Right to Confidentiality and Information

Mental illness has always carried a peculiar double burden: the illness itself, and the stigma that follows the moment it becomes known. The Mental Healthcare Act, 2017 answers that reality with two interlocking statutory rights — the right to confidentiality in Section 23 and the right to information in Section 22, reinforced by the media restriction in Section 24 and the access-to-records guarantee in Section 25. Together they convert what was once a matter of medical etiquette and the Hippocratic conscience into an enforceable legal entitlement, anchored after August 2017 in the fundamental right to privacy itself. This chapter unpacks each provision, the seven exceptions that qualify confidentiality, and the case law from Mr 'X' v. Hospital 'Z' to Justice K.S. Puttaswamy v. Union of India that gives these rights their constitutional weight.

Where these rights sit in the statutory scheme

The right to confidentiality and the right to information do not float free; they belong to Chapter V of the Mental Healthcare Act, 2017, titled "Rights of Persons with Mental Illness", which runs from Section 18 to Section 28. The chapter opens with the omnibus right to access mental healthcare in Section 18, moves through the right to community living (Section 19) and protection from cruel, inhuman and degrading treatment (Section 20), and then arrives at a cluster of rights that are essentially about information and its control — equality and non-discrimination (Section 21), the right to information (Section 22), the right to confidentiality (Section 23), the restriction on release of information to the media (Section 24) and the right to access one's own medical records (Section 25).

Reading these as a block is the key to the topic. Section 22 governs the flow of information to the patient; Section 23 governs the flow of information from the treating establishment to the world; Section 24 is a special, near-absolute rule for one particular recipient — the media; and Section 25 closes the loop by letting the patient see what has been written about them. The architecture mirrors the Act's larger philosophy, explained in our introduction to the Mental Healthcare Act, of shifting from a custodial, paternalist model under the repealed Mental Health Act, 1987 to a rights-based, autonomy-respecting framework consistent with the United Nations Convention on the Rights of Persons with Disabilities.

For aspirants, the examiner's favourite trap is to test whether a candidate can place the right correctly: confidentiality is Section 23, not Section 22; the media bar is Section 24; and access to records is Section 25. Memorise the sequence and the rest follows.

Section 23(1): the core right to confidentiality

Section 23(1) states the right in deceptively simple terms: "A person with mental illness shall have the right to confidentiality in respect of his mental health, mental healthcare, treatment and physical healthcare." Four objects of confidentiality are named, and the inclusion of physical healthcare is deliberate — a person admitted for a psychiatric condition does not surrender confidentiality over an unrelated cardiac or obstetric record merely because they are housed in a mental health establishment.

The subject of the right is a "person with mental illness", a term that takes its meaning from the definition machinery discussed in our note on definitions under the Act. Significantly, the right does not depend on the person currently possessing decision-making capacity. A patient who lacks capacity at a given moment, or who has been admitted as a supported admission, retains the confidentiality right in full; the Act never makes confidentiality contingent on competence. This is consistent with the capacity framework explored in capacity to make mental healthcare treatment decisions, where the Act treats loss of capacity as episodic and supported, not as a wholesale forfeiture of rights.

The duty-bearer is broad. Section 23(2) places the obligation on "all health professionals providing care or treatment to a person with mental illness" — not merely the psychiatrist in charge, but every health professional in the chain, from the medical officer to nursing and allied staff. The duty attaches to "all such information which has been obtained during care or treatment", a phrase wide enough to capture clinical notes, diagnostic findings, the fact of admission itself, and even the patient's presence in the establishment.

Section 23(2): the seven exceptions, decoded

Confidentiality under the Act is strong but not absolute. Section 23(2) sets out the closed list of situations in which a health professional may lawfully release otherwise confidential information. Reading the clauses together, they resolve into the following gateways: (a) release to the nominated representative to enable that representative to discharge their duties under the Act; (b) release to other mental health professionals or health professionals for the purpose of providing care or treatment to the person; (c) release where it is necessary to protect any other person from harm or violence; (d) release of only such information as is necessary to protect against the identified harm; (e) release of only such information as is necessary to prevent a threat to life; (f) release in compliance with an order of the concerned Board, the Central Authority, the High Court, the Supreme Court or any other statutory authority competent to require it; and (g) release in the interests of public safety and security.

