Under 45 CFR 160.102, the HIPAA rules apply directly to which set of entities?
Choose an answer, then check it.
Social Work & Human Services · Ethics
Confidentiality and Privacy
On this page 9 sections
In 30 seconds
Confidentiality is the practitioner's duty over what a client discloses inside a professional relationship. Privacy is the client's own interest in controlling information about themselves. privilege An evidence rule that lets a client keep a court from compelling a professional to testify about, or produce records of, their confidential communications. Full entry → is a narrower evidence rule about what a court can compel. In the United States, HIPAA binds only covered entities and their business associates, substance use disorder treatment records carry stricter federal protection, and every duty has limits set largely by state law. Naming those limits out loud, at the start, is the practice standard.
Why this matters
Almost every task in a helping job touches this: an intake form, a phone call from a school, a case consultation, a subpoena in the mail. Students who leave with the slogan that everything is confidential are the ones who freeze when a real limit appears, and the ones who over-disclose because they assume a signed form covers anything. Licensing exams test these distinctions directly, and field placements expect you to explain confidentiality to a client in your first week. The rules also move. Federal protection for substance use disorder records was realigned with HIPAA by a 2024 rule whose compliance date fell in February 2026, and state duties differ enough that a habit learned in one state can be wrong in the next.
The college version
Three words students merge into one
Privacy is a person's interest in controlling information about themselves - who knows what, when, and on what terms. It exists before any professional arrives. Confidentiality is a duty that attaches to the practitioner and the agency once information is disclosed inside a professional relationship, enforced through licensure law, regulation, and codes of ethics. Privilege is neither. It is a rule of evidence governing whether a court can compel testimony or records. In Jaffee v. Redmond, 518 U.S. 1 (1996), the Supreme Court recognized a psychotherapist-patient privilege under Federal Rule of Evidence 501 and held that the reasoning extended to licensed clinical social workers, while declining to map the privilege's full contours and acknowledging that exceptions may exist, including where disclosure is the only way to avert a serious threat of harm. Privilege belongs to the client and is narrower than confidentiality: a great deal of information is confidential without ever being privileged. Mandated reporting makes the gap visible. The Child Welfare Information Gateway's review of state reporting statutes reports that most states restrict privilege for mandated reporters, with the physician-patient and spousal privileges most commonly denied and attorney-client most commonly affirmed. Keep the three apart and this topic organizes itself.
What HIPAA actually covers - and what it does not
HIPAA is not a general privacy law for health information, which is the most common misunderstanding of it. Under 45 CFR 160.102 the rules apply to health plans, health care clearinghouses, and health care providers who transmit health information electronically in connection with a covered transaction - and, where the regulations say so, to business associates. A business associate A person or organization outside a covered entity's workforce that handles protected health information on that entity's behalf, or supplies listed professional services requiring access to it; subcontractors are included. Full entry →, defined at 160.103, is a person or organization outside the covered entity A health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in connection with a transaction the HIPAA rules cover. Full entry →'s workforce that handles protected health information Individually identifiable health data held or transmitted in any form by a HIPAA covered entity or business associate, excluding FERPA education records, employment records held by an employer, and information about people dead more than 50 years. Full entry → on its behalf or supplies listed services involving disclosure of it; subcontractors are included. A peer support group, a mutual-aid organization, a consumer symptom-tracking app, an employer holding employment records - none become covered merely by holding health information. The definition of protected health information itself carves out education records covered by the Family Educational Rights and Privacy Act and employment records a covered entity holds as an employer. That is scoping, not permission: state confidentiality statutes, licensure rules, professional codes, and agency policy routinely bind organizations HIPAA never reaches. And where HIPAA applies it is a floor, not a ceiling - under 160.203(b) a state privacy law that is more stringent, as 160.202 defines it, survives preemption. Schools run on a different statute: education records fall under FERPA and 34 CFR Part 99, where rights transfer to the student at 18 or on entering a postsecondary institution, and records a recognized professional makes and uses only in connection with treatment, disclosed only to those providing it, sit outside education records under 34 CFR 99.3 - an exclusion that ends the moment the record goes elsewhere.
