A nurse reviews several scenarios involving client information. Which scenarios represent a HIPAA violation that should be reported? Select all that apply.
Select All That Apply
Choose your responses, then check the answer.
Explanation
HIPAA prohibits disclosure of protected health information (PHI) without authorization or a permitted purpose. Discussing diagnosis with family without permission, snooping on a celebrity record without a treatment role, posting indirect identifiers on social media (location plus date can re-identify), and leaving printed PHI in a public area are all violations. Sharing information with a consulting physician falls under the treatment exception and is permitted.
Clinical Judgment HIPAA permits PHI disclosure only for Treatment, Payment, or Operations (TPO) without explicit authorization. Curiosity, social media posting, and uncontrolled physical PHI (printouts in public areas) are all violations. Indirect identifiers (location + date + diagnosis) can re-identify even without name or face.
Memory Tip HIPAA TPO: Treatment + Payment + Operations OK. Curiosity + Social media + Public PHI = report.
KR vs US HIPAA (US 1996) and Korean Personal Information Protection Act + Medical Service Act article 21 align: PHI access only for legitimate care purposes; unauthorized access by curiosity is a reportable violation in both.
Clinical Practice GuideHIPAA Privacy Rule key concepts:- Minimum necessary: share only the PHI needed for the task- Permitted disclosures: Treatment, Payment, Operations (TPO) without authorization- Required authorization: marketing, research, family of competent adult- Indirect identifiers: 18 HIPAA identifiers including dates, geographic detail, photos, device IDs
Reporting:- Internal: report to facility privacy officer immediately- External: HHS Office for Civil Rights (OCR) for breaches affecting 500+- Penalties: $100 to $50,000 per violation, plus criminal liability for willful neglect
CautionEven well-intentioned disclosure (telling a worried spouse) violates HIPAA without explicit client authorization. Always default to no disclosure; check authorization on the chart and get the client OK before discussing care with anyone outside the treatment team.
HIPAA — Health Insurance Portability and Accountability Act 1996. Establishes privacy rule (PHI protection), security rule (electronic PHI), and breach notification rule. Applies to covered entities (providers, plans, clearinghouses) and business associates.
PHI (Protected Health Information) — Any individually identifiable health information held or transmitted by a covered entity. Includes 18 identifiers: name, address, dates, phone, SSN, email, medical record number, photographs, device IDs, biometrics. De-identification requires removal of all 18.
Minimum necessary standard — HIPAA principle that PHI disclosure should be limited to the smallest amount needed to accomplish the intended purpose. Applies to internal use, external disclosures, and access. Treatment exception allows fuller disclosure for direct care.