Published September 6, 2026
Records, EHR, and Release Rules on the NCMHCE: HIPAA, Psychotherapy Notes, Part 2, and Subpoenas
By David Zimmerman · 9 min read · Domain deep-dives
Clinical documentation and EHR systems are Domain 5 and Domain 6 tasks on NBCC’s 2027 outline, and Legal and Ethical Compliance is 20% of the exam[5]. The items test what belongs in the record, who can see it, what a release must say, the stricter rules for substance use records, subpoenas, and electronic safeguards, drawing on HIPAA[1][2], 42 CFR Part 2[3], and the ACA Code[4]. Seven scenarios follow. Note-writing itself is in our SOAP notes post.
What is in the record, and who can see it
| Category | Contents | Access |
|---|---|---|
| Designated record set (the clinical record) | Intake, assessment, diagnosis, treatment plan, progress notes (dates, modality, interventions, response, plan), medications, test results, correspondence, releases, billing | Client has a right of access; disclosable with authorization or under treatment/payment/operations rules; minimum necessary for most disclosures |
| Psychotherapy notes (HIPAA definition) | The counselor's private process notes analyzing conversation, kept physically or electronically separate | Not part of the record set; require a specific authorization; client access may be limited; excluded from most other disclosures |
| Substance use disorder treatment records (Part 2 programs) | Any record identifying a person as receiving SUD treatment from a Part 2 program | Specific written consent naming recipient, purpose, and information; redisclosure prohibited without consent; narrow exceptions (medical emergency, court order with special findings) |
| Minors' records | Same contents | Parents or guardians generally have access, subject to state law, custody orders, and minor-consent statutes; counselor sets expectations at intake |
| Group and couples records | Records of conjoint sessions | Release requires care; one member cannot unilaterally release information about others |
Releases of information
- A valid authorization is written, specific (who, to whom, what, purpose), dated, time-limited, signed, revocable in writing, and explains redisclosure risk.
- Verbal permission is not a release; document it and get the signature.
- Send the minimum necessary for the purpose; a summary often serves better than the whole chart.
- Part 2 consents must name the recipient and purpose and carry the redisclosure notice.
- Coordination with collateral contacts (schools, physicians, family) is a Domain 5 task that runs on releases.
Subpoenas, court orders, and privilege
- Subpoena (from an attorney or clerk): respond, do not ignore, do not release; contact the client, consult an attorney or your liability carrier, and assert privilege on the client’s behalf unless the client authorizes release.
- Court order (signed by a judge): comply, releasing only what is ordered; seek to limit scope where possible.
- Privilege belongs to the client; exceptions vary by state (client puts mental state at issue, court-ordered evaluation, child custody in some jurisdictions).
Electronic records and security
- HIPAA Security Rule: administrative (policies, training, risk analysis), physical (device and facility controls), and technical (unique logins, role-based access, encryption, audit logs) safeguards.
- Business associate agreements with EHR, telehealth, billing, and cloud vendors.
- Breach notification procedures; texting and email only through secure, consented channels.
- AI tools that touch client data are subject to the same rules; the 2027 outline names AI under legal compliance (see the telehealth and AI post).
Retention, transfer, and the professional will
Records and release items are free Domain 5 and 6 drills
Subpoena, release, and documentation questions with rationales for every option. 18 free drills.
Scenarios
Interactive
Records, EHR, and release rules on the NCMHCE
A client's new psychiatrist requests "all records." The client has signed a release naming the psychiatrist. The counselor should send:
Related
Sources
- U.S. Department of Health & Human Services — HIPAA
- U.S. Department of Health & Human Services — HIPAA Privacy Rule and sharing information related to mental health
- 42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records (eCFR)
- American Counseling Association — ACA Code of Ethics (2014) and ethics resources
- NBCC — NCMHCE Examination Specifications, effective July 1, 2027 (domain weighting, format, scaled scoring)
Frequently asked questions
What are psychotherapy notes under HIPAA?
A counselor's private process notes analyzing the content of sessions, kept separate from the rest of the record. They exclude medications, session times, diagnosis, treatment plan, results, and progress, all of which belong in the clinical record. Psychotherapy notes require a specific authorization for release and are excluded from most other disclosures.
What should a counselor do with a subpoena for client records?
Respond but do not release: contact the client, consult an attorney or liability carrier, and assert privilege on the client's behalf unless the client authorizes release or a judge issues a court order. A court order requires compliance limited to what is ordered.
How do substance use treatment records differ from other records?
Records of federally assisted substance use disorder treatment programs are protected by 42 CFR Part 2, which requires a specific written consent naming the recipient and purpose, prohibits redisclosure without consent, and allows only narrow exceptions such as medical emergencies and court orders with special findings.
Ready to practice?
Start drilling NCMHCE-style questions for free — no credit card required.
Start Free Practice →