How to Identify HIPAA Protected Health Information: Finding Your Clients’ Sensitive Information Wherever It Goes

Course Materials

How to Identify HIPAA Protected Health Information: Finding Your Clients’ Sensitive Information Wherever It Goes

1 CE Hour. Legal-Ethical CE. Continuing Education for Office Hours (CE for OH) Session Replay.

Developed by Roy Huggins, LPC NCC
Presented by Roy Huggins, LPC NCC; Liath Dalton

A person reading a book with a magnifying glass

HIPAA is all about the privacy and security of our clients’ sensitive information. Even without HIPAA and other similar laws, mental health professionals have ethical duties to keep client information private and secure. Are HIPAA’s rules for maintaining privacy the same as our professional ethics codes? In many ways they are, and in some important ways they are not.

When a client first reaches out to make an appointment, is the information they send you protected under HIPAA? If you use clients’ initials instead of their names in your contact book, is that information still protected under HIPAA? If the answer to either question is yes, what does HIPAA require you to do? We will answer these questions and more in this CE for OH session.

This introductory-level course for counselors, clinical social workers, marriage and family therapists, and clinical and counseling psychologists helps learners make sense of when HIPAA applies and when it doesn’t in the many contexts where mental health clinicians use client information.

1 CE Hour. Continuing Education for Office Hours (CE for OH) Session Replay.

Educational Objectives

  • Determine when information is personally identifying using HIPAA’s list of 18 identifiers
  • Determine when PHI is the responsibility of the learner’s practice under HIPAA
  • Identify when services and software tools may be handling HIPAA protected health information


  1. What, precisely stated, is “Protected Health Information?”
    • PHI as defined under HIPAA
      • Examples of “health information.”
    • “PHI,” the HIPAA concept vs. “Confidential information,” the professional ethical concept
      • Precision in definition
      • Boundaries of scope
  2. How does HIPAA determine what is “personally identifying” and what is not?
    • HIPAA’s 18 identifiers
    • Applying the identifiers to information typically found in mental health practices
  3. When does “personally identifying health information” become my practice’s PHI, and by extension my/our responsibility under HIPAA?
    • “Scope” in security and privacy regulations
    • The scope of HIPAA’s various rules
    • Concrete examples of the likely edges of HIPAA PHI in mental health practices
  4. How do I know when PHI is being handled by my devices, service professionals, and cloud services?
    • Following information flow
    • Which identifiers to look for based on where you’re looking
      • Identifiers on smartphones
      • Identifiers on cloud services in general
      • Identifiers on email and texting services
      • Identifiers and service professionals

Course Developer/Primary Presenter

Roy Huggins, LPC NCCRoy Huggins, LPC NCC, is a counselor in private practice who also directs Person-Centered Tech. Roy worked as a professional Web developer for 7 years before changing paths, and makes it his mission to grow clinicians’ understanding of the Internet and other electronic communications mediums for the future of our practices and our professions.

Roy is an adjunct instructor at the Portland State University Counseling program where he teaches Ethics, and is a member of the Zur Institute advisory board. He has acted as a subject matter expert on HIPAA, security and clinical use of technology for Counseling licensure boards and both state and national mental health professional organizations. He has co-authored or authored 2 book chapters, and he routinely consults with mental health colleagues on ethical and practical issues surrounding tech in clinical practice. He served for 5 years on the board of the Oregon Mental Health Counselors Association and then the Oregon Counseling Association as the Technology Committee Chair.

He really likes this stuff.

Course Co-Presenters

Liath Dalton is a Ph.D candidate in Religious Studies. She began her academic career at Reed College and continued her graduate work at the University of Cape Town.

Liath is the Deputy Director for Person Centered Tech and runs our HIPAApropriateness review program. Through her combination of experience evaluating products for their utility and security in regards to how they can meet risk management needs and providing guidance to members around what product options will best meet their specific practice needs, Liath has an intimate knowledge of both what the practice tech needs are for mental health professionals and what it takes for a product to meet those needs.

Program Notices

Accuracy, Utility, and Risks Statement:The contents of this program are based on publications and reports from the federal Department of Health and Human Services; consultation with experts on HIPAA Security standards and their implementation; and personal study from the program developers. Some interpretation and analysis presented is made by the presenter, in consultation with knowledgeable colleagues and expert consultants. Statements about applications to technology are according to presenter’s understanding of the technology at the time of the program. The presenter may not know how to apply all principles discussed to every technology type or product. This program discusses strategies for complying with HIPAA and covered ethics codes. It may not include information on all applicable state laws. Misapplication of the materials, or errors in the materials, could result in security problems, data breaches, or non-compliance with applicable laws or ethics codes.

Conflicts of Interest: None.

Commercial Support: This program has no commercial support.

All events for this program will be subject to our cancellation/refund policy and complaint policy.

Photo by João Silas on Unsplash

ACEP LogoPerson Centered Tech, LLC is approved by the American Psychological Association to sponsor continuing education for psychologists. Person Centered Tech, LLC maintains responsibility for this program and its content.

ACEP LogoPerson-Centered Tech, LLC has been approved by NBCC as an Approved Continuing Education Provider, ACEP No. 6582. Programs that do not qualify for NBCC credit are clearly identified. Person-Centered Tech, LLC is solely responsible for all aspects of the programs.

State Approvals

Pre-approved by the Texas Social Work Board (#6357) and Texas Counseling Board (#1883)

Ohio CSWMFT Pre-Approved Provider #: RCST071601

Person-Centered Tech, LLC is recognized by the New York State Education Department's State Board for Social Work as an approved provider of continuing education for licensed social workers #SW-0540.