Before 2003, psychologists were advised to make “reasonable efforts to maintain the integrity and security” by withholding “tests and other assessment techniques” from non-psychologists (American Psychological Association, 1992). In 1996, the enactment of HIPAA significantly changed the law by mandating patient access to their medical records.

    The ethics code, revised in part to comply with HIPAA, distinguished test data from test materials and required disclosure of test data (American Psychological Association, 2017; Dept of Health and Human Services, 2002; Health Insurance Portability and Accountability Act (HIPAA), 1996). 

     Thus, test materials are test manuals and questions; limiting public distribution protects test publishers and tests by ensuring test takers are naive to the questions (American Psychological Association, 2017, Standard 9.11). Test data include test-taker responses to test questions (e.g., T/F answers to objective personality tests); disclosure to test-takers supports patient autonomy, pursuant to state and federal patient access laws (American Psychological Association, 2017, Standard 9.04). 

     A dilemma arises when patient responses directly match the test questions (e.g., list learning and visual reproduction tasks). Stimuli can also be ascertained from the response (e.g., vocabulary tests). In such cases, disclosing patient responses risks public exposure of the test stimuli. Duplicative documents cannot be disclosed without revealing test materials, and withholding them violates patient access laws.    

    The 2003 ethics code (American Psychological Association, 2017) interpreted public policy (under HIPAA) as favoring patient access and attempted to resolve this dilemma by disclosing duplicative documents. As stated by the then-ethics code task force chair and the then-ethics chair, the current standards regarding test data disclosure were developed to be consistent with increased patient autonomy, as expressed by HIPAA (Behnke, 2003, 2004; Fisher, 2003, 2022, January/ February 2003).

     Others, concerned about test security, advocated for a return to the 1992 ethics code, prohibiting disclosure of duplicative documents (Axelrod et al., 2000, 2003; Bush et al., 2010; Chadda & Stein, 2005; Kaufmann, 2009). However, neither proposal resolved the problem. This ethical dilemma between the test publisher and others’ rights is mirrored legally, for example, pre-trial discovery of test data presents a conflict between the test publishers’ rights and justice. Patient access to test data creates a conflict between the rights of test publishers and patients. Nevertheless, test publishers continue to produce tests in which patient responses duplicate the test questions.
     Prior commentary consisted mainly of test security advocacy, beginning with the a priori position that test security should preempt any other rights and selectively citing only those state laws and cases supporting test security (Boone et al., 2022, 2024; S. Bush et al., 2010; S. S. Bush et al., 2020; Chafetz et al., 2015; Frederick et al., 2024; Glen et al., 2021; Greiffenstein & Kaufmann, 2012; Grote, 2005; IOPC, 2024; Kaufmann, 2005, 2008, 2009; McLeod et al., 2024; Montgomery et al., 1977; Morel, 2009; Rapp et al., 2008; Rapp & Ferber, 2003; Shapiro, 2021). The chief argument, however, was a slippery slope fallacy that any disclosure of test data would be sure to invalidate tests and therefore result in the ruin of publishers, referral sources, and harm society itself (Inter Organizational Practice Committee, 2024; McLeod et al., 2024). Patient and legal system rights were ignored or discounted.

     To address this deficiency in the literature, I surveyed 152 published cases where test data discovery was disputed (Borkosky, 2025b). Psychologists have questioned the discovery of test data that utilized 26 different types of ethical and legal arguments. Contrary to prior commentary, courts ordered discovery of test data almost seven times more frequently (~67%) than they directed disclosure to psychologists (~10%).
     I also surveyed 175 state laws regulating test data disclosure (Borkosky, 2025a).

Contrary to prior commentary, state laws generally support test data disclosure to

patients (Table 1, row 2). More states require test data disclosure to patients (32) than

those restricting disclosure (14). Also, state and federal patient access laws (all states)

require disclosure of all records to patients. Additionally, state laws that limit disclosure

will likely be overridden by federal patient access laws. For example, HIPAA does not

permit withholding any records from patients unless doing so would cause serious

bodily harm to someone. Even then, that withholding must be reviewed by a third party.

    This issue is at the forefront of many minds today, as the ethics code is being revised. Test security advocates are pursuing a systematic effort to rewrite the rules of professional psychology, reverting to the 1992 ethics code and prohibiting test data disclosure, by advocating for an official APA policy resolution and petitioning the ethics code task force (IOPC, 2024; McLeod et al., 2024).

     Not all psychologists believe that disclosure of test data is unlawful or unethical, though. For example, the American Academy of Forensic Psychology recently issued a position paper advising that it is ethical to disclose test data “subject to a judge’s protective order or other negotiated remedy that prevents public distribution of sensitive test materials” (Balancing test security and discovery rules in forensic psychological practice: Official position, 2024, p. 2). Similarly, Division 41 opposed the upcoming proposed resolution, because it is “incompatible with the protection of human rights, existing APA ethical principles, and with the best practices of those operating within forensic psychology” (Division 41’s response to the proposed APA Resolution on Protecting Psychological Test Security, Test Validity, and Public Safety, 2024, p. 15)

     Should the ethics code change, the legal regulation of test data disclosure to test takers will change considerably, as most states have adopted the ethics code into law. If the new ethics code is silent, patient access laws will likely predominate (only 16 states (31%) will expressly regulate disclosure, leaving patient access laws as the predominant law - two states requiring, three both requiring and restricting, and 11 states restricting disclosure). Discovery rules will remain unchanged, of course, as the court rules are not affected by psychologists’ ethics codes.

    Thus, if the new ethics code is silent or prohibits test data disclosure, then psychology ethics and licensing laws will contradict patient access laws (Table 1). This would place psychologists in an untenable situation by contravening both the legal system’s right to evidence and state and federal patient access rights.

     Those cases that go before a court are likely to be criticized. Psychologists who challenge disclosure are likely to lose credibility with oversight agencies. 

     Regardless of what happens, the issue is likely to be as contentious as it was during the 2003 ethics code revision. Additional information is on the task force’s web page (https://www.apa.org/ethics/task-force). If you have not yet commented, consider doing so here.

Note: Each row in column 1 describes the outcome if the new ethics code is consistent with the current code, becomes silent on the issue, or prohibits test data disclosure. Columns 2-4 describe state laws that require disclosure. Column 5 describes states with laws that both require and restrict disclosure. Columns 6-8 describe state laws that restrict disclosure. The totals are more than 52 because many state laws conflict.