Two design features deserve emphasis. First, the exceptions are cumulative and self-limiting: clauses (d) and (e) are not free-standing gateways but proportionality controls that bite on (c) — the professional may disclose only the minimum information necessary, never the entire file, even when a genuine risk of harm or threat to life exists. Second, the central role given to the nominated representative in clause (a) integrates confidentiality with the substituted-and-supported decision-making spine of the Act; the representative is not an outsider to whom disclosure is a breach but an insider to whom disclosure is a duty. The mechanics of who that representative is, and how they are appointed, are set out in our note on the nominated representative.

For examination purposes, candidates should be able to reproduce the list and, crucially, distinguish a permissible from an impermissible disclosure on facts. A psychiatrist who tells a colleague treating the same patient — permissible under (b). A psychiatrist who confirms admission to a curious neighbour — a clear breach falling within no exception.

Section 24: the near-absolute bar on media release

If Section 23 is a general rule with seven exceptions, Section 24 is a special rule that admits essentially one. Section 24(1) provides that "no photograph or any other information relating to a person with mental illness undergoing treatment at a mental health establishment shall be released to the media without the consent of the person with mental illness." The bar is striking for what it omits: none of the Section 23(2) gateways — harm to others, threat to life, public safety, even a Board order — is reproduced as an automatic carve-out. The single key that unlocks media release is the consent of the person with mental illness themselves.

This is a conscious legislative response to a long history of sensationalist reporting that paraded psychiatric patients before cameras, often in conditions of restraint. By naming "photograph" expressly and by routing the decision through the patient's own consent rather than the nominated representative's, the Act treats the patient's image and identity as a near-inviolable zone against the press.

Section 24(2) extends the protection into the digital age: "The right to confidentiality of person with mental illness shall also apply to all information stored in electronic or digital format in real or virtual space." This sub-section future-proofs the right against leaks of electronic health records, screenshots circulated on messaging platforms, or images posted to social media. In an era where a single forwarded message can undo a lifetime of privacy, Section 24(2) makes clear that the format of the information — paper, server, or cloud — never dilutes the duty.

Section 22: the right to information, the mirror image

Confidentiality controls outflow; Section 22 guarantees inflow. It provides that a person with mental illness, and his nominated representative, shall have the right to receive information about: the provision of the Act or any other law under which he has been admitted, and the criteria for that admission; his right to make an application to the concerned Board for a review of the admission; the nature of the person's mental illness and the proposed treatment plan, including the treatment proposed and the known side-effects of that treatment; and the right to receive all of this in a language and form that the recipient can understand.

That last requirement is not decorative. Information delivered in dense clinical English to a person who reads only a regional language, or to a person in acute distress, is no information at all. The Act therefore builds in a comprehensibility standard, echoing the philosophy that informed consent and informed decision-making — examined in our note on capacity to make mental healthcare treatment decisions — are meaningless unless the person genuinely understands what is being communicated.

Section 22 also contains a timing safeguard. Where complete information cannot be given to the person at the time of admission or the start of treatment — typically because the person is not, at that moment, in a fit state to receive and process it — the duty does not lapse. It is deferred: the medical officer or psychiatrist in charge must furnish the information to the person as soon as they are in a position to receive it, and must in the meantime give the information to the nominated representative immediately. The right is thus never extinguished by incapacity; it is merely time-shifted and routed through the representative in the interim.

Section 25: the right to access one's own medical records

Section 25 completes the information cluster by giving the patient a right to look at what has been written about them. Section 25(1) provides that all persons with mental illness shall have the right to access their basic medical records as may be prescribed. Section 25(2) carves out a narrow exception: the mental health professional in charge of the records may withhold specific information where its disclosure would result in (a) serious mental harm to the person with mental illness, or (b) a likelihood of harm to other persons.

