💓 Savvy NurseOpen the app

📋 Management of Care · Lesson 2 of 7 · 5 min

HIPAA in the Elevator, the Hallway and the Group Chat

📱 A friend texts: 'Is my uncle on your unit? Just tell me if he's okay.' You know the answer. You also know the answer that keeps your license.

💡 Key idea

Share only with those caring for the client and only what they need. Confirm nothing to outsiders. Report what the law requires, and nothing else.

🧠 Why it matters

Protected health information may be shared only with people DIRECTLY INVOLVED in the client's care and only as much as they need to know. That excludes staff not caring for the client, visitors, the media and curious coworkers. Never confirm or deny to a caller that someone is admitted without the client's permission. Discussions happen in private, not in elevators, hallways or cafeterias. Computer screens are locked when you walk away, printed material is shredded, and nothing identifiable goes on social media, even without a name, because details can identify a person. Clients have the right to see their own records and to ask that corrections be added. Exceptions where disclosure is required by law include reporting suspected abuse of children, elders and vulnerable adults, certain communicable diseases, and gunshot wounds.

🏥 In the real world

☕ Two nurses debrief about a difficult delivery in the cafeteria. At the next table sits the client's sister. Nothing was said that was false. Everything said was a breach. Confidentiality does not require intent to harm, only an audience that should not have heard.

📌 Takeaways

  • Need-to-know, care-team only
  • Never confirm a client's presence to outsiders without permission
  • Mandatory reporting of abuse and certain diseases is a legal exception

✅ Test yourself

A police officer calls the unit and asks whether a named client was admitted after a car crash. What should the nurse do?
  1. Decline to confirm or deny; follow facility policy
  2. Provide the client's room number
  3. Tell the officer to call back later
  4. Confirm the admission because police have authority

Answer: A · Decline to confirm or deny; follow facility policy

Without client authorization or a valid legal process, the nurse neither confirms nor denies. Facilities have procedures for legitimate law-enforcement requests.

Which situation is a breach of confidentiality?
  1. Telling the dietitian about a client's new diabetes diagnosis
  2. Discussing care with the client's health care proxy
  3. Giving report to the oncoming nurse
  4. Posting 'rough night, lost a 40-year-old mom of three' on social media

Answer: D · Posting 'rough night, lost a 40-year-old mom of three' on social media

Details without a name can still identify a person. The care team members in the other options are directly involved in care.

A nurse suspects an older adult client is being physically abused by a caregiver. What is the nurse legally required to do?
  1. Confront the caregiver first and ask for an explanation
  2. Report the suspicion to adult protective services
  3. Wait for clear proof of injury before reporting anything
  4. Keep it confidential because HIPAA protects the client's information

Answer: B · Report the suspicion to adult protective services

Nurses are mandatory reporters; reasonable suspicion is enough and is a legal exception to confidentiality.

Start this lesson free →

NCLEX-style questions, XP and streaks in the app. No sign-up needed.

More in Management of Care

🔗 Related lessons