# Situation: A 67-year-old man is on the medical ward on day 4 after an ischemic stroke with right-sided weakness. The ward uses a problem-oriented record with nursing progress notes in SOAPIE format (Subjective, Objective, Assessment, Plan, Intervention, Evaluation), kept in an electronic health record. A nurse from another ward, who is his neighbor, opens his electronic record to see how he is doing. She does not share what she reads with anyone. Why is this a breach of his privacy?

> source: MyMerci (mymerci.kr)  
> url: https://mymerci.kr/pages/nclex_q.php?qn_id=630557  
> language: ko  
> subject: Nursing Practice IV — Care of Clients with Problems in Nutrition and Gastrointestinal, Metabolism and Endocrine, Perception and Coordination

## 문제

Situation: A 67-year-old man is on the medical ward on day 4 after an ischemic stroke with right-sided weakness. The ward uses a problem-oriented record with nursing progress notes in SOAPIE format (Subjective, Objective, Assessment, Plan, Intervention, Evaluation), kept in an electronic health record.

A nurse from another ward, who is his neighbor, opens his electronic record to see how he is doing. She does not share what she reads with anyone. Why is this a breach of his privacy?

## 보기

1. She should first have asked his family for consent to open it
2. She had no role in his care, so her access had no legitimate purpose **✔ 정답**
3. Records may be opened only from computers on the client's own ward
4. Viewing becomes a breach only if she used a colleague's login to open it

**정답: 2**

## 해설

Under the Data Privacy Act of 2012 (RA 10173), health information is sensitive personal information, processed only for a legitimate purpose and in proportion to it. Opening a record without a care role is a breach even if nothing is shared; audit trails record who viewed what.

## 심화 해설

Legitimate purpose is the test
Under the Data Privacy Act of 2012 (RA 10173), health information is sensitive personal information. It may be processed, which includes viewing, only for a legitimate purpose and only to the extent proportional to that purpose. A nurse caring for the client has a legitimate purpose. This nurse from another ward has no role in his care, so opening his record to satisfy personal interest has no legitimate purpose and is a breach of privacy, even though she shares nothing. Viewing itself is a form of processing; the breach does not depend on disclosure.

Why curiosity access is a breach
Being a health worker in the same hospital does not give access to every record. Access is based on role and need to know: the people who need the information to provide care, process payment, or perform authorized functions. Her neighborly concern may be kind, but it does not create a care role. Hospitals also use audit trails in the electronic health record, which log who opened which record and when. Such unauthorized access can lead to disciplinary action and penalties under the law.

| Statement | Accurate? | Reason |
| --- | --- | --- |
| No care role, so no legitimate purpose | Yes | Purpose and role decide lawful access |
| Should have asked family consent | No | Family consent does not make it lawful |
| Only computers on the client's ward | No | Rules depend on role, not location |
| Breach only with a colleague's login | No | Own login does not make it lawful |

Why the other explanations are wrong
Family consent does not authorize access; the information belongs to the client, and lawful access requires a legitimate purpose or the client's own consent. Access rules depend on role and purpose, not on which computer is used. Using a colleague's login would be an additional violation, but using her own login does not make the access lawful; access without a care role is a breach in itself.

What she could do instead
If she wishes to know how he is, she can visit him as a neighbor or ask him or his family directly, outside her professional role. The nurse also has a duty to report privacy breaches according to hospital policy, and nurses should log out of terminals and protect their credentials.

Exam takeaway
Key point Under RA 10173, health information is accessed only for a legitimate purpose tied to a role in care. Viewing without such a role is a breach, even if nothing is shared.

## 임상 시나리오

Privacy of Electronic Health RecordsData Privacy Act of 2012
Under the Data Privacy Act of 2012 (RA 10173), health information is sensitive personal information, processed only for a legitimate purpose and in proportion to it.

A nurse with no role in the client's care has no legitimate purpose, so opening his record is a breach, even if she tells no one.

Audit trails record who viewed each record. Access is based on role and need to know, not on location or login.

CautionFamily consent does not authorize access, and using one's own login does not make curiosity access lawful.

## 핵심 개념

- **Data Privacy Act of 2012 (RA 10173)** — The Philippine law protecting personal information and regulating its processing.
- **Sensitive personal information** — Personal data such as health records that receive stronger protection under the law.
- **Legitimate purpose** — A lawful, declared reason for processing personal information, such as providing care.
- **Audit trail** — An electronic log that records who accessed a record, what was viewed, and when.

## 같은 주제 문제

- [Situation: A 64-year-old woman with liver cirrhosis is admitted to the medical ward becaus…](https://mymerci.kr/pages/nclex_q.php?qn_id=630356)
- [Situation: A 64-year-old woman with liver cirrhosis is admitted to the medical ward becaus…](https://mymerci.kr/pages/nclex_q.php?qn_id=630357)
- [Situation: A 64-year-old woman with liver cirrhosis is admitted to the medical ward becaus…](https://mymerci.kr/pages/nclex_q.php?qn_id=630358)
- [Situation: A 64-year-old woman with liver cirrhosis is admitted to the medical ward becaus…](https://mymerci.kr/pages/nclex_q.php?qn_id=630359)
- [Situation: A 64-year-old woman with liver cirrhosis is admitted to the medical ward becaus…](https://mymerci.kr/pages/nclex_q.php?qn_id=630360)
- [Situation: A 34-year-old man with a closed fracture of the left femur is in skeletal tract…](https://mymerci.kr/pages/nclex_q.php?qn_id=630456)
- [Situation: A 34-year-old man with a closed fracture of the left femur is in skeletal tract…](https://mymerci.kr/pages/nclex_q.php?qn_id=630457)
- [Situation: A 34-year-old man with a closed fracture of the left femur is in skeletal tract…](https://mymerci.kr/pages/nclex_q.php?qn_id=630458)

---

More free questions: [기출문제](https://mymerci.kr/)

_학습 참고용입니다. 실제 임상은 최신 지침과 소속 기관 프로토콜을 따르세요._