Critically, the exception is not a black box. Section 25(3) provides that where any information is withheld, the professional must inform the person of their right to apply to the concerned Board for an order directing release. The withholding decision is therefore always reviewable; the clinician proposes, but the Board — a quasi-judicial body — disposes. This converts what could have been an unaccountable clinical veto into a contestable, supervised decision, and it dovetails with the Board's appellate role over confidentiality disclosures under Section 23(2)(f).

The contrast with the old regime is sharp. Under the repealed Mental Health Act, 1987 the patient was largely an object of the record, not a person entitled to read it. Section 25 reverses that posture, treating the patient as the presumptive owner of information about themselves, with non-disclosure as the supervised exception rather than the unquestioned norm.

The constitutional anchor: Puttaswamy and informational privacy

The Mental Healthcare Act received Presidential assent in April 2017; four months later the Supreme Court handed down Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1 (AIR 2017 SC 4161). A nine-judge Bench unanimously held that the right to privacy is a fundamental right intrinsic to the right to life and personal liberty under Article 21 and to the freedoms guaranteed by Part III of the Constitution, expressly overruling the contrary holdings in M.P. Sharma and Kharak Singh.

For our purposes the decisive strand is the Court's recognition of informational privacy — the individual's interest in controlling the dissemination of personal information, including health information. The judgments treated medical and health data as a core zone of privacy, precisely because its disclosure can expose a person to stigma, discrimination and loss of dignity. Read with Puttaswamy, Section 23 of the Mental Healthcare Act is no longer merely a statutory courtesy; it is the legislative concretisation of a constitutional guarantee. Any state action that compels disclosure of mental health information must now satisfy the Puttaswamy proportionality test — legality, a legitimate aim, and proportionality between means and end — which is exactly the structure mirrored in the "only such information as is necessary" language of Section 23(2)(d) and (e).

This is the analytical bridge an examiner most rewards: the ability to show that the Act's confidentiality exceptions are not arbitrary statutory choices but a textbook application of proportionality to the informational-privacy right recognised in Puttaswamy.

The doctor's dilemma: Mr 'X' v. Hospital 'Z'

The tension at the heart of Section 23(2)(c) — confidentiality versus the duty to protect a third party — was litigated long before 2017 in Mr 'X' v. Hospital 'Z', (1998) 8 SCC 296. The appellant, a doctor, was found to be HIV-positive when he donated blood at the respondent hospital. The hospital disclosed his status, and his impending marriage was called off, leading to social ostracism. He sued for breach of medical confidentiality.

The Supreme Court accepted that the Hippocratic tradition and the Medical Council's code of ethics ordinarily bind a doctor to confidentiality, but held that this duty is not absolute. Where disclosure is necessary to protect an identified person from a real and immediate risk to health or life — here, the prospective bride from a communicable, life-threatening infection — the public-interest exception applies and disclosure is justified. The Court located the doctor's duty to warn within the broader "public interest" carve-out to the confidentiality rule.

Some of the Court's wider observations in 1998 — particularly remarks suspending the appellant's right to marry — proved controversial, and on a clarificatory application the Court in Mr 'X' v. Hospital 'Z', (2003) 1 SCC 500 held that those observations were unnecessary to the decision and ought not to be treated as binding, while leaving the core ruling on permissible disclosure intact. For the Mental Healthcare Act, the case is the doctrinal ancestor of Section 23(2)(c)-(e): it establishes that protecting a third party from harm can justify breach of confidentiality, but only to the extent strictly necessary — the very proportionality the Act later codified.

Applying the exceptions: a working method

Problem questions on this topic almost always present a disclosure and ask whether it was lawful. A reliable method runs in four steps. First, confirm that the information is confidential under Section 23(1) — does it relate to the person's mental health, mental healthcare, treatment or physical healthcare? Second, identify the recipient: a nominated representative (clause a), a treating professional (clause b), a person at risk of harm (clause c), a court or Board (clause f), or the media (which throws the analysis into Section 24, not Section 23). Third, test necessity and proportionality under clauses (d) and (e): was only the minimum information released, or was the whole file dumped? Fourth, check for any overriding order under clause (f) or a genuine public-safety justification under clause (g).

