A client with newly diagnosed metastatic colon cancer is admitted to a medical-surgical unit. Outside the closed door of the room, an adult who identifies himself as the brother stops the nurse and asks for the diagnosis and prognosis. The client has not designated this brother as a representative, and the chart contains no documentation of consent. Which nursing response is most appropriate?

The HIPAA Privacy Rule requires the patient written or documented oral authorization before protected health information (PHI) is disclosed to family members or others outside the care team. The proper response is to verify the wishes of the client first and then arrange a family conference if the client consents. Option 2 discloses PHI without authorization and is a HIPAA breach; asking the brother to keep the information private does not justify the breach. Option 3 is dismissive, misrepresents HIPAA (the rule allows disclosure with consent — the correct step is to seek consent, not to deflect), and ignores a legitimate family concern. Option 4 also discloses PHI without authorization, and framing the breach as helping the family prepare does not make it permissible.

In-depth explanation

<span class="merci-scenario-label">Clinical Judgment</span><br>Apply NCJMM: Recognize cues (<span class="merci-kw">third-party request for PHI; no documented consent; client has capacity</span>) → Analyze cues (HIPAA Privacy Rule prohibits disclosure without authorization; family concern is genuine but does not override consent) → Generate solutions (verify wishes of the client → arrange a family conference if the client agrees) → Take action (defer disclosure, seek consent, facilitate communication) → Evaluate outcomes (privacy preserved, family supported, communication legitimized).<br><br><span class="merci-scenario-label">Memory Tip</span><br><span class="merci-kw-mark">Consent first, conference second.</span> Information is not shared with family without explicit patient permission. <span class="merci-kw">HIPAA = patient gives permission, not the family.</span> If the client lacks capacity or is a minor, the designated healthcare proxy or next of kin (per state law) applies.<br><br><span class="merci-scenario-label">KR vs US</span><br>Korean medical culture is family-centered, and clinicians often explain the diagnosis and prognosis directly to the family. The US HIPAA Privacy Rule prohibits disclosing PHI to family without the patient consent. The NCLEX answer is always to <span class="merci-kw">verify patient consent first</span>. When the client lacks capacity, the healthcare proxy or surrogate hierarchy is followed.

Clinical scenario

<span class="merci-scenario-label">Clinical Practice Guide</span><br><span class="merci-kw">HIPAA Privacy Rule (45 CFR Part 164)</span>: PHI disclosure to family or others requires written or documented oral authorization from the patient. Exceptions: treatment, payment, and operations (TPO); and certain emergencies in which the patient lacks capacity, where disclosure may occur in the patient best interest. Direct verification with the patient remains the standard.<br><br><span class="merci-scenario-label">Caution</span><br>Korean family-centered culture vs. the US patient-autonomy standard. NCLEX always prioritizes verification with the patient. <span class="merci-kw">Even when the family insists, no disclosure occurs without consent.</span> Once consent is obtained, a formal family conference with the care team is the appropriate communication channel.

Key concepts

• HIPAA Privacy Rule — A federal regulation (45 CFR Part 164) that protects individually identifiable health information (PHI). Disclosure to family or others outside the care team requires written or documented oral authorization from the patient, with limited exceptions for treatment/payment/operations (TPO) or qualifying emergencies.
• Protected Health Information (PHI) — Any individually identifiable health information held or transmitted by a covered entity, including diagnosis, treatment, prognosis, and any data that could identify the patient. The same disclosure rules apply regardless of format (verbal, paper, or electronic).
• Healthcare proxy / Surrogate decision-maker — A person legally designated by the patient (in an advance directive or power of attorney) to receive PHI and make decisions when the patient lacks capacity. Without a designated proxy, the next-of-kin hierarchy and state law apply.