# A nurse manager is reviewing situations from the past week to identify potential HIPAA Privacy Rule violations on the unit. Which situations represent HIPAA violations that require reporting to the privacy officer? Select all that apply.

> source: MyMerci (mymerci.kr)  
> url: https://mymerci.kr/pages/nclex_q.php?qn_id=364050&lang=en  
> language: en  
> subject: Assignment/Delegation/Supervision  
> category: MOC

## Question

A nurse manager is reviewing situations from the past week to identify potential HIPAA Privacy Rule violations on the unit. Which situations represent HIPAA violations that require reporting to the privacy officer? Select all that apply.

1

Disclosing a client's positive HIV status to the public health department in accordance with state mandatory reporting law

2

Posting a before-and-after wound photograph from a client's case on a personal social media account, even with the client's face cropped out

3

Reviewing the chart of a hospitalized friend on another unit when the nurse has been formally assigned by the charge nurse to provide care that day

4

Looking up the electronic health record of a celebrity admitted to the unit out of curiosity, even when the information is not shared with anyone

5

Sharing pertinent clinical information with the receiving unit nurse during a patient transfer using the SBAR format at the bedside computer

6

Discussing a client's plan of care with the assigned RN during a private hand-off report in a closed conference room with the door shut

## Explanation

Posting an identifiable client image on personal social media is a HIPAA violation; cropping the face alone does not reliably de-identify an image because scars, tattoos, dressings, background details, or metadata may identify the client (Choice 2). Accessing a client's record without a treatment, payment, or health care operations purpose—including out of curiosity even if the information is not shared—is an impermissible access or snooping violation (Choice 4). HIPAA permits relevant PHI sharing for treatment among assigned care-team members using reasonable safeguards (Choices 3, 5, and 6). A disclosure to a public health authority that is required by state law is permitted under HIPAA (Choice 1).

## In-depth explanation

HIPAA Permitted vs Prohibited
Permitted: treatment, payment, healthcare operations (TPO), mandatory public health reporting, court order.
Prohibited: social media posts, snooping records out of curiosity, sharing in elevators/cafeterias, using PHI for personal purposes.

"Need to Know" Standard
Access only the minimum necessary information for your specific role. Even formal staff cannot browse records without a care relationship.

Memory Tip
"CAMP": Curiosity = violation, Authorization required for non-TPO, Minimum necessary, Photos require consent.

Caution
Cropping the face does NOT de-identify a client. Wound location, tattoos, room background, time stamps can all re-identify.

## Clinical scenario

Scenario
Nurse manager weekly review of unit incidents and near-misses for HIPAA Privacy Rule compliance. New graduates rotating through, social media use rising, celebrity recently admitted to the unit.

Common Violations Identified
- Photos posted online (even cropped)
- Curiosity-based record access (snooping)
- Conversations in public elevators
- Leaving computer unlocked with PHI visible
- Faxing PHI to wrong number without callback verification

Required Action
1. Report to privacy officer within 24 hours
2. Document the breach and persons involved
3. Re-education and corrective action
4. Possible breach notification to client and OCR if PHI compromised

## Key concepts

- **HIPAA Privacy Rule** — US federal law (1996, updated by HITECH 2009) protecting individually identifiable health information (PHI). Permits disclosure for treatment, payment, healthcare operations, and required public health reporting. All other disclosures require client authorization.
- **Minimum necessary standard** — Workforce members must access only the PHI strictly required to perform their job. A nurse caring for a patient may view that chart; the same nurse may not view records of unrelated patients on other units, regardless of whether the information is shared.
- **Permitted public health disclosures** — HIPAA explicitly allows disclosure without client authorization to public health authorities for: communicable diseases (TB, HIV in many states), abuse/neglect/domestic violence, FDA adverse events, vital statistics, and worker injury surveillance.

## Related questions

- [A 67-year-old client with chronic obstructive pulmonary disease attends a routine primary …](https://mymerci.kr/pages/nclex_q.php?qn_id=360522&lang=en)
- [A registered nurse on a medical-surgical unit is delegating tasks at the start of shift. W…](https://mymerci.kr/pages/nclex_q.php?qn_id=360523&lang=en)
- [A 78-year-old male client with end-stage pancreatic cancer is enrolled in inpatient hospic…](https://mymerci.kr/pages/nclex_q.php?qn_id=362322&lang=en)
- [A nurse on a medical-surgical unit is starting a 0700 round and reviews these four assigne…](https://mymerci.kr/pages/nclex_q.php?qn_id=362403&lang=en)
- [An RN is assigning care on a medical-surgical unit to an LPN/VN and a trained unlicensed a…](https://mymerci.kr/pages/nclex_q.php?qn_id=362464&lang=en)
- [A registered nurse on a medical-surgical unit is assigning tasks to a licensed practical n…](https://mymerci.kr/pages/nclex_q.php?qn_id=363932&lang=en)
- [A charge nurse on a medical-surgical unit is making assignments for the day shift. The tea…](https://mymerci.kr/pages/nclex_q.php?qn_id=363953&lang=en)
- [A nurse is preparing an adult client for an open cholecystectomy and is reviewing the info…](https://mymerci.kr/pages/nclex_q.php?qn_id=365729&lang=en)

## Read in another language

- [en](https://mymerci.kr/pages/nclex_q.php?qn_id=364050&lang=en)
- [ko](https://mymerci.kr/pages/nclex_q.php?qn_id=364050&lang=ko)
- [ja](https://mymerci.kr/pages/nclex_q.php?qn_id=364050&lang=ja)
- [zh-TW](https://mymerci.kr/pages/nclex_q.php?qn_id=364050&lang=zh-tw)
- [vi](https://mymerci.kr/pages/nclex_q.php?qn_id=364050&lang=vi)

---

More free questions: [NCLEX-RN Practice](https://mymerci.kr/pages/nclex_bank.php?lang=en)

_For study reference only. Always follow current clinical guidelines and your institution’s protocols._