The everyday machinery: minimum necessary, TPO, and a valid release
Three mechanics do most of the daily work. The minimum necessary standard The requirement to make reasonable efforts to limit the health information used, disclosed, or requested to what the stated purpose actually needs, subject to listed exceptions such as treatment disclosures. Full entry → at 45 CFR 164.502(b) requires reasonable efforts to limit protected health information to the minimum needed for the purpose of the use, disclosure, or request. Its exceptions matter as much as the rule: it does not apply to disclosures to, or requests by, a health care provider for treatment; to disclosures to the individual; to uses made under an authorization A signed, plain-language document meeting specified regulatory elements that permits a described disclosure to a named recipient for a stated purpose, with an expiration and a right to revoke. Full entry →; to disclosures to the Secretary for compliance review; or to uses required by law. Section 164.514(d) turns this into role-based access - identify which workforce members need which categories of information, then limit access accordingly. Second, 164.506 permits a covered entity to use or disclose information for its own treatment, payment, and health care operations, and to disclose it to another provider for that provider's treatment activities, without a signed authorization. That is why a referral needs no new form. Third, everything outside those permissions runs on an authorization - the document practitioners call a release of information. Section 164.508(c) sets the core elements: a specific and meaningful description of the information, who may disclose, who may receive, each purpose, an expiration date or event, and the individual's signature and date. It must also carry statements on the right to revoke, whether treatment or benefits may be conditioned on signing, and - the one students skip and clients care most about - the potential for the recipient to redisclose, after which HIPAA may no longer protect the information. It must be in plain language, and the individual gets a copy.
Substance use disorder records: 42 CFR Part 2
A separate, older federal regime protects substance use disorder treatment records more tightly than HIPAA does. Under 42 CFR 2.12 the restrictions reach records that would identify a patient as having or having had a substance use disorder and that were obtained by a federally assisted substance use disorder program - a part 2 program A federally assisted individual or organization that holds itself out as providing, and does provide, substance use disorder diagnosis, treatment, or referral for treatment. Full entry →. Federal assistance is defined broadly at 2.12(b) - Medicare participation, registration to dispense a controlled substance used in this treatment, federal funds in almost any form, even tax-exempt status. Part 2 is program-based, not diagnosis-based. Section 2.12(e)(2) says that if the diagnosis, treatment, or referral is not provided by a part 2 program the record is not covered. Section 2.13(b) is strict: the restrictions apply regardless of whether the requester already has the information, is a law enforcement official, or holds a subpoena. The 2024 final rule (89 FR 12472, effective April 16, 2024, compliance date February 16, 2026) implemented section 3221 of the CARES Act and moved Part 2 closer to HIPAA. A patient may now give a single written consent covering all future disclosures for treatment, payment, and health care operations (2.31(a)); a covered entity receiving records on that consent may redisclose under HIPAA's permissions and need not segregate them (2.12(d)(2)(i)(C)); HIPAA breach notification applies (2.16(b)); and enforcement runs through HIPAA's penalty provisions (2.3). The core did not change. Records, and testimony relaying their content, may not be used against the patient in civil, criminal, administrative, or legislative proceedings without specific written consent or a qualifying court order (2.12(d)(1), 2.13(a)), and a consent for that purpose may not be combined with any other (2.31(d)). Section 2.20 preserves stricter state law and forbids any state law from authorizing a disclosure Part 2 prohibits.
