A new RN reviews staff scenarios on the medical-surgical unit. Which scenarios represent a HIPAA violation? Select all that apply.
Select All That Apply
Choose your responses, then check the answer.
Explanation
HIPAA prohibits unauthorized creation, use, transmission, or disclosure of protected health information (PHI). The four violations are: (1) social media post — room number is identifying information about an individual; deidentification requires removing all 18 HIPAA identifiers. (2) Public conversation — discussing a specific patient where others can overhear. (3) Lost unencrypted device — a reportable breach affecting 240 individuals. (5) Sharing a password — undermines authentication, accountability, and the audit trail; the colleague's actions cannot be distinguished from the original nurse's. Choice 3 is permitted because the spouse is on the consented contact list, which the patient herself authorized.
High-yield HIPAA violations on NCLEX cluster around four patterns: (a) social media — even photos that look "deidentified" can leak identity through room signs, wristbands, monitors, family in background, or unique tattoos; (b) verbal disclosure in public spaces — elevators, cafeterias, hallways; (c) electronic safeguard failures — lost unencrypted USB or laptop, screen left open, downloads to personal email; (d) authentication breaches — sharing passwords, allowing others to chart under your login. The Privacy Rule allows incidental disclosures (e.g., name on a chart visible at a nursing station) and disclosures within the consented contact list. The Security Rule mandates encryption, audit trails, and unique authentication. Mandatory reporting of any breach affecting 500+ patients to HHS within 60 days; smaller breaches reported annually. Patients have the right to an accounting of disclosures.
A new RN reviews five staff scenarios on the medical-surgical unit and is asked to identify those that constitute a HIPAA violation.
HIPAA Privacy Rule — Federal regulation governing the use and disclosure of protected health information (PHI). Allows disclosures for treatment, payment, and operations; requires patient authorization for other disclosures; recognizes a consented contact list for family or friend involvement.
HIPAA Security Rule — Requires administrative, physical, and technical safeguards for electronic PHI: encryption of devices and transmissions, unique authentication (no shared passwords), automatic logoff, and audit trails. Lost unencrypted devices are reportable breaches.
Breach Notification Rule — Mandates notification to affected individuals, HHS, and (for breaches affecting 500+ persons) the media within 60 days. Smaller breaches are reported annually. Patients have the right to an accounting of disclosures over the previous 6 years.