# A nurse reviews several scenarios involving client information. Which scenarios represent a HIPAA violation that should be reported? Select all that apply.

> source: MyMerci (mymerci.kr)  
> url: https://mymerci.kr/pages/nclex_q.php?qn_id=363986&lang=en  
> language: en  
> subject: Confidentiality/Information Security  
> category: MOC

## Question

A nurse reviews several scenarios involving client information. Which scenarios represent a HIPAA violation that should be reported? Select all that apply.

1

Discussing a client diagnosis with the spouse without client permission

2

Leaving a printed handoff report in the public break room overnight

3

Posting a clinical photo to social media with no name or face but with the unit location and admission date

4

Sharing client clinical information with a consulting physician who has been called in on the case

5

Accessing the electronic medical record of a celebrity admitted to the unit out of curiosity

## Explanation

HIPAA prohibits disclosure of protected health information (PHI) without authorization or a permitted purpose. Discussing diagnosis with family without permission, snooping on a celebrity record without a treatment role, posting indirect identifiers on social media (location plus date can re-identify), and leaving printed PHI in a public area are all violations. Sharing information with a consulting physician falls under the treatment exception and is permitted.

## In-depth explanation

Clinical Judgment
HIPAA permits PHI disclosure only for Treatment, Payment, or Operations (TPO) without explicit authorization. Curiosity, social media posting, and uncontrolled physical PHI (printouts in public areas) are all violations. Indirect identifiers (location + date + diagnosis) can re-identify even without name or face.

Memory Tip
HIPAA TPO: Treatment + Payment + Operations OK. Curiosity + Social media + Public PHI = report.

KR vs US
HIPAA (US 1996) and Korean Personal Information Protection Act + Medical Service Act article 21 align: PHI access only for legitimate care purposes; unauthorized access by curiosity is a reportable violation in both.

## Clinical scenario

Clinical Practice Guide
HIPAA Privacy Rule key concepts:
- Minimum necessary: share only the PHI needed for the task
- Permitted disclosures: Treatment, Payment, Operations (TPO) without authorization
- Required authorization: marketing, research, family of competent adult
- Indirect identifiers: 18 HIPAA identifiers including dates, geographic detail, photos, device IDs

Reporting:
- Internal: report to facility privacy officer immediately
- External: HHS Office for Civil Rights (OCR) for breaches affecting 500+
- Penalties: $100 to $50,000 per violation, plus criminal liability for willful neglect

Caution
Even well-intentioned disclosure (telling a worried spouse) violates HIPAA without explicit client authorization. Always default to no disclosure; check authorization on the chart and get the client OK before discussing care with anyone outside the treatment team.

## Key concepts

- **HIPAA** — Health Insurance Portability and Accountability Act 1996. Establishes privacy rule (PHI protection), security rule (electronic PHI), and breach notification rule. Applies to covered entities (providers, plans, clearinghouses) and business associates.
- **PHI (Protected Health Information)** — Any individually identifiable health information held or transmitted by a covered entity. Includes 18 identifiers: name, address, dates, phone, SSN, email, medical record number, photographs, device IDs, biometrics. De-identification requires removal of all 18.
- **Minimum necessary standard** — HIPAA principle that PHI disclosure should be limited to the smallest amount needed to accomplish the intended purpose. Applies to internal use, external disclosures, and access. Treatment exception allows fuller disclosure for direct care.

## Related questions

- [A nurse manager discovers that a hospital-issued laptop containing the protected health in…](https://mymerci.kr/pages/nclex_q.php?qn_id=368101&lang=en)
- [A nurse discovers that a discharge summary containing protected health information was fax…](https://mymerci.kr/pages/nclex_q.php?qn_id=393393&lang=en)
- [The charge nurse reviews eight uses or disclosures of protected health information. Drag e…](https://mymerci.kr/pages/nclex_q.php?qn_id=396455&lang=en)
- [Review the timeline after protected health information is sent to the wrong recipient and …](https://mymerci.kr/pages/nclex_q.php?qn_id=535414&lang=en)
- [Review the timeline after protected health information is sent to the wrong recipient and …](https://mymerci.kr/pages/nclex_q.php?qn_id=568927&lang=en)

## Read in another language

- [en](https://mymerci.kr/pages/nclex_q.php?qn_id=363986&lang=en)
- [ko](https://mymerci.kr/pages/nclex_q.php?qn_id=363986&lang=ko)
- [ja](https://mymerci.kr/pages/nclex_q.php?qn_id=363986&lang=ja)
- [zh-TW](https://mymerci.kr/pages/nclex_q.php?qn_id=363986&lang=zh-tw)
- [vi](https://mymerci.kr/pages/nclex_q.php?qn_id=363986&lang=vi)

---

More free questions: [NCLEX-RN Practice](https://mymerci.kr/pages/nclex_bank.php?lang=en)

_For study reference only. Always follow current clinical guidelines and your institution’s protocols._