The limits: reporting, duty to protect, and the courts
Confidentiality has never meant never, and its limits arrive from three directions. Mandated reporting comes first. The federal Child Abuse Prevention and Treatment Act requires each state to have provisions requiring certain individuals to report known or suspected child abuse and neglect, but who reports, on what standard, and to whom is state law. As of the Child Welfare Information Gateway review current through May 2023, roughly 46 states plus the District of Columbia and several territories enumerate mandated professions - social workers in 41 of them - while Indiana, New Jersey, North Carolina, and Wyoming instead require all persons to report, and approximately 17 states plus Puerto Rico impose a duty on any person. The trigger is typically suspicion or reasonable belief formed in the reporter's official capacity, and the job is to report the facts that produced the suspicion; proof is never the reporter's burden. Vulnerable-adult reporting is a parallel state-law duty. HIPAA accommodates this rather than blocking it (45 CFR 164.512(a), (b)(1)(ii), (c)), and Part 2 does not bar reporting suspected child abuse and neglect under state law (2.12(c)(6)), though the underlying records stay protected. Second, duty to protect A state-law obligation, arising from the Tarasoff line of cases or from statute, to take reasonable steps to prevent foreseeable serious harm to an identifiable person. Full entry →. Tarasoff v. Regents of the University of California is the origin: the 1974 decision framed a duty to warn a foreseeable victim, and the 1976 rehearing (551 P.2d 334) framed a broader duty to exercise reasonable care to protect, of which warning is one possible step. That is California state law, not a national rule. Johnson, Persad, and Sisti's 2014 review, summarizing Edwards's 2012 classification, counted 23 states with a mandatory duty in statute, 10 with a mandatory duty in common law, 11 that permit disclosure without requiring it, and 6 with no guidance. In one survey the same review cites, 76 percent of psychologists misidentified their own state's law, which is why this question belongs to your jurisdiction's statute, your licensing board, and your agency's counsel. HIPAA does not create the duty; 164.512(j) merely permits a covered entity, consistent with applicable law and ethical standards, to make a good-faith disclosure believed necessary to prevent or lessen a serious and imminent threat, to someone reasonably able to prevent it. Third, the courts, where a subpoena and a court order are different instruments. Under 164.512(e) a covered entity may disclose in response to a court order, limited to what the order expressly authorizes, while a bare subpoena requires satisfactory assurances that the individual received notice and a chance to object, or that a qualified protective order was sought. Part 2 is stricter still: a subpoena alone is never sufficient, and subpart E requires specific judicial findings first.
Minors, families, and groups
Confidentiality with minors tracks a prior question: who may lawfully consent to the service. Part 2 makes that dependency explicit. Under 42 CFR 2.14(a), if a minor acting alone has legal capacity under state law to obtain substance use disorder treatment, only the minor may consent to a disclosure - including a disclosure to a parent for reimbursement. Under 2.14(b), where state law requires parental consent to treatment, both the minor and the parent or guardian must sign. A narrow exception at 2.14(c) lets the program director disclose facts relevant to reducing a substantial threat to the life or physical well-being of the minor or another person when the minor lacks capacity for a rational choice. Outside Part 2 the pattern holds but answers vary, because states differ on when a minor may independently consent to care. Family and group settings raise a structural problem rather than a legal one. A practitioner can hold their own duty but cannot make other participants keep a confidence. The NASW Code of Ethics addresses this in Standard 1.07: social workers seek agreement among the parties about each person's right to confidentiality and obligation to preserve what others share, and tell participants that the worker cannot guarantee everyone will honor it. Say that with the ground rules, not afterward.
The conversation at the start, and the practice around it
The practice standard is not a signature. It is a conversation. NASW Standard 1.07(e) frames it as informing clients about the nature and limits of confidentiality and reviewing the circumstances in which information may be requested or disclosure legally required - early in the relationship and again as needed. The regulations supply the paper version: 42 CFR 2.22 requires a part 2 program to tell the patient at admission that federal law protects these records and to provide a plain-language privacy notice no later than first service delivery, and HIPAA imposes parallel notice obligations. But a notice handed across a desk is not a conversation had. The working test is whether the client can say back, in their own words, what would make you have to tell someone else. Section 2.16 requires part 2 programs to keep written policies covering both paper and electronic records - transfer, secure storage, workstation access, destruction; 45 CFR 164.514(d)(2) requires the same discipline in role terms. In practice: unencrypted email and text are not confidential channels; a telehealth session has a room on both ends and you control only one of them, so asking who else is present is part of the work; and case consultation, legitimate as it is, still runs on the rule NASW Standard 1.07 states - no identifying information without consent or a compelling professional need, and no more than the consultation requires. Hallways, elevators, and screens angled toward a waiting room defeat more confidentiality than any attacker does.
