# A nurse on a medical-surgical unit notices several situations involving protected health information (PHI). Which actions comply with HIPAA requirements? Select all that apply.

> source: MyMerci (mymerci.kr)  
> url: https://mymerci.kr/pages/nclex_q.php?qn_id=368104&lang=en  
> language: en  
> subject: Assignment/Delegation/Supervision  
> category: MOC

## Question

A nurse on a medical-surgical unit notices several situations involving protected health information (PHI). Which actions comply with HIPAA requirements? Select all that apply.

1

Discuss the client's laboratory results with the assigned physician at the bedside computer using a low voice and an angled screen so others cannot see or hear identifiable information

2

Log out of the EHR before stepping away from the workstation, never share user credentials, and do not allow an unverified person to follow through a badge-secured door

3

If a visitor overhears another client's diagnosis through a partly open curtain, promptly report the unintended disclosure through the facility's privacy-incident process

4

Allow a coworker who is not involved in the client's care to open the chart solely for learning because the coworker is also an RN employed on the same unit

5

Post a case description with the admission date and a single rare diagnosis on a personal social media account because omitting the name makes the information de-identified

6

Before disclosing PHI by telephone, verify the requester's identity and authority using facility-approved procedures and independently obtained contact information when appropriate

## Explanation

HIPAA requires appropriate access controls and reasonable safeguards. A treatment discussion with the assigned physician can occur at the bedside when safeguards such as a low voice and protected screen are used (Choice 1). Logging out, protecting credentials, and preventing unauthorized entry reduce unauthorized access (Choice 2). Staff should report a potential unintended disclosure through the facility's privacy-incident process so the privacy officer can assess whether an impermissible disclosure or reportable breach occurred (Choice 3). Before telephone disclosure, verify both identity and authority using facility-approved procedures; for an outside provider or facility, independently obtained contact information may be used rather than a caller-supplied number (Choice 6). Accessing a chart without a work-related need is unauthorized even when the person is another RN (Choice 4). An admission date and rare diagnosis can make a case identifiable and do not meet HIPAA de-identification requirements merely because the name is omitted (Choice 5).

## In-depth explanation

HIPAA Privacy Rule — Core Principles
1. Minimum Necessary: access only the PHI required for your role and task
2. Need-to-Know: only the care team directly involved may access
3. Reasonable Safeguards: low voice, angled screen, curtain, private discussion areas
4. Breach Notification Rule: report internally to charge nurse + privacy officer; HHS within 60 days; media if 500+ affected

Common Pitfalls
- Snooping: accessing a non-assigned client's chart = violation, even by a coworker
- Social media: rare diagnosis + admission date can re-identify; never post client info
- Workstation: log out + never share credentials; do not badge-hold for unverified persons
- Phone callers: voice ID is insufficient — call back to the published number

Memory Tip
"MIN-NEED-VERIFY-REPORT: Minimum necessary, Need-to-know, Verify identity, Report breach"

## Clinical scenario

Scenario
RN on a busy medical-surgical unit faces multiple PHI situations during the shift: bedside discussion, overheard disclosure, phone caller asking for PHI, workstation security, coworker chart access, social media post.

Action Map
1. Bedside discussion: low voice + angled screen (incidental safeguard)
2. Overheard breach: report to charge nurse + privacy officer
3. Phone PHI request: call-back to published number
4. Workstation: log out + no credential sharing
5. Social media: never post client info, even de-identified

Avoid
- Snooping non-assigned charts
- Holding doors after badge auth for unverified persons
- Discussing PHI in elevators/cafeteria

## Key concepts

- **HIPAA Privacy Rule** — U.S. federal law (Health Insurance Portability and Accountability Act, 1996) protecting protected health information (PHI). Core requirements: Minimum Necessary access, Need-to-Know basis, reasonable safeguards (workstation, conversation, paper/printed PHI). Civil penalties up to $50K/violation; criminal penalties for malicious release.
- **Incidental Disclosure (HIPAA exception)** — Limited overheard or briefly visible PHI during reasonable care (e.g., another client overhears a curtain conversation). Permitted IF reasonable safeguards are used (low voice, angled screen, curtain, locked computer). Repeated incidental disclosures or those due to inadequate safeguards become reportable breaches.
- **HIPAA Breach Notification Rule** — Unauthorized disclosure of unsecured PHI requires notification within 60 days to: (1) affected individuals, (2) HHS Office for Civil Rights, (3) prominent media outlets if 500+ individuals affected. Nurses report internally to the charge nurse and privacy officer per facility incident protocol; failure to report can result in personal and institutional penalties.

## Related questions

- [A 67-year-old client with chronic obstructive pulmonary disease attends a routine primary …](https://mymerci.kr/pages/nclex_q.php?qn_id=360522&lang=en)
- [A registered nurse on a medical-surgical unit is delegating tasks at the start of shift. W…](https://mymerci.kr/pages/nclex_q.php?qn_id=360523&lang=en)
- [A 78-year-old male client with end-stage pancreatic cancer is enrolled in inpatient hospic…](https://mymerci.kr/pages/nclex_q.php?qn_id=362322&lang=en)
- [A nurse on a medical-surgical unit is starting a 0700 round and reviews these four assigne…](https://mymerci.kr/pages/nclex_q.php?qn_id=362403&lang=en)
- [An RN is assigning care on a medical-surgical unit to an LPN/VN and a trained unlicensed a…](https://mymerci.kr/pages/nclex_q.php?qn_id=362464&lang=en)
- [A registered nurse on a medical-surgical unit is assigning tasks to a licensed practical n…](https://mymerci.kr/pages/nclex_q.php?qn_id=363932&lang=en)
- [A charge nurse on a medical-surgical unit is making assignments for the day shift. The tea…](https://mymerci.kr/pages/nclex_q.php?qn_id=363953&lang=en)
- [A nurse manager is reviewing situations from the past week to identify potential HIPAA Pri…](https://mymerci.kr/pages/nclex_q.php?qn_id=364050&lang=en)

## Read in another language

- [en](https://mymerci.kr/pages/nclex_q.php?qn_id=368104&lang=en)
- [ko](https://mymerci.kr/pages/nclex_q.php?qn_id=368104&lang=ko)
- [ja](https://mymerci.kr/pages/nclex_q.php?qn_id=368104&lang=ja)
- [zh-TW](https://mymerci.kr/pages/nclex_q.php?qn_id=368104&lang=zh-tw)
- [vi](https://mymerci.kr/pages/nclex_q.php?qn_id=368104&lang=vi)

---

More free questions: [NCLEX-RN Practice](https://mymerci.kr/pages/nclex_bank.php?lang=en)

_For study reference only. Always follow current clinical guidelines and your institution’s protocols._