16.2 FLSA, HIPAA, FERPA, and NCMW

16.2 FLSA, HIPAA, FERPA, and NCMW

Quick Answer: FLSA conceptually separates employees from independent contractors — do not self-diagnose your legal status. HIPAA attaches when you are a covered entity or business associate handling protected health information; a cash-pay gym trainer still owes confidentiality even when HIPAA does not attach. FERPA protects student education records in funded schools. NCMW frames mental wellbeing as a referral, not a treatment plan.

Hygiene, standard of care, and facility hazards cover the room. The remaining Knowledge 1 sources cover the paperwork and the people: how you are employed, who is allowed to see a client's health information, what changes when the client is a minor in a school, and where a mental-health conversation stops being yours.

FLSA: Employee Versus Contractor, Conceptually

The Fair Labor Standards Act is federal wage-and-hour law. Employees who are not exempt generally must receive at least the applicable minimum wage and overtime (typically one-and-one-half times the regular rate after 40 hours in a workweek, unless a narrower exception applies). Independent contractors are not covered by those FLSA wage-and-hour rules in the same way. Classification is a legal and factual question. The U.S. Department of Labor looks at the economic reality of the relationship — how much control the business has over the work, whether the worker can make a profit or take a loss, investment in equipment, permanence, skill, and how integral the work is to the business. A signed “contractor” form does not settle it if the club sets your rate, writes your floor schedule, forbids outside clients, and treats you like staff.

This paragraph is not legal advice and is not a classification opinion. Exam items test whether you recognize the issue: a trainer who looks like an employee may trigger wage-and-hour duties, including overtime. A trainer who truly runs an independent practice may not. You do not diagnose FLSA status on the gym floor. You take the question to the facility, an employment attorney, or a qualified accountant. Misclassification is a business-risk problem, not a programming cue.

HIPAA: Only When You Are in the PHI Pipeline

HIPAA’s Privacy and Security Rules apply to covered entities — health plans, health-care clearinghouses, and health-care providers who transmit health information electronically in connection with standard transactions such as claims — and to their business associates. Protected health information (PHI) is individually identifiable health information held in that system.

A cash-pay trainer in a commercial gym who collects a PAR-Q+ and a health-history form for program design is often not a HIPAA covered entity. A trainer employed by a hospital wellness clinic, a physical-therapy practice, a cardiac-rehab department, or a physician group, or a trainer who is a business associate of one of those entities, can be inside HIPAA. Electronic clinic billing, shared electronic health records, and clinic-issued laptops are the giveaways.

Exam traps at both extremes fail:

• “HIPAA never applies to personal trainers” — false when you are in a covered clinic.
• “Every trainer is a covered entity because we ask about medications” — false for a typical independent gym practice.

Even when HIPAA does not attach, professional confidentiality still does. You do not post the client’s A1C, discuss their depression in the smoothie line, or forward a form video to a group chat. Chapter 17 will unpack storage, incident reports, and consent documents. Here the rule is: know whether HIPAA is in the room, and behave as if the information is private either way.

FERPA: Minors and Students in a School

The Family Educational Rights and Privacy Act protects education records of students in schools and colleges that receive U.S. Department of Education funds. If you train minors or student-athletes through a school — after-school strength, a college recreation contract, a PE pull-out — notes that live in the school file, injury reports the athletic trainer shares with you, and identifying student data are FERPA-flavored. Do not text a student’s medical restrictions to an unauthorized parent, booster, or college recruiter. Parents generally hold FERPA rights until the student turns 18 or attends a postsecondary institution; after that, the student holds them.

A private living-room session with a 15-year-old whose parent hired you is not automatically FERPA just because the client is a minor. It is still a consent, confidentiality, and guardian-communication problem. FERPA is the school-records statute. Do not use it as a synonym for “kids.”

NCMW: Mental Wellbeing Is a Referral, Not a Treatment Plan

The National Council for Mental Wellbeing is named in the outline because trainers meet distress long before they meet a barbell. NCMW administers Mental Health First Aid, an early-intervention training that teaches you to recognize a mental-health or substance-use challenge, listen, and encourage professional help. It is first aid, not psychotherapy and not a diagnosis.

Your scope move:

1. Notice the flag (hopeless talk, panic on the floor, restricting that looks like an eating-disorder pattern, intoxication, talk of self-harm).
2. Stay human. Do not interrogate for a DSM label.
3. Refer to a licensed mental-health professional. Offer NCMW/Mental Health First Aid resources and the 988 Suicide & Crisis Lifeline as public doors, not as your treatment plan.
4. If there is imminent risk of harm, activate emergency services. That is crisis management (section 16.3), not a coaching conversation.

You do not write a “depression program,” adjust a psychiatric medication, or promise to be the client’s only support person. NCMW exists on the outline so you have a named referral frame instead of improvising clinical care.

Same Sources, Five Rooms

Task 1 is setting-specific. HIPAA is more likely in a clinic than in a park. FERPA is a school problem. OSHA is a worksite problem. CDC hygiene and ACSM standard of care travel with you. NCMW referral travels with you. FLSA follows the employment relationship, not the squat rack.

Worked clinic. You are employed by a hospital-based wellness center. Client files live in the health system’s electronic record and billing runs electronically. HIPAA is in the room. You do not screenshot the problem list onto a personal phone.

Worked school. You contract with a public high school. The athletic trainer emails you a student’s clearance note. That note is an education record. FERPA limits who else sees it.

Worked park. Cash-pay adult, no clinic, no school. HIPAA and FERPA probably do not attach. ACSM heat rules, CDC hygiene, confidentiality, and a virtual-ready emergency plan still do.

When in Doubt

Do not crowd-source a legal theory on the trainer group chat. Read the facility policy. If the policy and a statute appear to conflict, or if you cannot tell whether you are an employee, a covered entity, or a school official, stop improvising and send the question to the facility risk manager or to legal counsel. The professional answer on the exam is the same as the professional answer on Tuesday: follow the written rule you have, hold the session if safety is unclear, and get a qualified opinion before you invent a third path.

Exam Traps

• Treating ACSM as optional because it is “only a guideline.”
• Claiming HIPAA covers every gym conversation, or that it covers none.
• Using FERPA as a synonym for “anyone under 18.”
• Diagnosing FLSA status from a contractor signature alone.
• Ignoring an OSHA-style floor hazard because “I am a contractor, not staff.”
• Treating NCMW as a license to counsel mental illness.
• Skipping CDC hygiene because the client “doesn’t look sick.”
• Inventing a legal interpretation instead of using facility policy and counsel.