What this lesson is and is not
This is educational material about how these rules are structured. It is not legal advice, and nothing here should be used to decide an actual disclosure question about a real person. Everything described as federal law is United States federal law; state law varies, is frequently stricter, and is expressly preserved when stricter by both HIPAA (45 CFR 160.203) and Part 2 (42 CFR 2.20). Professional codes differ across social work, counseling, psychology, and nursing, and licensing boards enforce them separately from statute. Regulations change, so any date or count here should be re-verified against the current regulation. When a real question arrives - a subpoena, a threat, a call from a parent - the answer comes from your jurisdiction's statutes, your licensing board, your agency's policy and counsel, and your supervisor. The skill this topic builds is recognizing which kind of question you are holding, and who may answer it. Two neighboring topics carry the rest of the ethics load: codes, values, and the structured decision-making process belong to Ethics in Helping Professions, and dual relationships belong to Professional Boundaries.
Eli explains
The same idea, in plain words
Explain it like I’m 10
Imagine telling a school counselor something hard. Three different ideas are doing three different jobs. Privacy is your say over who knows things about you. It is yours, and it existed before you walked in the room. Confidentiality is the counselor's rule about what you just told them. It sticks to the counselor, not to you. Privilege is a courtroom rule about whether a judge can make them repeat it out loud. None of the three means never tells anyone. There are a small number of situations where adults have to pass information along, mostly when someone could get seriously hurt. A good counselor lists those situations before you start talking, not after.
Picture it like this
Think about lending someone your bike. Privacy is the fact that it is your bike and you decide who gets to ride it. Confidentiality is the rule your friend follows once they have it: they take care of it and do not hand it to strangers. Privilege is a separate rule about whether a referee can force your friend to wheel the bike out onto the field during a game. And there is a fire-station rule sitting on top of all of it: if the bike catches fire, your friend calls for help without stopping to ask your permission first.
Where the picture stops working
The bike breaks the picture in two places. Information is not a bike. Once you tell someone, you cannot get it back, and copies can sit in a chart, a billing system, and an email at the same time, each with different protection. The second break is the fire-station rule. Your friend deciding about a burning bike is deciding alone, in a moment. A practitioner is following rules that other people wrote down, that differ from state to state, and that specialists still argue about at the edges.
Worked example
A social worker at a community behavioral health agency opens a first session with a new client while a student intern observes. Before taking any history, the worker says: "Before you tell me anything, I want you to know what happens to it. Most of what you say stays between us and the people here who help with your care and your billing. There are a few things I cannot keep to myself. If you tell me a child or a vulnerable adult is being hurt, I have to report it. If I believe you are about to seriously hurt yourself or someone else, I have to act on that, which can mean telling someone who can help keep people safe. And if a court orders your records, I have to respond, though I can ask the court to narrow what goes out. Anything else leaves this office only if you sign a release saying who gets it, what they get, and for how long. Does that match what you expected? What questions do you have?" The client asks whether an employer's insurance plan will see a diagnosis. The worker explains what billing routinely transmits and what it does not, points to the agency's written privacy notice, and offers to read through it together. Afterward the intern asks how the worker picked those particular examples. The answer: they are the limits that actually arise in this program, said in words a person can repeat back - which is the test of whether the conversation worked.
Key takeaway
Privacy, confidentiality, and privilege are three different rules with three different owners, and none of them means never. Learn which federal regime applies, learn where your state is stricter, and tell the client the limits in plain words before they start talking - this lesson is educational material about how the rules are built, not legal advice.
Quick check
3 questions here, of 5 in this lesson’s practice set. Answers stay hidden until you check.
A client's statement in a counseling session is confidential, yet a state mandated-reporting statute removes the professional's ability to withhold it when child abuse is suspected. Which distinction does this best illustrate?
