This lesson closes Domain 4 with its fourth and final sub-competency: the legal obligations around client data. NBHWC's outline names five specific practices — documented consent, data security, secure platforms, recognizing secure vs. non-secure sites, and keeping client data out of generative AI tools — plus a general duty to adhere to relevant laws and regulations. That last piece includes HIPAA, but not the way most people assume: HIPAA doesn't automatically cover every independent coach, and this lesson is precise about exactly when it does.
Lesson 12 covered three of Domain 4's four sub-competencies: ongoing professional development, scope of practice, and the Code of Ethics. This lesson finishes the domain with the piece that's easiest to get wrong by assumption — the legal side of handling client data. NBHWC's outline is specific here in a way the rest of Domain 4 wasn't: it names documented consent, data security, and generative AI directly, rather than leaving them as general principles.
Maintaining Confidentiality of Client Data
NBHWC's outline names five specific practices under maintaining confidentiality of data. Together they cover the full lifecycle of a client's information — how it's collected, where it's stored, and where it must never end up.
- Documented consentCapturing a client's agreement to how their data is collected and used, in writing rather than left as a verbal understanding.
- Data securityActively protecting stored and transmitted client data, not just assuming it's safe by default.
- Privacy, confidentiality & secure platformsChoosing tools and platforms built to keep client information private and confidential.
- Secure vs. non-secure sitesRecognizing the difference between a protected platform and an open or unprotected one before client data touches it.
- Keeping client data out of generative AINever entering a client's identifying or health information into a generative AI tool.
Documented Consent, Not Assumed Consent
Lesson 3 covered the coaching agreement and intake process that opens a new client relationship. This is where that same paperwork earns its legal weight: a client's consent to how their data is collected, stored, and potentially shared needs to be documented as part of that intake — not left as something the coach assumes because the client showed up and started talking.
A verbal "that's fine" in a first conversation isn't the same thing. It leaves no record of exactly what the client agreed to, which matters the moment a question comes up later about what a coach was and wasn't authorized to do with what a client shared.
A new client mentions offhand that she's fine with the coach "keeping notes." Rather than treating that as sufficient, the coach walks her through the intake form's data section directly: what's recorded, how long it's kept, and that it's never shared without her separate written permission. She signs it. Months later, if a question ever comes up about what she agreed to, there's an actual record — not just a memory of a conversation.
Choosing Secure Platforms Over Non-Secure Ones
NBHWC's outline pairs data security with recognizing secure vs. non-secure sites — the practical judgment call a coach makes every time they pick a tool to store notes, send a message, or share a document with a client.
| Signals of a Secure Platform | Signals of a Non-Secure Platform |
|---|---|
| Encrypts data in transit and at rest. | Sends client details over plain, unencrypted email. |
| Uses access controls and unique logins per user. | Relies on a single shared login everyone uses. |
| Keeps an audit log of who accessed what, and when. | Stores files on a public link anyone with the URL can open. |
None of this requires a coach to become a security expert. It requires choosing tools that were actually built to hold sensitive information, over the free or convenient option that happens to be sitting open in another tab.
Keeping Client Data Out of Generative AI
NBHWC's outline names this as its own specific practice, separate from everything above: client data should never be entered into a generative AI tool. This is a different question from the one Lesson 12 covered. Lesson 12's Code of Ethics item was about disclosure — telling a client when AI helped produce something for them. This is about input — never putting the client's own identifying or health information into an AI tool in the first place, disclosed or not.
A coach can use an AI tool the way Lesson 12's worked example did, to help draft a generic starting point, without ever typing a specific client's name, health history, or session details into the prompt. The two practices work together: keep client data out, and disclose the tool's use when its output reaches the client.
A coach wants AI's help brainstorming discussion questions for a client working through motivation around a fitness goal. Instead of pasting in the client's name, history, and session notes, the coach describes the situation generically: "a client working on consistency with morning exercise, motivated by energy rather than appearance." The AI tool never sees anything that could identify the actual client, and the resulting ideas still get adapted — and disclosed — before they reach her.
Adhering to Relevant Laws and Regulations
The second half of Domain 4's legal sub-competency is a general duty: adhere to relevant laws and regulations. HIPAA is the name most people reach for here, but NBHWC's outline doesn't say HIPAA applies to every coach automatically — and it doesn't.
HIPAA generally applies to "covered entities" (health plans, clearinghouses, and healthcare providers who bill electronically) and their business associates. An independent coach who takes direct payment and doesn't bill insurance electronically typically falls outside both categories. A coach becomes subject to HIPAA when they work under a healthcare organization as a business associate, when they bill insurance electronically themselves, or when a licensed clinician offering "coaching" can't relabel their way out of the obligations their license already carries.
That said, falling outside HIPAA's direct scope isn't a reason to skip the safeguards above. Other laws — state consumer-health-data statutes and the FTC's rules on health-related apps and services among them — can still apply, and a client's trust doesn't depend on which specific law technically covers a coach. The practical standard is the same either way: documented consent, real data security, and secure platforms, regardless of whether HIPAA itself is the law doing the requiring.
Domain 4 Complete — Domain 5 Begins in Lesson 14
This lesson completes Domain 4: Ethics and Professional Practice, across two lessons and all four sub-competencies — ongoing professional development, scope of practice, the Code of Ethics, and now the legal obligations around client data. Lesson 14 opens Domain 5: Health and Wellness, starting with NBHWC's whole-person model and the eight dimensions of wellness that make it up.
8 questions on documented consent, secure vs. non-secure platforms, keeping client data out of generative AI, and where HIPAA actually applies to independent coaches. NBHWC doesn't publish a fixed pass/fail line for its own exam, so this knowledge check doesn't invent one either — you'll get a raw score and a rationale for every question instead.
- NBHWC's outline names five confidentiality practices: documented consent, data security, secure platforms, recognizing secure vs. non-secure sites, and keeping client data out of generative AI.
- Documented consent, captured as part of the same intake process Lesson 3 covered, replaces a verbal assumption with an actual record of what a client agreed to.
- A secure platform protects data with encryption, access controls, and audit logging — a non-secure one exposes it on open or unprotected channels.
- Keeping client data out of generative AI is distinct from Lesson 12's disclosure requirement — one is about input, the other about telling the client afterward.
- HIPAA generally applies only to covered entities and their business associates, not automatically to every independent coach — though the same safeguards are worth keeping regardless.
- This lesson completes Domain 4. Domain 5 begins in Lesson 14 with NBHWC's whole-person model and the eight dimensions of wellness.
Before moving to Lesson 14:
- Check whether your own (or a training program's) intake paperwork documents consent for data handling specifically, not just general coaching terms.
- List the tools you'd use to store or send client information, and note which ones actually offer encryption and access controls.
- If you've ever used an AI tool for coaching-related work, consider whether any real client details made it into the prompt.
- Complete the knowledge check above and review the rationale for any question you missed.