Professional Counseling Orientation & Ethical Practice· Legal & Risk Management

HIPAA essentials

High-yieldCovers privacy rule, PHI, disclosures, security expectations for counselors.

Practice this topic10+ questions + flashcards

Study summary

Congress passed HIPAA in 1996 to make health insurance portable — but the part that dominates the exam is the Privacy Rule that protects your clients' health information. If a question mentions PHI, TPO, or a signed authorization, you're in HIPAA territory.

Who and what. HIPAA applies to covered entities — providers, health plans, and clearinghouses — that transmit health information electronically. It guards Protected Health Information (PHI): any individually identifiable health information (name, diagnosis, dates, record numbers) held or transmitted in any form.

The Privacy Rule sets the national floor for how PHI may be used and disclosed. The organizing idea is the minimum necessary standard — disclose only the least PHI needed for the purpose. Clients must receive a Notice of Privacy Practices describing their rights.

Disclosures. PHI may be used or disclosed without authorization for TPO — Treatment, Payment, and health-care Operations — plus certain required disclosures (e.g., to the client, or as law requires). Anything outside TPO generally needs a signed client authorization.

Psychotherapy notes get special protection. Under HIPAA, psychotherapy notes kept separate from the record enjoy a higher bar: a specific, separate authorization is required to release them, and — importantly — they are not swept in under general TPO consent the way ordinary PHI is. This heightened HIPAA protection is the piece examiners test.

Security expectations. The companion Security Rule governs electronic PHI (ePHI), requiring administrative, physical, and technical safeguards — access controls, encryption, secure storage, and breach notification. Counselors are expected to protect ePHI on devices, email, and telehealth platforms.

Clinical Pearl: Ordinary PHI flows freely for TPO (Treatment, Payment, Operations) under the Privacy Rule, but psychotherapy notes require a separate, specific authorization — that heightened protection is HIPAA's signature exam trap.

Cheat sheet

NCE · Professional Counseling Orientation & Ethical Practice

HIPAA essentials

Protected Health Information (PHI) is any individually identifiable health information — name, diagnosis, dates, record numbers — held or transmitted in any form.

01 · The lawPrivacy Rule — national floor

02 · Know the termPHI — identifiable health info, any form

03 · Must knowTPO: no authorization needed

Legal rules

Privacy Rule — national floor must knowThe HIPAA Privacy Rule sets the national floor for how protected health information may be used and disclosed.

TPO: no authorization needed must knowOrdinary PHI may be used or disclosed without a separate client authorization for TPO — Treatment, Payment, and health-care Operations — plus certain required disclosures.

Minimum necessary standard must knowThe minimum necessary standard requires disclosing only the least PHI needed for the purpose at hand.

Psychotherapy notes: separate authorization must knowPsychotherapy notes kept separate from the record carry heightened HIPAA protection: releasing them requires a separate, specific authorization, and they are not swept in under general TPO consent the way ordinary PHI is.

Outside TPO: signed authorizationAny use or disclosure outside TPO and required disclosures generally requires a signed client authorization.

Notice of Privacy PracticesClients must be given a Notice of Privacy Practices describing how their PHI may be used and what rights they hold.

Security Rule — electronic PHIThe Security Rule is HIPAA's companion to the Privacy Rule and governs electronic PHI (ePHI) specifically, rather than PHI in every form.

Administrative, physical, technical safeguardsThe Security Rule requires three categories of safeguards: administrative (policies, training), physical (locked storage, device control), and technical (access controls, encryption).

Breach notification — unsecured PHIBreach notification is required when unsecured protected health information — in any form (electronic, paper, or oral) — is breached.

Key terms

Covered entities definedHIPAA applies to covered entities — health plans, health-care clearinghouses, and health-care providers who transmit health information electronically in standard transactions (such as insurance billing).

Privacy Rule vs. Security Rule

Commonly confused

	Privacy Rule	Security Rule
Covers	PHI in any form	Electronic PHI (ePHI) only
Governs	Use and disclosure (TPO, authorization, minimum necessary)	Administrative, physical, technical safeguards
Examples	Notice of Privacy Practices; minimum necessary	Policies and training; locked storage; encryption

More detail

Show 2 reference facts

HIPAA 1996 — originCongress passed HIPAA in 1996 to make health insurance portable; the Privacy Rule protecting client health information is the portion that dominates the exam.

Protect ePHI on devices, telehealthCounselors are expected to protect ePHI on their devices, in email, and on telehealth platforms.

Pearl

Ordinary PHI flows for treatment, payment and operations; psychotherapy notes need their own authorization.

Built from CaseSavvy's verified NCE fact map for this topic (13 facts, verified 2026-10-20).

Try an NCE practice question

Pick an answer to see why each option is right or wrong.

Professional Orientation & Ethics

Under the HIPAA Privacy Rule, for which purposes may a counselor disclose ordinary PHI without a separate client authorization?

Keep going on HIPAA essentials

CaseSavvy has 10+ practice questions and a flashcard set for every one of the 227 NCE topics, a spaced-review queue, and timed practice exams. Your first topic is free.

Start free How CaseSavvy NCE works

See all Professional Counseling Orientation & Ethical Practice topics or read the Professional orientation and ethics for the NCE overview.