Choose an answer, then check it.
A covered entity receives two requests for a client's records: one from its own billing department to process a claim, and one from a treating physician to guide care. How does HIPAA's minimum necessary standard apply?
Choose an answer, then check it.
Study tools & related lessonsYou’ll learn to · Common mistakes · Easily confused · Key vocabulary · Related
You’ll learn to
- Distinguish privacy, confidentiality, and privilege, and explain why the three terms are not interchangeable.
- Explain which organizations the HIPAA rules bind and which they do not, and state what the minimum necessary standard requires.
- Apply the regulatory elements of a valid authorization, and distinguish authorization from consent for treatment, payment, and health care operations.
- Explain the heightened federal protection for substance use disorder treatment records under 42 CFR Part 2 and what the 2024 alignment rule changed.
- Analyze the limits of confidentiality - mandated reporting, duty-to-protect doctrines, court orders and subpoenas, and imminent risk - as jurisdiction-dependent rules rather than one national standard.
- Evaluate how a practitioner communicates those limits to a client, and to participants in family and group settings, before information is shared.
Common mistakes
Believing HIPAA covers every organization that holds health information.
Under 45 CFR 160.102 and 160.103, HIPAA reaches health plans, health care clearinghouses, providers who transmit electronically for covered transactions, and their business associates. A peer support group, a consumer health app, an employer's employment records, or a school's education records are not covered simply because health information is present - though state law, licensure rules, professional codes, and contract may still bind them.
Treating duty to warn as one national rule that follows automatically from Tarasoff.
Tarasoff is California case law, and the 1976 rehearing framed a duty to protect rather than only to warn. A 2014 review summarizing a 2012 classification counted 23 states with a mandatory duty in statute, 10 in common law, 11 that permit disclosure without requiring it, and 6 with no guidance. Your obligation comes from your jurisdiction, your licensing board, and your agency, not from a general summary.
Treating a subpoena as if it carried the force of a court order.
Under 45 CFR 164.512(e), a court order permits disclosure of what the order expressly authorizes, while a bare subpoena requires satisfactory assurances about notice to the individual or a qualified protective order. For substance use disorder records, 42 CFR 2.13(b) makes clear a subpoena alone is never sufficient, and subpart E requires a court to make specific findings first.
Assuming any signed form counts as a valid release of information.
Section 164.508(c) requires specific core elements - a meaningful description of the information, who may disclose, who may receive, each purpose, an expiration date or event, and signature and date - plus statements on revocation, conditioning, and redisclosure, in plain language, with a copy to the individual. Part 2 consents carry their own list at 42 CFR 2.31(a), and 2.31(c) bars acting on a consent that is expired, revoked, or facially deficient.
Promising confidentiality in a group or family session that the practitioner cannot actually deliver.
The duty binds the practitioner, not the other participants. The NASW Code of Ethics addresses this in Standard 1.07: seek agreement among the parties about each person's confidentiality rights and obligations, and tell participants plainly that you cannot guarantee every participant will honor the agreement. Say it before the first disclosure, not afterward.
Easily confused
Privacy vs. Confidentiality
Privacy is the client's interest in controlling information about themselves and exists independently of any professional. Confidentiality is a duty that attaches to the practitioner and the agency once information is disclosed inside a professional relationship.
Confidentiality vs. Privilege
Confidentiality is an ethical and regulatory duty about what you may share in practice. Privilege is an evidence rule about what a court may compel. Jaffee v. Redmond (1996) recognized a federal psychotherapist-patient privilege reaching licensed clinical social workers, but much information is confidential without being privileged, and state reporting statutes commonly restrict privilege for mandated reporters.
Consent for treatment, payment, and health care operations vs. Authorization
Section 164.506 permits a covered entity to use and disclose protected health information for treatment, payment, and health care operations without a signed authorization. Section 164.508 requires an authorization with specified core elements and notice statements for disclosures outside those permissions.
