16.2 FLSA, HIPAA, FERPA, and NCMW

ACE Certified Personal Trainer ACE-CPT

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current Exam Facts 1.2 Blueprint, Scoring, and Score Reports 1.3 ACE IFT Model and Mover Method

2 Client Intake and Communication

2.1 Rapport and Intake Interviews 2.2 Communication Across Age, Culture, and Ability 2.3 Dietary Evaluation and Eating Patterns

3 Health Screening and Risk Stratification

3.1 PAR-Q+ and ACSM Preparticipation Screening 3.2 Medical Clearance, Contraindications, and Referrals 3.3 Cardiovascular and Chronic-Disease Risk Factors

4 Medications and Special-Population Intake

4.1 Medications and Exercise Response 4.2 Youth, Older-Adult, and Prenatal Intake 4.3 Low-Back, Diabetes, and Cancer Intake Flags

5 Behavior Change and Goal Setting

5.1 Transtheoretical Model and Health Belief Model 5.2 Motivational Interviewing and OARS 5.3 SMART Goals and the GROW Model

6 Movement Science and Baseline Assessments

6.1 Anatomy, Muscle Roles, and Physical Laws 6.2 Mobility, Stability, and the Five Movement Patterns 6.3 Static Posture and Joint Mobility Assessment 6.4 Movement Screens, Interpretation, and Referral 6.5 Assessment Sequencing, Resting Measures, and Cardiorespiratory Tests 6.6 Muscular and Flexibility Tests, Termination, and Reporting

7 From Data to Personalized Programs

7.1 Integrating Interviews and Assessments into Goals 7.2 Nutrition and Weight-Management Guidelines 7.3 Social Determinants and Personal Adherence Factors

8 Training Principles and Program Variables

8.1 Overload, Specificity, and Progression 8.2 Recovery, Reversibility, and Diminishing Returns 8.3 FITT-VP Variables and Adult Activity Targets 8.4 Resistance Guidelines, Governing Organizations, and Worked Doses 8.5 Acute Responses During a Session 8.6 Chronic Adaptations, Plateaus, and Overreaching

9 ACE IFT Cardio and Muscular Programming

9.1 Cardiorespiratory Phases and VT1/VT2 9.2 Functional, Movement, and Load/Speed Training 9.3 Flexibility, Warm-Up, Cool-Down, and Recovery 9.4 Skill-Related Fitness Components

10 Exercise and Equipment Selection

10.1 Equipment as a Stability Menu and IFT Phase Match 10.2 Environment, Session Sequence, and a Worked Session 10.3 Force, Momentum, Levers, and Moment Arms 10.4 Joint-by-Joint Force, Chain Type, and Kinetic-Chain Leaks 10.5 Five Complexity Levers and Pattern Ladders 10.6 Home and Virtual Regressions and Worked Decisions

11 Instruction and Session Implementation

11.1 Verbal, Visual, and Kinesthetic Cueing 11.2 Intensity Monitoring and Breathing 11.3 Teaching Across Environments and Technology

12 Adherence and Coaching

12.1 Adherence Factors and the Four Sources of Self-Efficacy 12.2 TTM in Practice, Inclusive Gym Floors, and Rapport 12.3 DISC as a Communication Preference 12.4 Decisional Balance, Strengths, and Body Knowledge 12.5 Credible Nutrition Resources and Common Diets 12.6 Supplement Literacy and Staying Inside Scope

13 Lapses, Reassessment, and Overtraining

13.1 Lapse, Relapse, and Naming Barriers 13.2 If-Then Plans, Variable Adjustments, and Referral 13.3 Reassessment and Program Evaluation 13.4 Overtraining Signs and Exercise Termination

14 Progressions, Periodization, and Context Modifications

14.1 Progression and Regression Guidelines by Component 14.2 Skill Progression, Periodization, and Deloads 14.3 Postural and Muscle-Imbalance Modifications 14.4 Virtual, In-Home, In-Club, and Public-Space Modifications

15 Special Populations and Chronic Conditions

15.1 Youth Program Modifications 15.2 Older-Adult Program Modifications 15.3 Prenatal and Postpartum Programming 15.4 CVD, Hypertension, Diabetes, Obesity, and Arthritis

