Published September 5, 2026
NCMHCE Domain 6 (Legal & Ethical): Task Map + 4 Practice Questions
By David Zimmerman · 9 min read · Domain deep-dives
Domain 6, Legal and Ethical Compliance, is roughly 8–10% of the NCMHCE, and it is the domain candidates most often feel confident about and then lose points on, because the items are not about knowing the rule. They are about applying the rule in the right order when a supervisor, an attorney, or a convenient tool is pushing you to skip a step. Here is the task map, the reasoning patterns, and four playable questions from the free tier.
What Domain 6 covers
| Task area | What the exam asks you to do | Typical stems |
|---|---|---|
| Confidentiality and privilege | Protect records; distinguish a subpoena from a court order; respond formally rather than reflexively. | "What should you recognize about the legal document…" |
| Informed consent | Consent must cover the actual practice, including technology and third-party processing. | "What procedural step should the agency complete before…" |
| HIPAA and records | BAAs, minimum necessary, retention, secondary uses of PHI. | "Under HIPAA, what is required when…" |
| Duty to warn / protect, mandated reporting | Assess before acting; know the thresholds; document. | "What is your FIRST ethical obligation…" |
| Technology and telehealth | ACA Section H: limitations, security, consent, jurisdiction. | "Which ACA standard MOST directly addresses…" |
| Consultation and self-protection | Use supervision, legal counsel, and liability-carrier resources early. | "What role does professional liability insurance play…" |
How the exam thinks about ethics
Assess before you disclose, report, or hospitalize
Ethics items almost never key on the dramatic action. The counselor who assesses severity, consults, and documents before breaking confidentiality is the one the exam rewards. Immediate reporting, immediate release of records, and immediate termination are classic distractors.
Authority does not transfer responsibility
A clinical director saying “the BAA covers us” or an attorney demanding a file does not change your obligations. The keyed answer identifies the gap (an uncovered data use, a missing consent, an unwaived privilege) and responds formally.
Specific beats general
When two ethics standards both apply, the stem usually asks for the one that MOST directly addresses the situation: Section H for technology over Section B for confidentiality, HIPAA’s Privacy Rule over HITECH, a court order’s scope over the minimum-necessary standard.
Practice questions
Four questions from CaseSavvy’s free-tier Domain 6 drills. Pick an answer to reveal the rationale.
Question 1 · Technology and PHI
Domain 6: Legal and Ethical Compliance
Your agency has adopted an AI progress-note tool that processes session recordings. The vendor calls it "HIPAA-compliant" and provides a Business Associate Agreement. Recordings go to cloud servers and are retained up to 90 days "for quality improvement"; the privacy policy says de-identified data may be used to train the company's models. The BAA covers storage and transmission encryption but does not address the model-training clause, and no client consent template for AI processing has been provided. Your clinical director says, "The BAA covers us legally. We don't need to change our consent forms." A colleague has already used it with three clients.
What should you evaluate first before using this AI tool with client session recordings?
Question 2 · ACA Code of Ethics
Domain 6: Legal and Ethical Compliance
Your agency has adopted an AI progress-note tool that processes session recordings. The vendor calls it "HIPAA-compliant" and provides a Business Associate Agreement. Recordings go to cloud servers and are retained up to 90 days "for quality improvement"; the privacy policy says de-identified data may be used to train the company's models. The BAA covers storage and transmission encryption but does not address the model-training clause, and no client consent template for AI processing has been provided. Your clinical director says, "The BAA covers us legally. We don't need to change our consent forms." A colleague has already used it with three clients.
Which ACA Code of Ethics standard most directly addresses a counselor's obligation when using technology to deliver services or manage records?
Every ethics drill explains all four options
Why the distractor is tempting matters as much as why the key is right. 18 drills are free.
Question 3 · Subpoenas and privilege
Domain 6: Legal and Ethical Compliance
You receive a subpoena duces tecum from the attorney for your client's ex-spouse requesting your "complete clinical file" for a contested custody case. Your client has been in treatment with you for fourteen months for recurrent depression; the file includes notes about a hospitalization two years ago. He has not signed a release, no judge has issued a court order, and your state recognizes therapist-client privilege, which he has not waived. The subpoena was issued by opposing counsel and sets a compliance date twelve business days out. He asks, "Do I even have a choice here, or do you just have to hand everything over?"
What should you recognize about the legal document you received from opposing counsel?
Question 4 · Releasing records
Domain 6: Legal and Ethical Compliance
You receive a subpoena duces tecum from the attorney for your client's ex-spouse requesting your "complete clinical file" for a contested custody case. Your client has been in treatment with you for fourteen months for recurrent depression; the file includes notes about a hospitalization two years ago. He has not signed a release, no judge has issued a court order, and your state recognizes therapist-client privilege, which he has not waived. The subpoena was issued by opposing counsel and sets a compliance date twelve business days out. He asks, "Do I even have a choice here, or do you just have to hand everything over?"
What does the ACA Code of Ethics direct you to do regarding your client's privileged communication?
The subpoena rule, in one breath
How to study Domain 6
- Know the ACA Code by section letter (A relationship, B confidentiality, C responsibility, D other professionals, E assessment, F supervision, G research, H technology, I resolving issues) and the two or three standards the exam cites from each.
- Write the sequences out: duty to warn (assess, consult, document, then act), subpoena response, mandated report, breach response. Sequence is what FIRST items test.
- Practice the 2027 additions: AI tools, telehealth across state lines, license portability. These show up as technology and consent items, not as trivia. See what changes in 2027.
- Pair ethics with assessment: most ethics dilemmas in cases begin with a risk assessment. The Domain 2B questions and stem strategies are the natural companions.
Sources
Frequently asked questions
Do I have to release records when I get a subpoena?
Not automatically. An attorney-issued subpoena is a demand, not a court order; assert privilege in writing or move to quash, inform the client, and consult your liability carrier. Release only with valid client authorization or a court order.
Which ACA Code section covers technology and telehealth?
Section H addresses distance counseling, technology, and social media, including data security and consent for technology-assisted services.
Ready to practice?
Start drilling NCMHCE-style questions for free — no credit card required.
Start Free Practice →