Worked example: a psychiatrist learns from a patient, during therapy, of a credible and specific plan to kill a named individual. Disclosure to warn that individual or the police is permissible under clause (c), but clause (d) restricts the psychiatrist to releasing only what is necessary to avert that harm — the threat and its target — not the patient's entire diagnostic history. Contrast: the same psychiatrist sells the patient's file to a journalist. No exception applies; Section 24's media bar is breached; and the patient's informational-privacy right under Puttaswamy is violated.

This structured approach — confidential? recipient? proportionate? authorised? — lets a candidate reason transparently rather than guess, and it maps directly onto how a Board or court would itself analyse a complaint.

Confidentiality, advance directives and the nominated representative

The information rights do not operate in isolation from the Act's autonomy machinery. A person may, while possessing capacity, record an advance directive stating how they wish to be treated — and, by extension, indicating their wishes about who may receive information about their condition. The advance directive and the appointment of a nominated representative are the two principal tools by which a person projects their autonomous choices forward into a future period of incapacity.

Because Section 23(2)(a) makes the nominated representative the lawful recipient of confidential information needed to discharge their statutory duties, the choice of representative is, in practice, also a confidentiality decision. A person who fears that a particular relative will misuse sensitive information can appoint a different, trusted representative, thereby controlling the channel through which their mental health data flows even when they cannot speak for themselves. The interaction between the directive, the representative and the confidentiality exceptions is a favourite area for analytical questions precisely because it shows the Act functioning as an integrated whole rather than a list of disconnected rights.

Where a dispute arises — for instance, whether a particular disclosure to a representative was within the duties the Act assigns them — the matter is resolved by the Mental Health Review Board, the same body that supervises withholding of records under Section 25(3) and that may order disclosure under Section 23(2)(f).

Remedies and enforcement for a breach

A statutory right is only as good as its remedy. A person whose confidentiality has been breached, or who has been denied information due under Section 22 or access to records under Section 25, has several avenues. The primary forum is the Mental Health Review Board constituted under the Act, which can entertain complaints, order release or withholding of information, and direct compliance. Above the Board sits the appellate structure leading to the High Court.

Beyond the Act's own machinery, a breach of medical confidentiality may sound in the general law: a civil action for damages on the lines pursued in Mr 'X' v. Hospital 'Z', professional disciplinary proceedings before the relevant medical council for breach of the code of ethics, and — where state action is involved — a writ petition for violation of the fundamental right to privacy recognised in Justice K.S. Puttaswamy v. Union of India. The General Provisions of the Act also create offences and penalties for contraventions by mental health establishments, giving the rights a deterrent edge.

The practical upshot is that confidentiality under the Mental Healthcare Act is enforced on three planes at once — statutory (the Board), professional (the medical council) and constitutional (Article 21 privacy) — and a well-prepared candidate should be able to name all three when asked about remedies.

How the 2017 Act improved on the 1987 regime

The repealed Mental Health Act, 1987 contained no comparable, freestanding right to confidentiality or to information framed in the language of patient autonomy. Confidentiality, to the extent it existed, rested on professional ethics and the general law rather than on an enforceable statutory entitlement, and the patient's access to their own records was not guaranteed at all. The 1987 Act's centre of gravity was institutional and custodial; the patient was largely a subject of administration.

The 2017 Act reframes the same subject-matter around the individual. It names the right (Section 23), specifies the duty-bearers and the exhaustive exceptions, singles out the media for special treatment (Section 24), guarantees comprehensible information (Section 22) and grants supervised access to records (Section 25). This is the practical face of the larger paradigm shift discussed in our introduction to the Mental Healthcare Act — from a regime that managed patients to one that recognises rights-holders. The confidentiality and information provisions are perhaps the clearest doctrinal illustration of that shift, because they take what used to be discretionary professional decency and make it a matter of legal obligation owed to a person whose autonomy and dignity the Act is bound to respect.