16 Risk Management and Session Safety

16.1 Standards of Care, CDC, ACSM, and OSHA 16.2 FLSA, HIPAA, FERPA, and NCMW 16.3 Emergency Action Plans, CPR/AED, and First Aid 16.4 Injury Prevention, Spotting, and Environmental Extremes

17 Liability, Documentation, and Privacy

17.1 Negligence Elements, Commission, and Omission 17.2 The Risk-Management Protocol and Four Risk Approaches 17.3 Informed Consent, Waivers, and SOAP Notes 17.4 Incident Reports, Privacy, and the Client File

18 Ethics, Scope, and Ethical Business

18.1 Scope of Practice and ACE Code of Ethics 18.2 Evidence-Based Practice, CECs, and Cultural Competence 18.3 Allied Healthcare Continuum and Client Decision Models 18.4 Business Plans, Legal Documents, and Professional Growth

16.2 FLSA, HIPAA, FERPA, and NCMW

Key Takeaways Explain This Topic AI

FLSA conceptually separates employees, who are covered by wage-and-hour rules including overtime for non-exempt staff, from independent contractors — the substance of the relationship governs, not the label on the contract.

HIPAA applies when you are a covered entity or a business associate handling protected health information, such as a hospital or clinic trainer.

A cash-pay gym trainer still owes a professional confidentiality duty and secure storage even when HIPAA does not attach.

FERPA protects student education records in schools that receive U.S. Department of Education funds, which changes documentation for minors trained in a school setting.

NCMW resources frame mental wellbeing as a referral pathway; recognizing a concern and routing it is inside scope, treating it is not.

Last updated: August 2026

16.2 FLSA, HIPAA, FERPA, and NCMW

Quick Answer: FLSA conceptually separates employees from independent contractors — do not self-diagnose your legal status. HIPAA attaches when you are a covered entity or business associate handling protected health information; a cash-pay gym trainer still owes confidentiality even when HIPAA does not attach. FERPA protects student education records in funded schools. NCMW frames mental wellbeing as a referral , not a treatment plan.

Hygiene, standard of care, and facility hazards cover the room. The remaining Knowledge 1 sources cover the paperwork and the people: how you are employed, who is allowed to see a client's health information, what changes when the client is a minor in a school, and where a mental-health conversation stops being yours.

FLSA: Employee Versus Contractor, Conceptually

The Fair Labor Standards Act is federal wage-and-hour law. Employees who are not exempt generally must receive at least the applicable minimum wage and overtime (typically one-and-one-half times the regular rate after 40 hours in a workweek, unless a narrower exception applies). Independent contractors are not covered by those FLSA wage-and-hour rules in the same way. Classification is a legal and factual question. The U.S. Department of Labor looks at the economic reality of the relationship — how much control the business has over the work, whether the worker can make a profit or take a loss, investment in equipment, permanence, skill, and how integral the work is to the business. A signed “contractor” form does not settle it if the club sets your rate, writes your floor schedule, forbids outside clients, and treats you like staff.

This paragraph is not legal advice and is not a classification opinion. Exam items test whether you recognize the issue : a trainer who looks like an employee may trigger wage-and-hour duties, including overtime. A trainer who truly runs an independent practice may not. You do not diagnose FLSA status on the gym floor. You take the question to the facility, an employment attorney, or a qualified accountant. Misclassification is a business-risk problem, not a programming cue.

HIPAA: Only When You Are in the PHI Pipeline

HIPAA’s Privacy and Security Rules apply to covered entities — health plans, health-care clearinghouses, and health-care providers who transmit health information electronically in connection with standard transactions such as claims — and to their business associates . Protected health information (PHI) is individually identifiable health information held in that system.

A cash-pay trainer in a commercial gym who collects a PAR-Q+ and a health-history form for program design is often not a HIPAA covered entity. A trainer employed by a hospital wellness clinic, a physical-therapy practice, a cardiac-rehab department, or a physician group, or a trainer who is a business associate of one of those entities, can be inside HIPAA. Electronic clinic billing, shared electronic health records, and clinic-issued laptops are the giveaways.

