What facilitators need to know about client confidentiality and data privacy

Last reviewed: August 2026 · Psychedelic law changes quickly — verify current status before relying on this page.

For licensed psilocybin facilitators in Oregon who want to understand their confidentiality obligations, what they can and cannot disclose, how state privacy law applies to their practice, and where HIPAA fits — or doesn’t.

The short answer

Oregon’s psilocybin confidentiality framework is created by ORS 475A.450, not by HIPAA. HIPAA applies to covered entities — healthcare providers, health plans, and healthcare clearinghouses — and to their business associates. An OPS-licensed facilitator providing psilocybin services is not providing healthcare under Oregon law, and OPS facilitation is not a covered healthcare transaction under HIPAA. Facilitators operate under ORS 475A.450’s confidentiality protections, which are strong but structured differently from HIPAA. Understanding the difference matters because the obligations, exceptions, and enforcement mechanisms are not the same.

What ORS 475A.450 prohibits

ORS 475A.450 prohibits a facilitator from disclosing any information that may identify a client, or any communication made by a client during the course of psilocybin services. The prohibition is default — it applies without the client needing to invoke it. A facilitator who discusses a client’s session with another facilitator, mentions a client’s name in a professional context, or shares details of a client’s experience with anyone outside the service relationship has violated ORS 475A.450 unless a statutory exception applies.

The confidentiality obligation attaches to identifying information and to client communications. A facilitator who describes an anonymized case — with no identifying details — for professional education purposes is in a different position from one who describes the same case with enough detail to allow the client to be identified. The test is whether the information may identify the client, not whether the facilitator intended to identify them.

The statutory exceptions

ORS 475A.450 permits disclosure in three circumstances: in legal proceedings where disclosure is compelled by court order or legal process; to prevent imminent harm to the client or to others; and as otherwise required by law.

Each exception has limits. Compelled disclosure in legal proceedings does not mean a facilitator must produce records the moment they receive a subpoena — it means compelled disclosure through proper legal process, after the facilitator has had the opportunity to assert any applicable protections. A facilitator who receives a subpoena for client records should consult an attorney before producing anything.

The imminent harm exception permits disclosure to prevent serious and imminent harm to an identified person. This is a narrower standard than the general mandatory reporting obligations that apply to licensed therapists — facilitation is not a clinical relationship, and ORS 475A does not create a Tarasoff-style duty to warn. The exception applies when a facilitator has specific, credible information of imminent serious harm and disclosure is necessary to prevent it.

HB 2387 and OPS complaint confidentiality

HB 2387 (effective January 1, 2026) added a confidentiality layer over OPS complaint and investigation records. Information obtained by OHA as part of an OPS investigation — including complaint contents and information that might identify a complainant — is confidential and not subject to public records disclosure, except in limited circumstances. One exception allows OPS and the seven identified professional licensing boards to share complaint and investigation information when a dual-licensed facilitator is under investigation by both.

Complainants may request confidentiality in writing. That request protects their identity from public disclosure but does not prevent OPS from using the information in its investigation.

Why HIPAA does not apply to OPS facilitation

HIPAA’s Privacy Rule applies to covered entities — healthcare providers who conduct certain electronic transactions, health plans, and healthcare clearinghouses — and to their business associates. A psilocybin service center is not a covered healthcare entity under HIPAA. The informed consent document that every client signs before an administration session explicitly states that psilocybin services are not a medical or clinical treatment. Services provided under ORS 475A are wellness services, not healthcare transactions as defined under HIPAA.

This means facilitators do not have HIPAA obligations for their OPS facilitation work — they do not need to provide clients with a HIPAA Notice of Privacy Practices, they are not subject to HIPAA’s breach notification requirements, and their records are not subject to HIPAA’s access and amendment rights.

The exception is a dual-licensed facilitator who also provides healthcare services to the same client under a separate professional license. In that context, the clinical services they provide as a licensed professional may be subject to HIPAA if they otherwise meet the covered entity threshold, while their OPS facilitation work is not. Keeping those two service streams — and their records — cleanly separated is important for a dual-licensed professional managing both.

SB 303 and data collection

Senate Bill 303, effective January 1, 2025, requires service centers to collect and report aggregate demographic and session data to OPS quarterly. This includes information about clients’ age, income, race, gender identity, sexual orientation, county of residence, and reasons for seeking services. The data submitted to OPS is de-identified and aggregated — the service center collects individual-level data, then strips identifying information before submission.

Clients have the right to opt out of having their data included in the submission to OPS. A client who opts out must still have their data collected by the service center, but that data is not forwarded to OPS. Facilitators working at service centers are involved in explaining the opt-out process to clients during the preparation session and documenting the client’s choice.

Confidentiality and the facilitator-service center relationship

Because client records belong at the service center, the confidentiality obligations that attach to those records run to the service center as custodian. A facilitator who takes notes during a session, then transfers those notes to the service center, has transferred both the records and the primary custodial responsibility. The facilitator retains their own confidentiality obligations under ORS 475A.450 regardless — they cannot discuss clients with third parties based on what they remember from sessions even after the records have been transferred.

A facilitator who works across multiple service centers has confidentiality obligations to each client that are governed by ORS 475A.450 and by whatever additional confidentiality policies each service center has established. A facilitator should review the service center’s confidentiality policies before working there to ensure no service center policy requires or permits disclosures that the facilitator is prohibited from making under ORS 475A.450.

Responding to requests for client information

Clients, third parties, attorneys, insurers, and law enforcement may all request client information from a facilitator at various points. The default answer under ORS 475A.450 is no — the facilitator may not disclose without a statutory basis.

A client may authorize disclosure of their own records. Even then, the facilitator should document the client’s authorization in writing and confirm it is voluntary before producing anything. Third-party requests — from family members, attorneys, or employers — do not carry the client’s authorization and should be declined without client consent. Law enforcement requests short of compelled legal process should also be declined; the existence of the client relationship itself is protected information.

When in doubt, the correct response is to consult an attorney before disclosing. The consequence of wrongful disclosure — a violation of ORS 475A.450 — can include OPS discipline and potential civil liability. The consequence of declining to disclose pending legal advice is almost always manageable.

When public information may be enough

ORS 475A.450 is publicly available through the Oregon Legislative Assembly. The HB 2387 confidentiality provisions are in the enrolled bill text, also publicly available. OPS publishes client-facing information about confidentiality at oregon.gov/psilocybin. The Department of Health and Human Services publishes HIPAA covered entity guidance at hhs.gov/hipaa.

When you should speak with a lawyer

If you receive a subpoena, court order, or law enforcement request for client records, consult an attorney before producing anything. If you are a dual-licensed facilitator uncertain about how HIPAA applies to your clinical work versus your facilitation work, legal advice specific to your situation is worth getting before you establish your recordkeeping and disclosure practices. If a client or third party is pressuring you to disclose information you believe is protected, consult an attorney before responding.

You might also want to read

• Recordkeeping requirements for Oregon and Colorado facilitators
• Informed consent obligations for facilitators
• Can I facilitate psilocybin sessions if I am also a licensed therapist, nurse, or doctor?
• What a facilitator can and cannot do during a session
• Professional liability and insurance for psychedelic facilitators