HIPAA Privacy Rule vs. 42 CFR Part 2
HIPAA sets a federal floor for protected health information held by covered entities and business associates. Part 2 adds stricter, program-based protection to records from federally assisted substance use disorder programs, including a bar on using records or related testimony against the patient in legal proceedings without specific consent or a qualifying court order.
Duty to warn vs. Duty to protect
The 1974 Tarasoff decision framed a duty to warn a foreseeable victim. The 1976 rehearing framed a broader duty to exercise reasonable care to protect, of which warning is one possible step among several. States adopted these formulations unevenly, by statute, by common law, or not at all.
Subpoena vs. Court order
A subpoena is a party's demand for records or testimony; a court order is a judicial directive. HIPAA lets a covered entity respond directly to an order but conditions response to a bare subpoena on notice or a protective order, and Part 2 requires a qualifying court order regardless of any subpoena.
Key vocabulary
- protected health information
- Individually identifiable health data held or transmitted in any form by a HIPAA covered entity or business associate, excluding FERPA education records, employment records held by an employer, and information about people dead more than 50 years.
- covered entity
- A health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in connection with a transaction the HIPAA rules cover.
- business associate
- A person or organization outside a covered entity's workforce that handles protected health information on that entity's behalf, or supplies listed professional services requiring access to it; subcontractors are included.
- minimum necessary standard
- The requirement to make reasonable efforts to limit the health information used, disclosed, or requested to what the stated purpose actually needs, subject to listed exceptions such as treatment disclosures.
- authorization
- A signed, plain-language document meeting specified regulatory elements that permits a described disclosure to a named recipient for a stated purpose, with an expiration and a right to revoke.
- part 2 program
- A federally assisted individual or organization that holds itself out as providing, and does provide, substance use disorder diagnosis, treatment, or referral for treatment.
- redisclosure
- Further sharing of information by a recipient after it has left the original holder, at which point the original federal protections may no longer travel with it.
- mandated reporter
- A person whom state law obligates to notify authorities upon suspecting, in their official capacity, that a child or other protected person is being abused or neglected.
- duty to protect
- A state-law obligation, arising from the Tarasoff line of cases or from statute, to take reasonable steps to prevent foreseeable serious harm to an identifiable person.
- privilege
- An evidence rule that lets a client keep a court from compelling a professional to testify about, or produce records of, their confidential communications.
Sources & references
- 45 CFR Part 160 - General Administrative Requirements (HIPAA applicability, definitions, and preemption) — U.S. Government Publishing Office / Office of the Federal Register (eCFR)
- 45 CFR Part 164 Subpart E - Privacy of Individually Identifiable Health Information — U.S. Government Publishing Office / Office of the Federal Register (eCFR)
- 42 CFR Part 2 - Confidentiality of Substance Use Disorder Patient Records — U.S. Government Publishing Office / Office of the Federal Register (eCFR)
- Confidentiality of Substance Use Disorder (SUD) Patient Records; Final Rule, 89 FR 12472 — U.S. Department of Health and Human Services (Office for Civil Rights and SAMHSA), via the Federal Register
- 34 CFR Part 99 - Family Educational Rights and Privacy — U.S. Government Publishing Office / Office of the Federal Register (eCFR)
- Mandatory Reporting of Child Abuse and Neglect (State Statutes, current through May 2023) — Child Welfare Information Gateway, Children's Bureau, Administration for Children and Families, U.S. Department of Health and Human Services
- The Tarasoff Rule: The Implications of Interstate Variation and Gaps in Professional Training — Journal of the American Academy of Psychiatry and the Law (Johnson R, Persad G, Sisti D; 2014;42(4):469-477)
- Jaffee v. Redmond, 518 U.S. 1 (1996) — Legal Information Institute, Cornell Law School
- NASW Code of Ethics (2021 revision), including Ethical Responsibilities to Clients — National Association of Social Workers
EliExplains lessons are original prose written from the open, credible references above. See Copyright & Licensing.
Researched 2026-08-18
Educational content only. It is not medical, legal or professional advice. Found an error? Tell us.