Exam traps at both extremes fail:

“HIPAA never applies to personal trainers” — false when you are in a covered clinic.

“Every trainer is a covered entity because we ask about medications” — false for a typical independent gym practice.

Even when HIPAA does not attach, professional confidentiality still does . You do not post the client’s A1C, discuss their depression in the smoothie line, or forward a form video to a group chat. Chapter 17 will unpack storage, incident reports, and consent documents. Here the rule is: know whether HIPAA is in the room, and behave as if the information is private either way.

FERPA: Minors and Students in a School

The Family Educational Rights and Privacy Act protects education records of students in schools and colleges that receive U.S. Department of Education funds. If you train minors or student-athletes through a school — after-school strength, a college recreation contract, a PE pull-out — notes that live in the school file, injury reports the athletic trainer shares with you, and identifying student data are FERPA-flavored. Do not text a student’s medical restrictions to an unauthorized parent, booster, or college recruiter. Parents generally hold FERPA rights until the student turns 18 or attends a postsecondary institution; after that, the student holds them.

A private living-room session with a 15-year-old whose parent hired you is not automatically FERPA just because the client is a minor. It is still a consent, confidentiality, and guardian-communication problem. FERPA is the school-records statute. Do not use it as a synonym for “kids.”

NCMW: Mental Wellbeing Is a Referral, Not a Treatment Plan

The National Council for Mental Wellbeing is named in the outline because trainers meet distress long before they meet a barbell. NCMW administers Mental Health First Aid , an early-intervention training that teaches you to recognize a mental-health or substance-use challenge, listen, and encourage professional help . It is first aid, not psychotherapy and not a diagnosis.

Your scope move:

Notice the flag (hopeless talk, panic on the floor, restricting that looks like an eating-disorder pattern, intoxication, talk of self-harm).

Stay human. Do not interrogate for a DSM label.

Refer to a licensed mental-health professional . Offer NCMW/Mental Health First Aid resources and the 988 Suicide & Crisis Lifeline as public doors, not as your treatment plan.

If there is imminent risk of harm, activate emergency services. That is crisis management (section 16.3), not a coaching conversation.

You do not write a “depression program,” adjust a psychiatric medication, or promise to be the client’s only support person. NCMW exists on the outline so you have a named referral frame instead of improvising clinical care.

Same Sources, Five Rooms

Task 1 is setting-specific. HIPAA is more likely in a clinic than in a park. FERPA is a school problem. OSHA is a worksite problem. CDC hygiene and ACSM standard of care travel with you. NCMW referral travels with you. FLSA follows the employment relationship, not the squat rack.

Worked clinic. You are employed by a hospital-based wellness center. Client files live in the health system’s electronic record and billing runs electronically. HIPAA is in the room. You do not screenshot the problem list onto a personal phone.

Worked school. You contract with a public high school. The athletic trainer emails you a student’s clearance note. That note is an education record. FERPA limits who else sees it.

Worked park. Cash-pay adult, no clinic, no school. HIPAA and FERPA probably do not attach. ACSM heat rules, CDC hygiene, confidentiality, and a virtual-ready emergency plan still do.

When in Doubt

Do not crowd-source a legal theory on the trainer group chat. Read the facility policy . If the policy and a statute appear to conflict, or if you cannot tell whether you are an employee, a covered entity, or a school official, stop improvising and send the question to the facility risk manager or to legal counsel . The professional answer on the exam is the same as the professional answer on Tuesday: follow the written rule you have, hold the session if safety is unclear, and get a qualified opinion before you invent a third path.

• Exam Traps
• Treating ACSM as optional because it is “only a guideline.”

Claiming HIPAA covers every gym conversation, or that it covers none.

Using FERPA as a synonym for “anyone under 18.”

Diagnosing FLSA status from a contractor signature alone.

Ignoring an OSHA-style floor hazard because “I am a contractor, not staff.”

Treating NCMW as a license to counsel mental illness.

Skipping CDC hygiene because the client “doesn’t look sick.”

Inventing a legal interpretation instead of using facility policy and counsel .