Sooner or later, a client asks the question directly: "Who else gets to see this?" It's a fair question, and the honest answer is longer than most clients expect. A clinical record isn't a locked diary. It moves—to insurers, to supervisors, to other providers, sometimes to courts—and the rules governing that movement show up all over the ASWB exam. Confidentiality questions aren't really testing whether you value privacy. They're testing whether you know exactly where privacy ends.
Here's a map of who can access a client's record, when consent is required, and when it isn't.
HIPAA permits covered entities—including social workers in most practice settings—to use and disclose protected health information without a signed authorization for three purposes: treatment, payment, and healthcare operations.
That covers more ground than it sounds like. Coordinating care with a client's psychiatrist is treatment. Submitting a claim to the client's insurer is payment. Quality reviews, audits, and supervision fall under operations. None of these requires the client to sign a release, though clients should understand at intake, through informed consent, how their information may be used.
Two limits keep this from becoming a free-for-all. First, the minimum necessary standard: disclose only what the purpose actually requires, not the whole chart. Second, psychotherapy notes—a clinician's separate process notes, kept apart from the general record—get extra protection under HIPAA and generally require specific authorization even for uses the rest of the record wouldn't.
Beyond treatment, payment, and operations, disclosure generally requires the client's written authorization. A client can direct their record almost anywhere—to a family member, an attorney, a new therapist, a disability insurer. The social worker's job is to make sure the consent is informed: the client should understand what's being released, to whom, for what purpose, and that authorization can be revoked.
Exam questions in this area often test whether a signed release ends the analysis. It doesn't. The minimum necessary principle still applies, and so does clinical judgment about what the release actually covers.
Then there are the disclosures that happen without consent and outside routine operations. These are the exceptions the exam returns to again and again, and they fall into a few families.
Mandated reporting comes first. Suspected abuse or neglect of a child—and in most jurisdictions, of elders and dependent adults—triggers a legal duty to report that overrides confidentiality entirely. The client's permission isn't required and their objection doesn't change the obligation.
Safety comes next. When a client presents a serious threat of harm to an identifiable person, duty-to-protect principles permit or require disclosure to the extent necessary to prevent the harm. The operative phrase is "to the extent necessary." Even in an emergency, the record doesn't open wide; only the relevant information moves.
Legal process is its own category, and the easiest one to get wrong. A subpoena signed by an attorney is not a court order, and it doesn't by itself override privilege. When a subpoena arrives, the measured response—contact the client, assert privilege on their behalf, disclose the minimum necessary if disclosure is ultimately compelled—almost always beats immediate compliance or outright refusal. A judge's order is different. When a court orders release, the social worker complies, though advocating for limited disclosure remains appropriate.
Employers have no right to a client's clinical record, even when they pay for the insurance that covers treatment. HIPAA draws that line deliberately, because employer access invites discrimination. An EAP referral or a fitness-for-duty evaluation may involve limited, defined reporting—but the terms of that reporting should be established, in writing, before services begin, and the client should know them.
Family members follow a rule that's clean on paper and hard in practice: no consent, no disclosure, no matter how worried the caller sounds. The exam favors the worried-family-member scenario precisely because the empathic pull is strong. A social worker can listen to information a family member offers without confirming the client is even in treatment.
Minors add a state-law layer. Parents generally hold the right to access a minor child's records, but exceptions exist—when the minor lawfully consented to their own care, when a court directed the treatment, or when the parent agreed to a confidential treatment relationship. Exam questions usually stay at the principle level: know that parental access is the default and that it isn't absolute.
The client's right to their own record is easy to overlook because it seems obvious, but the NASW Code of Ethics (standard 1.08) and HIPAA both make it explicit: clients are entitled to reasonable access to records concerning them. Access can be limited only in exceptional circumstances, when there's compelling evidence that access would cause serious harm to the client—and both the request and the rationale for limiting it must be documented. Concern that a client might find the record upsetting doesn't meet that bar. When content is sensitive, the better path is offering to review the record together, not withholding it.
A social worker in private practice receives a written request from a client for a complete copy of her record. The record includes candid documentation of the client's early treatment, and the social worker worries some of it may distress her. What should the social worker do FIRST?
A. Provide access to the record and offer to review its contents together
B. Release a summary of the record instead of the full documentation
C. Decline the request and document the clinical rationale
Reasoning it through: the client holds the right of access, and distress alone isn't the "serious harm" standard that permits limiting it. Substituting a summary (B) and declining (C) both withhold something the client is entitled to, without the exceptional circumstances that would justify it. Offering to review the record together honors the right while addressing the clinical concern.
The answer is A.
Access questions reward the same posture across every scenario: know who holds the right, disclose the minimum necessary, and don't let an official-looking document or a worried voice on the phone move you faster than the rules allow. The reliable way to build that instinct is repetition with realistic scenarios—which is what full-length practice tests are for.
Good luck with the exam!
Right now, get SWTP's online practice exams at a reduced price. Just $39. Get additional savings when buying more than one exam at a time-- less than $30 per exam!
Study with either the current or August 2026 exam format.
Keep going till you pass. Extensions are free.
to receive our free study guide and get started!