What is HIPAA, and what does it require of nurses?

HIPAA (Health Insurance Portability and Accountability Act of 1996) Privacy Rule protects Protected Health Information (PHI) — any individually identifiable health information. Nurse responsibilities: (1) Access PHI only for legitimate work purposes; (2) Discuss PHI only in private settings with people authorized to know; (3) Do not share PHI on social media; (4) Verify identity before releasing information; (5) Protect physical and electronic records; (6) Report breaches per facility policy. PHI can be shared without specific authorization for treatment (other healthcare providers caring for the client), payment (billing), and healthcare operations (quality improvement, training). Family members do not automatically have access — the client can authorize them, and emergency situations have specific rules. Violations of HIPAA carry significant penalties: civil fines up to millions of dollars, criminal penalties up to imprisonment in severe cases, loss of nursing license, employment termination. State laws may provide additional protections beyond HIPAA.