Federal Requirements
What this domain tests
Federal law sets floors and sometimes ceilings on privacy, education, employment, and billing conduct. Items test whether you know which federal regime governs which record and which disclosure.
Core rules and concepts
- HIPAA Privacy, Security, and Breach Notification Rules (45 CFR Parts 160 and 164) apply to covered entities. Psychotherapy notes require a separate authorization; minimum-necessary and business associate agreements apply; breach notice is due without unreasonable delay and no later than 60 days. HIPAA does not preempt stricter state law.
- 42 CFR Part 2 protects substance-use disorder records and bars redisclosure without consent.
- FERPA (34 CFR Part 99) covers education records; IDEA (34 CFR Part 300) and Section 504/ADA cover school services and accommodations.
- The No Surprises Act requires a Good Faith Estimate for uninsured or self-pay clients.
- A subpoena is not a court order. Verify it, notify the client, and seek authorization or a protective order before producing records.
Worked example
You receive a subpoena duces tecum for a client's complete file, including therapy process notes. Reasoning: contact the client, confirm the subpoena's validity, and obtain written authorization or a qualified court order. Disclose only what is ordered, keep psychotherapy notes out absent specific authorization, and document every step.
Traps that cost marks
- Assuming HIPAA overrides a stricter Nebraska confidentiality statute.
- Releasing psychotherapy notes on a general authorization.
- Treating a subpoena as self-executing.
- Mixing FERPA and HIPAA when a school-based service is billed to Medicaid.