three students sitting in a circle talking, with two out of focus in the background

School of Social Work

HIPAA Overview for Practicum Students

This overview outlines HIPAA expectations relevant to social work practicum students who may have access to Protected Health Information (PHI) during their practicum experiences. Students must also follow all privacy, confidentiality, and security requirements established by their practicum agency.

1. What Is HIPAA?

The Health Insurance Portability and Accountability Act (HIPAA) is a federal law designed to protect the privacy and security of patient health information. HIPAA applies to health care providers and organizations that create, maintain, transmit, or access Protected Health Information (PHI). Its primary purpose is to protect the confidentiality and security of patient information.

2. What Is Protected Health Information (PHI)?

Protected Health Information (PHI) includes written, verbal, or electronic information related to an individual's health condition, health care services, or payment for health care services that can identify the individual. Examples include names, addresses, dates of birth, medical record numbers, diagnoses, photographs, email addresses, voice recordings, and other identifiable health information.

3. Privacy Rule: Key Expectations for Students

Students must protect the confidentiality of PHI at all times. Important expectations include:

  • Access or use only the information necessary to complete assigned responsibilities
  • Do not discuss patient or client information in public or unsecured settings
  • Keep records and documents secure when not in use
  • Remove documents promptly from printers, copiers, or fax machines
  • Dispose of confidential materials appropriately
  • Do not access records or information unrelated to assigned responsibilities

4. Use and Disclosure of PHI

HIPAA distinguishes between the use of PHI within an organization and the disclosure of PHI outside an organization. Students may access or share PHI only when permitted and necessary for approved purposes and in accordance with agency policies. Other disclosures may require patient authorization.

5. Minimum Necessary Standard

Students should access, use, and disclose only the amount of PHI necessary to complete their assigned responsibilities. When uncertain about what information is appropriate to access or share, students should consult their supervisor or the agency's designated privacy contact.

6. Electronic PHI and Security Expectations

Students must also protect electronic Protected Health Information (ePHI). Expectations may include:

  • Using password-protected devices and systems
  • Never sharing passwords
  • Logging out of systems when not in use
  • Following agency-specific technology and security policies
  • Safeguarding laptops, tablets, phones, USB drives, and other portable devices
  • Avoiding storage of PHI on personal devices unless explicitly authorized

7. Email, Portable Devices, and Remote Access

PHI should be transmitted electronically only through approved and secure methods. Students must follow agency policies regarding email, texting, remote access, portable devices, cloud storage, and other electronic communication or storage systems. Unauthorized transmission or storage of PHI may constitute a privacy or security violation.

8. Breaches and Reporting Responsibilities

Any suspected breach, misuse, unauthorized access, or disclosure of PHI must be reported immediately to the student's supervisor and/or the agency's designated privacy officer or contact. Examples may include lost devices, accidental disclosures, discussing confidential information in public settings, or accessing records without authorization.

9. Student Responsibilities in Practicum

Students are expected to:

  • Follow all HIPAA-related policies and procedures at their practicum site
  • Complete required HIPAA or privacy trainings
  • Maintain confidentiality at all times
  • Seek supervision when uncertain about the appropriate use or disclosure of information
  • Immediately report concerns or possible violations

By participating in practicum activities, students are responsible for protecting patient and client privacy and following applicable HIPAA, confidentiality, and agency requirements.

10. Review and Acknowledgment

Students are required to review this HIPAA Overview before beginning practicum activities involving access to Protected Health Information (PHI).

After reviewing this information, students must acknowledge through the designated practicum form that they have reviewed this webpage and understand their responsibility to protect patient and client privacy, follow applicable HIPAA and confidentiality requirements, and comply with the privacy and security policies of their practicum agency.

Additional Resources

Students should review practicum site-specific HIPAA policies, confidentiality agreements, and required trainings before beginning direct service activities.

Sources and Attribution

Portions of this overview were adapted from HIPAA educational materials developed by the University of Wisconsin-Milwaukee. The School of Social Work appreciates the availability of these materials to support student learning and ethical practice.

Last reviewed: October 2026