Legal and Regulatory Issues
What to know
Know the legal framework surrounding practice: licensure and scope of practice, mandatory reporting of child and elder abuse, duty to protect (Tarasoff-type obligations, which vary by jurisdiction), involuntary commitment criteria, guardianship, and subpoenas versus court orders. Understand HIPAA and its permitted disclosures (treatment, payment, operations; serious threat; required by law), the minimum-necessary standard, and how state law may be stricter. Know record retention, minor consent rules, custody and divorce-related requests, and the distinction between privilege (held by the client) and confidentiality. Understand negligence elements - duty, breach, causation, damages - and how documentation reduces risk.
Traps in questions
- Assuming one national standard; duty-to-protect and reporting rules are state-specific.
- Releasing records on a subpoena without verifying it or notifying the client/obtaining consent or a court order.
- Confusing privilege (a legal evidentiary protection) with confidentiality (an ethical duty).
- Overlooking that minors' consent and parents' access vary by state and situation.
Rule of thumb
When in doubt, do not disclose; verify authority, consult, and document. A subpoena is a request, not automatically an authorization to release.
Worked example: A subpoena arrives for a client's records. Verify the client's consent, check jurisdiction rules, notify the client, and seek legal advice before releasing anything.