Confidentiality and HIPAA for the LCSW Exam: What You Must Know

Confidentiality as a Foundation of Clinical Practice

Confidentiality is one of the most fundamental ethical obligations in clinical social work and one of the most heavily tested topics on the ASWB Clinical exam. Clients must trust that their personal information will be protected in order to engage honestly in the therapeutic process. The exam tests your knowledge of both the ethical standards governing confidentiality and the legal frameworks, particularly HIPAA, that regulate the handling of client information.

NASW Code of Ethics on Confidentiality

Section 1.07 of the NASW Code of Ethics addresses privacy and confidentiality extensively. Key provisions include:

• Social workers should respect clients' right to privacy and protect the confidentiality of information obtained during the professional relationship
• Confidentiality may be limited when disclosure is necessary to prevent serious, foreseeable, and imminent harm to a client or other identifiable person
• Social workers should inform clients about the limits of confidentiality at the outset of services
• Social workers should protect the confidentiality of information shared in the context of professional consultation
• Social workers should not disclose confidential information to third parties unless the client consents or disclosure is required by law

HIPAA Basics for Social Workers

What Is HIPAA?

The Health Insurance Portability and Accountability Act (HIPAA) establishes national standards for protecting the privacy of individually identifiable health information, known as protected health information (PHI). HIPAA applies to covered entities, which include healthcare providers who transmit health information electronically, health plans, and healthcare clearinghouses.

Protected Health Information

PHI includes any information that can identify a patient and relates to their health condition, healthcare services, or payment for healthcare. This includes names, dates of birth, addresses, phone numbers, Social Security numbers, medical record numbers, and treatment information. For the exam, understand that PHI in any form (written, oral, or electronic) is protected under HIPAA.

The Minimum Necessary Standard

HIPAA requires that when using or disclosing PHI, covered entities limit the information to the minimum necessary to accomplish the intended purpose. This means that when sharing client information for treatment, payment, or healthcare operations, you should share only what is needed, not the entire client record. On the exam, this principle often appears in questions about how much information to share in a consultation or referral.

Exceptions to Confidentiality

Mandatory Reporting

Social workers are mandated reporters in every state. You must report suspected child abuse, elder abuse, and dependent adult abuse to the appropriate authorities. The requirement to report is triggered by reasonable suspicion, not confirmed evidence. On the exam, remember that the duty to report overrides confidentiality, but you should still limit your disclosure to the information necessary for the report.

Duty to Warn and Protect

When a client poses an imminent danger to an identifiable third party, the social worker has a duty to take reasonable steps to protect the potential victim. This may include warning the intended victim, notifying law enforcement, or hospitalizing the client. The specific requirements vary by state, but the exam typically follows the Tarasoff ruling as the standard.

Court Orders and Subpoenas

A court order generally requires the social worker to disclose specified information. A subpoena, however, is not a court order. When receiving a subpoena, the social worker should consult with an attorney, attempt to obtain the client's consent, and seek a protective order if disclosure would be harmful. On the exam, distinguish between court orders (which must be obeyed) and subpoenas (which may be challenged).

Client Access to Records

Under HIPAA, clients generally have the right to access their own health records. Social workers may deny access in limited circumstances, such as when the information could endanger the client or another person. Process notes (also called psychotherapy notes) that are kept separate from the medical record may have different access rules under HIPAA.

Record Keeping and Storage

The exam tests your knowledge of proper record-keeping practices. Client records should be stored securely, whether in paper or electronic form. Access should be limited to authorized personnel. Records should be retained for the period required by state law (typically five to seven years after the last date of service, or longer for minors). Disposal of records must be done securely to prevent unauthorized access.

Confidentiality in Special Situations

Telehealth

When providing services via telehealth, additional confidentiality considerations apply. Use HIPAA-compliant platforms, ensure the client is in a private location, and inform clients about the potential risks to confidentiality in electronic communication.

Minor Clients

Confidentiality with minor clients involves balancing the minor's right to privacy with the parents' right to information about their child's treatment. State laws vary on what information parents can access and when a minor can consent to treatment independently. On the exam, correct answers typically involve sharing general information with parents while protecting the specifics of what the minor disclosed in therapy.