably identifiable victim, or when the patient’s conduct indicates imminent danger of serious harm to others. The provider can satisfy the duty by attempting to notify the victim, contacting law enforcement, seeking civil commitment, or taking other reasonable steps to prevent harm.¹⁰ A provider who discloses to comply with this duty is immune from civil and criminal liability under the patient privacy statutes. Outside those narrow circumstances, confidentiality remains fully in force.

Crime-Fraud and Court Orders

Attorney-client privilege does not shield communications made to further a crime or fraud. Courts can also compel disclosure of confidential records through discovery. Indiana Trial Procedure Rule 34 allows document requests between parties, and Rule 45 authorizes subpoenas to non-parties. A court can quash or limit a subpoena that is unreasonable or oppressive, which is the mechanism for balancing privacy against the need for evidence.¹¹

Penalties for Unauthorized Disclosure

Civil Damages for Trade Secret Misappropriation

A business whose trade secret is misappropriated can seek a court order stopping the unauthorized use and recover actual damages plus any unjust enrichment the violator gained. Willful and malicious misappropriation opens the door to exemplary damages up to twice the actual loss.¹² Where no actual loss or enrichment is proven, a court may order a reasonable royalty.

Health Record Violations

Recklessly violating the health record confidentiality provisions under Indiana Code 16-39-5-3 is a Class C infraction, and each day the violation continues counts as a separate offense.² A Class C infraction is a civil penalty rather than a criminal conviction, but the daily accrual can add up quickly.

Federal HIPAA Penalties

Healthcare providers and their business associates who violate HIPAA face federal penalties that scale with culpability. As of January 2026, the minimum penalty per violation ranges from $145 for unknowing violations up to $73,011 for violations due to willful neglect that are not corrected within 30 days. The calendar-year cap for all violations of a single HIPAA provision is $2,190,294. Under a separate HHS enforcement discretion policy, lower annual limits apply to most categories, topping out at $1,500,000 for uncorrected willful neglect.

Computer Trespass

Indiana Code 35-43-2-3 criminalizes knowingly accessing a computer system or network without the owner’s consent. Computer trespass is a Class A misdemeanor, punishable by up to one year in jail and a fine of up to $5,000.¹³¹⁴ The statute targets the unauthorized access itself, but obtaining data that way often begins a chain of further liability.

Professional Discipline

Statutory penalties are only part of the exposure. Attorneys who violate Rule 1.6 face disciplinary proceedings that can result in reprimand, suspension, or disbarment. Healthcare providers who breach patient confidentiality may face parallel action from their licensing boards. For many professionals, the career consequences outweigh any fine.

Data Breach Notification Duty

Indiana Code 24-4.9 requires any person or business maintaining a database with personal information to notify affected Indiana residents after a breach. Notification is triggered when unencrypted personal information has been or may have been acquired by an unauthorized person and the breach could result in identity theft or fraud.¹⁵

Notice must go out without unreasonable delay and no later than 45 days after discovery. A delay is reasonable only if needed to restore system integrity, determine the breach’s scope, or comply with a law enforcement request. When the breach affects more than 1,000 consumers, the business must also notify consumer reporting agencies and the Indiana Attorney General.¹⁵

Workplace Confidentiality Limits

Employers commonly require confidentiality agreements, but federal labor law limits how far they can reach. Under the National Labor Relations Act, employees have the right to discuss wages, benefits, and working conditions with coworkers and third parties. A confidentiality policy that could reasonably discourage those conversations is presumed unlawful under current National Labor Relations Board standards, even in non-union workplaces, and the employer must show the policy is narrowly tailored to a strong business need.

Medical information collected through the Americans with Disabilities Act accommodation process must be stored separately from general personnel files and made accessible only to people with a need to know. Mixing medical documentation into a regular personnel file can violate federal disability law regardless of whether the information ever leaves the file.

Practical Safeguards

If you handle sensitive information in Indiana, encrypt communications, restrict access on a need-to-know basis, and put your rules in writing. Law firms need reasonable measures under Rule 1.6 to prevent unauthorized access to client information, which now means addressing cybersecurity.⁶ Healthcare providers need protocols that meet both Indiana’s health record statutes and HIPAA’s safeguard requirements. Businesses holding consumer data should shred paper records and securely wipe electronic storage when material is no longer needed. Most breaches trace back to human error rather than sophisticated attacks, so employee training on what is protected and what a violation costs is usually the highest-value step.

1
Justia. Indiana Code 24-2-3 – Trade Secrets
2
Indiana General Assembly. Indiana Code 16-39-5-3 – Provider’s Use of Records; Confidentiality; Violations
3
Indiana General Assembly. Indiana Code 16-39-2-3 – Confidentiality
4
Indiana General Assembly. Indiana Code 16-39-2-2 – Maintenance of Records by Provider; Contents; Dominion; Time Limits
5
Indiana General Assembly. Indiana Code 34-46-3-1 – Persons Not Required to Testify
6
Indiana Judicial Branch. Indiana Rules of Professional Conduct Rule 1.6 – Confidentiality of Information
7
Indiana General Assembly. Indiana Code 31-33-5-1 – Duty to Make Report
8
Indiana General Assembly. Indiana Code 31-33-22-1 – Failure to Make Report
9
Indiana General Assembly. Indiana Code 35-46-1-13 – Battery, Neglect, or Exploitation of Endangered Adult; Failure to Report
10
Indiana Office of Court Services. Indiana Code Sections Related to Confidentiality
11
Indiana Judicial Branch. Indiana Rules of Trial Procedure Rule 45 – Subpoena
12
Indiana General Assembly. Indiana Code 24-2-3-4 – Damages for Misappropriation and Unjust Enrichment; Royalty; Exemplary Damages
13
Indiana General Assembly. Indiana Code 35-43-2-3 – Computer Trespass; Computer Hoarding Programs
14
Indiana General Assembly. Indiana Code 35-50-3-2 – Class A Misdemeanor
15
Indiana General Assembly. Indiana Code 24-4.9-3-1 – Disclosure of Breach