LMSW guideContent areas

Confidentiality, Mandated Reporting, and Duty to Warn on the LMSW Exam

When a social worker may, must, or must not share client information on the ASWB Masters exam, with a disclose, don't-disclose, or consult table built on eight original cases.

Short answer

On the Masters exam, confidentiality is the default and its limits are narrow. The NASW Code allows disclosure with valid consent, or without consent when it is necessary to prevent serious, foreseeable, and imminent harm, and then only the least information needed. Mandated reports of suspected abuse or neglect, and any duty to warn or protect, come from state law, which differs from state to state. The exam tests the principle: explain the limits early, assess before you disclose, report when the law requires it, share the minimum, and document.

Where this sits in the Masters outline

Confidentiality appears twice in the Values and Ethics area, the largest of the three at 35%. Competency IA covers the legal and ethical issues of confidentiality and its limits, with HIPAA and protected health information as examples. Competency IB covers mandatory reporting, naming abuse, threats of harm, impaired professionals, and duty to warn, along with documentation. LMSW values and ethics maps the rest of the area. This page covers one decision: share, don't share, or stop and consult.

The rules the exam builds on

The NASW Code of Ethics, standard 1.07, supplies most of the logic. In plain terms:

  • Explain the limits early. Discuss what confidentiality means and where it ends as early as possible in the relationship, and revisit it as needed (1.07(e)).
  • Consent opens the door. Information may be shared with valid consent from the client or a person legally authorized to consent for them (1.07(b)).
  • The exception is narrow. The expectation of confidentiality does not apply when disclosure is necessary to prevent serious, foreseeable, and imminent harm to the client or others. Even then, share the least information needed (1.07(c)).
  • Tell the client first when you can. Before a planned disclosure, whether legally required or consent-based, inform the client about it and its likely consequences where feasible (1.07(d)).
  • Groups and families need ground rules. Seek agreement about each person's confidentiality, and explain that you cannot guarantee every participant will keep it (1.07(f) and (g)).
  • Payers: keep the Code and HIPAA apart. The Code says not to disclose to third-party payers unless the client has authorized it (1.07(h)). HIPAA is a separate layer. It generally permits disclosures for treatment, payment, and health care operations without a HIPAA authorization, but psychotherapy notes generally need one, and state law can add limits. Identify the record and the rule before releasing anything.
  • Court orders can be narrowed. When a court orders disclosure that could harm the client, ask the court to withdraw the order or limit it as narrowly as possible (1.07(j)).
  • Confidentiality outlives the client. Protect the confidentiality of deceased clients too (1.07(w)).
  • Consultation is not a loophole. When consulting colleagues, share only what the consultation needs (2.05(c)).

Two terms are easy to blur. Confidentiality is the professional duty not to share what a client discloses. Privileged communication is a legal protection that can keep that information out of court testimony, and the client generally holds it. State law defines privilege and its exceptions.

HIPAA, minors, and substance use records

HHS guidance on HIPAA and mental health adds three points that show up in Masters stems:

  • Parents of minors are generally the minor's personal representatives under HIPAA, but state law sets the age at which a minor can consent to certain care and may add rules about sharing a minor's information with parents or withholding it.
  • Professional judgment allows a provider to decline to treat someone as a personal representative if doing so would endanger the patient.
  • Substance use disorder treatment records from federally assisted programs carry additional federal confidentiality protections under 42 CFR Part 2.

The HHS guidance also describes circumstances in which mental health information may be disclosed for health and safety purposes. The exam does not expect you to cite regulation numbers. It expects you to recognize that a minor's or a substance use client's information can carry extra rules, and that the social worker checks them rather than assuming.

Mandated reporting: learn the principle, follow your state's law

Who counts as a mandated reporter, what level of suspicion triggers a report, how fast it must be made, and to whom are all set by state law. That includes child abuse and neglect and, in many states, abuse of older or dependent adults. The details differ, so learn the law where you will practice. On the exam, the principle is what gets tested:

  • Suspicion, not proof. The reporter does not investigate or wait for certainty. Gathering enough to recognize a reportable concern is assessment. Investigating is the job of the agency that receives the report.
  • The report is not up for negotiation. A client's request for secrecy does not cancel a legal duty, which is why limits are explained at the start.
  • Keep the client informed when it is safe. Telling a client about a required report, unless that would put someone at risk, protects the relationship.
  • Know whether telling a supervisor is enough. The reporting law that applies decides whether notifying a supervisor is enough, and agency policy cannot replace or narrow that legal duty. Consultation should not delay a required report.
  • Document what was observed, what was reported, to whom, and when.

