A nurse manager is reviewing situations from the past week to identify potential HIPAA Privacy Rule violations on the unit. Which situations represent HIPAA violations that require reporting to the privacy officer? Select all that apply.
Select All That Apply
Choose your responses, then check the answer.
Explanation
Posting an identifiable client image on personal social media is a HIPAA violation; cropping the face alone does not reliably de-identify an image because scars, tattoos, dressings, background details, or metadata may identify the client (Choice 2). Accessing a client's record without a treatment, payment, or health care operations purpose—including out of curiosity even if the information is not shared—is an impermissible access or snooping violation (Choice 4). HIPAA permits relevant PHI sharing for treatment among assigned care-team members using reasonable safeguards (Choices 3, 5, and 6). A disclosure to a public health authority that is required by state law is permitted under HIPAA (Choice 1).
HIPAA Permitted vs Prohibited Permitted: treatment, payment, healthcare operations (TPO), mandatory public health reporting, court order. Prohibited: social media posts, snooping records out of curiosity, sharing in elevators/cafeterias, using PHI for personal purposes.
"Need to Know" Standard Access only the minimum necessary information for your specific role. Even formal staff cannot browse records without a care relationship.
Memory Tip "CAMP": Curiosity = violation, Authorization required for non-TPO, Minimum necessary, Photos require consent.
Caution Cropping the face does NOT de-identify a client. Wound location, tattoos, room background, time stamps can all re-identify.
ScenarioNurse manager weekly review of unit incidents and near-misses for HIPAA Privacy Rule compliance. New graduates rotating through, social media use rising, celebrity recently admitted to the unit.
Common Violations Identified- Photos posted online (even cropped)- Curiosity-based record access (snooping)- Conversations in public elevators- Leaving computer unlocked with PHI visible- Faxing PHI to wrong number without callback verification
Required Action1. Report to privacy officer within 24 hours2. Document the breach and persons involved3. Re-education and corrective action4. Possible breach notification to client and OCR if PHI compromised
HIPAA Privacy Rule — US federal law (1996, updated by HITECH 2009) protecting individually identifiable health information (PHI). Permits disclosure for treatment, payment, healthcare operations, and required public health reporting. All other disclosures require client authorization.
Minimum necessary standard — Workforce members must access only the PHI strictly required to perform their job. A nurse caring for a patient may view that chart; the same nurse may not view records of unrelated patients on other units, regardless of whether the information is shared.
Permitted public health disclosures — HIPAA explicitly allows disclosure without client authorization to public health authorities for: communicable diseases (TB, HIV in many states), abuse/neglect/domestic violence, FDA adverse events, vital statistics, and worker injury surveillance.