Securing case notes and records

“Securely maintain case notes, records, and files” (NBCC, 2027 task 6.16)

Client records hold some of the most sensitive information people share. Counselors must protect paper and electronic records from unauthorized access, loss and improper disposal, and know what to do if a breach occurs. The exam tests record security rules and best practices.

Key points

The HIPAA Security Rule requires administrative, physical and technical safeguards for electronic protected health information, such as access controls, encryption, audit logs, locked storage and workforce training.
Paper records should be kept in locked cabinets in secure areas; electronic records on encrypted, password-protected systems with role-based access.
Disposal must make records unreadable, for example by shredding paper and securely wiping or destroying electronic media.
Under HITECH breach notification rules, affected individuals must be notified without unreasonable delay and no later than 60 days after discovery, with notice to HHS and, for large breaches, the media.
Retain records for the period required by state law, payer contracts and policy, and plan for records if the counselor retires or dies.
Clients have a right to access their records under HIPAA, with limited exceptions; psychotherapy notes are excluded from that right.
The ACA Code of Ethics (B.6) addresses confidentiality of records, client access, and secure storage, transfer and disposal.

In practice

A counselor's laptop with client notes is stolen from her car. Because the device was encrypted, the data is protected; she reports the theft to her practice's privacy officer, who documents the incident and determines whether breach notification is required.

Before closing her practice, a counselor arranges for a secure records custodian to hold client files for the period her state requires and tells clients how to request copies.

Check yourself

What three categories of safeguards does the HIPAA Security Rule require?

Administrative, physical and technical safeguards.

What is the outer time limit for notifying individuals of a breach under HITECH rules?

No later than 60 days after discovery, and without unreasonable delay.

How should paper client records be disposed of?

By methods that make them unreadable, such as shredding.

NBCC's knowledge and skills for Domain 6

Knowledge of: State laws (state licensure law, supervision requirements, abuse reporting, license renewal, CAQH); Federal laws (e.g., HIPAA, FERPA, immigration policy, HI-TECH, ADA, NPI); Codes of ethics; Third-party reimbursement, insurance and billing (e.g., CPT codes); Counseling Compact; Emerging technologies in Counseling; Crisis policies and procedures; Recording keeping and reporting requirements and procedures; Appropriate logistics for telemental health services; Scope of practice (e.g., letters of support, working with special populations); Alternative medical-assisted/pharmacological interventions; Accessing state licensure board; Executing voluntary and involuntary commitments.

Skill in: Maintaining confidentiality; Discerning reputable training providers and programs; Troubleshooting technological difficulties during telemental health session (e.g., session disconnects, video not working); Billing and third-party reimbursement.

A study guide written by ExamDragon from NBCC's published task; not NBCC material and not part of the exam.