A client with newly diagnosed metastatic colon cancer is adm… | MyMerci
MyMerci — full questions and rationale, freeStart for free
Assignment/Delegation/SupervisionMOC
Question
A client with newly diagnosed metastatic colon cancer is admitted to a medical-surgical unit. Outside the closed door of the room, an adult who identifies himself as the brother stops the nurse and asks for the diagnosis and prognosis. The client has not designated this brother as a representative, and the chart contains no documentation of consent. Which nursing response is most appropriate?
1Explain that HIPAA prohibits sharing information without the client’s consent, decline to provide any details, and instruct the brother to contact the attending physician for further discussion.
2Defer disclosure, verify the wishes of the client directly, and — if the client agrees — arrange a family conference with the care team to discuss the diagnosis and prognosis together.✓ Correct answer
3Inform the brother that the client has metastatic colon cancer with a limited life expectancy, and suggest he keep this confidential within the family until the client is ready to discuss it.
4Give the brother a brief overview of the diagnosis and the expected disease trajectory, because sharing information with close family supports their ability to make necessary arrangements.
Explanation
The HIPAA Privacy Rule requires the patient written or documented oral authorization before protected health information (PHI) is disclosed to family members or others outside the care team. The proper response is to verify the wishes of the client first and then arrange a family conference if the client consents. Option 3 discloses PHI without authorization and is a HIPAA breach; asking the brother to keep the information private does not justify the breach. Option 1 is dismissive, misrepresents HIPAA (the rule allows disclosure with consent — the correct step is to seek consent, not to deflect), and ignores a legitimate family concern. Option 4 also discloses PHI without authorization, and framing the breach as helping the family prepare does not make it permissible.
Clinical Judgment Apply NCJMM: Recognize cues (third-party request for PHI; no documented consent; client has capacity) → Analyze cues (HIPAA Privacy Rule prohibits disclosure without authorization; family concern is genuine but does not override consent) → Generate solutions (verify wishes of the client → arrange a family conference if the client agrees) → Take action (defer disclosure, seek consent, facilitate communication) → Evaluate outcomes (privacy preserved, family supported, communication legitimized).
Memory Tip Consent first, conference second. Information is not shared with family without explicit patient permission. HIPAA = patient gives permission, not the family. If the client lacks capacity or is a minor, the designated healthcare proxy or next of kin (per state law) applies.
KR vs US Korean medical culture is family-centered, and clinicians often explain the diagnosis and prognosis directly to the family. The US HIPAA Privacy Rule prohibits disclosing PHI to family without the patient consent. The NCLEX answer is always to verify patient consent first. When the client lacks capacity, the healthcare proxy or surrogate hierarchy is followed.
Clinical scenario
Clinical Practice Guide HIPAA Privacy Rule (45 CFR Part 164): PHI disclosure to family or others requires written or documented oral authorization from the patient. Exceptions: treatment, payment, and operations (TPO); and certain emergencies in which the patient lacks capacity, where disclosure may occur in the patient best interest. Direct verification with the patient remains the standard.
Caution Korean family-centered culture vs. the US patient-autonomy standard. NCLEX always prioritizes verification with the patient. Even when the family insists, no disclosure occurs without consent. Once consent is obtained, a formal family conference with the care team is the appropriate communication channel.
Key concepts
HIPAA Privacy Rule — A federal regulation (45 CFR Part 164) that protects individually identifiable health information (PHI). Disclosure to family or others outside the care team requires written or documented oral authorization from the patient, with limited exceptions for treatment/payment/operations (TPO) or qualifying emergencies.
Protected Health Information (PHI) — Any individually identifiable health information held or transmitted by a covered entity, including diagnosis, treatment, prognosis, and any data that could identify the patient. The same disclosure rules apply regardless of format (verbal, paper, or electronic).
Healthcare proxy / Surrogate decision-maker — A person legally designated by the patient (in an advance directive or power of attorney) to receive PHI and make decisions when the patient lacks capacity. Without a designated proxy, the next-of-kin hierarchy and state law apply.