2.1 Confidentiality, HIPAA, and Protected Health Information

Confidentiality is tested on nearly every item of the ASWB Clinical exam because it sits at the intersection of ethics, law, and clinical judgment. Expect scenario items that ask what a social worker should do when a subpoena arrives, when a teen asks a clinician not to tell a parent, or when a group member references another member outside the room. The key is knowing both the NASW ethical duty and the legal framework that overlays it.

Confidentiality vs. Privileged Communication

These two terms are often confused, and the exam will test the distinction.

• Confidentiality is an ethical and professional duty owed by the social worker to the client. It means the clinician will not disclose client information except as required or permitted. The duty is codified in NASW Code of Ethics standard 1.07.
• Privileged communication is a legal right belonging to the client. It allows the client to prevent the clinician from testifying or producing records in a legal proceeding. Privilege is created by statute (and in some jurisdictions by case law), and it varies by state. Not all social workers are covered by a statutory privilege, and even when one exists, it is the client who holds and can waive it — not the social worker.

A useful mnemonic: confidentiality is what I owe; privilege is what the client owns.

NASW Code of Ethics Standard 1.07 — Privacy and Confidentiality

Standard 1.07 is dense. Its key provisions for the exam:

• (a) Social workers respect clients' right to privacy and do not solicit private information except for compelling professional reasons.
• (b) Disclosure of confidential information requires valid consent from the client or a legally authorized representative.
• (c) The general rule of confidentiality has exceptions for "compelling professional reasons" — specifically, when disclosure is necessary to prevent serious, foreseeable, and imminent harm. Only the minimum necessary information is disclosed.
• (e) Social workers discuss the nature of confidentiality and its limitations with clients as early as feasible and throughout the relationship.
• (f) In family, couples, or group counseling, social workers have agreements about what may be disclosed among participants.
• (j) Social workers protect confidentiality in legal proceedings to the extent permitted by law.

The Limitations-of-Confidentiality Conversation

The exam often tests whether a social worker has discussed the limits of confidentiality up front. Best practice is to address this during the informed-consent process at the first session: "Most of what you share with me stays private, but there are exceptions. If I have reasonable cause to believe a child, older adult, or dependent adult is being abused or neglected, I am required to report it. If I believe you are at imminent risk of seriously harming yourself or someone else, I may have to break confidentiality to keep people safe. If a court issues a valid order, I may have to comply."

HIPAA and Protected Health Information

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 created the federal Privacy Rule governing protected health information (PHI) — individually identifiable health information transmitted or maintained in any form. Clinical social workers in private or agency practice who transmit health information electronically for billing or other covered transactions are covered entities subject to HIPAA.

Treatment, Payment, and Operations (TPO)

HIPAA permits covered entities to use and disclose PHI without separate client authorization for three core functions:

• Treatment — sharing information with other providers involved in the client's care.
• Payment — submitting claims to insurance for reimbursement.
• Operations — quality improvement, training, audit, and case consultation within the covered entity.

For anything beyond TPO — for example, releasing records to a school, employer, or family member — the clinician needs a written authorization that specifies what is released, to whom, for what purpose, and with an expiration.

Minimum Necessary Standard

For disclosures not covered by TPO, HIPAA requires the clinician to limit the information released to the minimum necessary to accomplish the purpose. TPO is exempt from this standard because full information is needed for treatment. When responding to a subpoena, the principle is to release only what the court order compels — not the entire record.

Business Associate Agreements (BAAs)

Any outside vendor that creates, receives, maintains, or transmits PHI on behalf of a covered entity is a business associate — for example, an electronic health record (EHR) vendor, a billing service, a transcription service, or a cloud storage provider. The covered entity must have a signed Business Associate Agreement (BAA) that obligates the vendor to safeguard PHI and report breaches. No BAA, no PHI.

Breach Notification Rule

Under the HIPAA Breach Notification Rule, a covered entity must notify affected individuals in writing within 60 days of discovering a breach of unsecured PHI. If the breach affects 500 or more individuals, the entity must also notify the U.S. Department of Health and Human Services (HHS) and prominent media outlets in the affected area without unreasonable delay, and no later than 60 days. Breaches affecting fewer than 500 individuals are logged and reported to HHS annually.

Exceptions and Limits to Confidentiality

The following table organizes the major exceptions you must know for the exam.

Vignette: The Subpoena

A clinical social worker in private practice receives a subpoena demanding the full therapy record of a client involved in a custody dispute. The client has not authorized release.

The correct sequence: (1) notify the client immediately so they can assert privilege or sign a release; (2) contact the issuing attorney to narrow the request or seek a protective order; (3) if the order is valid and not quashed, release only the information the court requires — not the whole record; (4) document every step. A subpoena alone is not authorization to release everything; it is a command to appear or produce, and the client's privilege is the first line of defense.

Confidentiality in Special Settings

Group Therapy

In group therapy, the social worker sets ground rules about confidentiality but cannot guarantee that other members will keep it. NASW 1.07(f) calls for a confidentiality agreement among participants. The clinician explains at orientation that confidentiality is expected of members but only legally enforceable against the clinician. Document this conversation.

Electronic Records

Electronic health records expand the surface area for breach. NASW 1.07(r)–(t) requires reasonable safeguards for electronic communications and written records. Use encrypted email, secure portals, and access controls. Do not transmit PHI over personal email or SMS. Do not store client files in unencrypted personal cloud accounts.

Case Consultation

Case consultation is part of TPO when done within a covered entity or for professional development. The clinician discloses only the minimum necessary and, where possible, de-identifies the case. Consultation outside a formal supervisory or consultation relationship requires either a BAA or client authorization.

---

The thread running through all of these scenarios is the same: protect the client's information by default, know the narrow exceptions, and when in doubt, consult and document.