# A new RN reviews staff scenarios on the medical-surgical unit. Which scenarios represent a HIPAA violation? Select all that apply.

> source: MyMerci (mymerci.kr)  
> url: https://mymerci.kr/pages/nclex_q.php?qn_id=372721&lang=en  
> language: en  
> subject: Concepts of Management  
> category: MOC

## Question

A new RN reviews staff scenarios on the medical-surgical unit. Which scenarios represent a HIPAA violation? Select all that apply.

1

A nurse posts a deidentified-looking selfie on social media with a patient room number visible on the door behind her.

2

A nurse loses an unencrypted USB drive containing 240 patient records on the way to a unit meeting.

3

A nurse confirms a patient's presence and room number to the patient's spouse who is on the consented contact list.

4

A nurse discusses a celebrity patient's admission diagnosis with two coworkers in a crowded elevator.

5

A nurse shares her electronic health record password with a colleague so that colleague can finish the nurse's charting after a shift change.

## Explanation

HIPAA prohibits unauthorized creation, use, transmission, or disclosure of protected health information (PHI). The four violations are: (1) social media post — room number is identifying information about an individual; deidentification requires removing all 18 HIPAA identifiers. (2) Public conversation — discussing a specific patient where others can overhear. (3) Lost unencrypted device — a reportable breach affecting 240 individuals. (5) Sharing a password — undermines authentication, accountability, and the audit trail; the colleague's actions cannot be distinguished from the original nurse's. Choice 3 is permitted because the spouse is on the consented contact list, which the patient herself authorized.

## In-depth explanation

High-yield HIPAA violations on NCLEX cluster around four patterns: (a) social media — even photos that look "deidentified" can leak identity through room signs, wristbands, monitors, family in background, or unique tattoos; (b) verbal disclosure in public spaces — elevators, cafeterias, hallways; (c) electronic safeguard failures — lost unencrypted USB or laptop, screen left open, downloads to personal email; (d) authentication breaches — sharing passwords, allowing others to chart under your login. The Privacy Rule allows incidental disclosures (e.g., name on a chart visible at a nursing station) and disclosures within the consented contact list. The Security Rule mandates encryption, audit trails, and unique authentication. Mandatory reporting of any breach affecting 500+ patients to HHS within 60 days; smaller breaches reported annually. Patients have the right to an accounting of disclosures.

## Clinical scenario

A new RN reviews **five staff scenarios** on the medical-surgical unit and is asked to identify those that constitute a **HIPAA violation**.

## Key concepts

- **HIPAA Privacy Rule** — Federal regulation governing the use and disclosure of protected health information (PHI). Allows disclosures for treatment, payment, and operations; requires patient authorization for other disclosures; recognizes a consented contact list for family or friend involvement.
- **HIPAA Security Rule** — Requires administrative, physical, and technical safeguards for electronic PHI: encryption of devices and transmissions, unique authentication (no shared passwords), automatic logoff, and audit trails. Lost unencrypted devices are reportable breaches.
- **Breach Notification Rule** — Mandates notification to affected individuals, HHS, and (for breaches affecting 500+ persons) the media within 60 days. Smaller breaches are reported annually. Patients have the right to an accounting of disclosures over the previous 6 years.

## Related questions

- [A nurse coming on duty for the night shift reviews the EHR tabs for a 65-year-old client a…](https://mymerci.kr/pages/nclex_q.php?qn_id=372269&lang=en)
- [During a shift-change SBAR handoff, the outgoing nurse reports: "Mr. K, 68-year-old male w…](https://mymerci.kr/pages/nclex_q.php?qn_id=372684&lang=en)
- [A charge nurse receives an unscheduled high-acuity admission while another client is deter…](https://mymerci.kr/pages/nclex_q.php?qn_id=396195&lang=en)
- [A charge nurse on a 24-bed step-down unit receives a float RN from the ambulatory procedur…](https://mymerci.kr/pages/nclex_q.php?qn_id=617360&lang=en)

## Read in another language

- [en](https://mymerci.kr/pages/nclex_q.php?qn_id=372721&lang=en)
- [ko](https://mymerci.kr/pages/nclex_q.php?qn_id=372721&lang=ko)
- [ja](https://mymerci.kr/pages/nclex_q.php?qn_id=372721&lang=ja)
- [zh-TW](https://mymerci.kr/pages/nclex_q.php?qn_id=372721&lang=zh-tw)
- [vi](https://mymerci.kr/pages/nclex_q.php?qn_id=372721&lang=vi)

---

More free questions: [NCLEX-RN Practice](https://mymerci.kr/pages/nclex_bank.php?lang=en)

_For study reference only. Always follow current clinical guidelines and your institution’s protocols._