Duty to warn or protect follows the same pattern. When a client makes a serious threat against an identifiable person, some states require action, others permit it, and the required steps vary. A strong answer assesses the threat promptly and directly, takes protective action under the law and agency protocol when the facts call for it, consults without letting consultation delay that protection, and documents. For impaired colleagues, the Code asks social workers to raise the concern with the colleague when feasible and to use appropriate channels if the colleague does not address it (2.08). Some boards add their own reporting rules.

Disclose, don't disclose, or consult: eight cases

Passy wrote these cases for study, and none comes from ASWB material. The "exam move" column shows the reasoning a Masters item would reward, not legal advice for a real case.

SituationExam moveWhy
A 9-year-old tells the school social worker that an uncle does "secret touching" during weekend visits.Report under state law and school protocol. Do not promise secrecy, question the child in depth, or contact the uncle.The disclosure gives reason to suspect abuse, which is what reporting laws act on. Proof is not required, and investigation belongs to the receiving agency.
An adult client's employer calls to ask whether the client is attending sessions.Don't disclose. Neither confirm nor deny treatment without written consent.No consent and no exception applies. Even the fact of treatment is confidential.
A 15-year-old in school-based counseling asks the social worker not to tell her parents she has been sad and failing two classes. She reports no thoughts of harm.Check which records and consent rules apply before responding. Explain the real limits of confidentiality, encourage her to involve her parents, and offer to help her do it.She reports no imminent risk, but that alone does not settle what her parents may see. School records can fall under FERPA, which gives parents a right to inspect their child's education records. Other services may fall under HIPAA and state minor-consent law.
A client says, "Everyone would be better off without me."Assess first. Ask directly about suicidal thoughts, plan, means, and intent before deciding anything about disclosure.The statement is a warning sign. The response depends on what the assessment shows.
A client names a coworker, says he has a gun in his car, and plans to confront the coworker after Monday's shift.Disclose as needed for protection, following state law and agency protocol. Consult, share the minimum, inform the client when safe, and document.These facts call for urgent threat assessment and protective action. Whether a legal duty to warn or protect applies, and what it requires, depends on state law and the fuller facts, not on a universal checklist.
An insurer requests full session notes for a claim review.Check what is being requested and what permits its release, then share no more than the purpose requires.The Code asks for client authorization before payer disclosures (1.07(h)). HIPAA generally permits payment disclosures without a separate authorization, but psychotherapy notes generally need one, and state law can add limits. Ethics and law are separate checks.
The social worker receives a subpoena for a client's records.Consult a supervisor or agency counsel and contact the client. Do not release records automatically. If a court orders disclosure, ask that the order be limited.Privilege belongs to the client, state rules on subpoenas vary, and the Code asks for the narrowest disclosure (1.07(j)).
The adult son of a client who recently died asks to read his mother's case file.Consult and verify authority. Release only to someone with legal authority under state law and agency policy.Confidentiality continues after death (1.07(w)).

Notice how often the right move is to assess or verify before acting. A stem that hands you a specific plan, a named target, or a child's disclosure is pointing at action. A stem that gives you worry without those facts is usually pointing at assessment.

How to practice this area

Make a two-column sheet: "the fact that would make me disclose" and "the fact that keeps it confidential." Fill it from every confidentiality item you miss. The free mixed LMSW set includes a school confidentiality request and a child's abuse disclosure, so start your disclose-or-keep sheet with the free LMSW set and add to it from your other practice. When a case turns on risk, risk assessment has the sequence. When two principles seem equally right, ethics vs safety priorities shows how the threshold decides. Boundary questions, such as a client who wants to connect on social media, are in boundaries and dual relationships.

Treat the table as exam preparation. In practice, follow the law of the state where you are licensed and your agency's policy, and get supervision or legal consultation for a real case.

Trust the source

Official sources

Exam policies can change. Use these primary sources for the most current details.