8. A nurse discloses a client's HIV status to the client's employer without the client's consent. What is this an example of?
-
A
Normal information sharing between healthcare and community
-
B
A HIPAA violation — unauthorized disclosure of protected health information (PHI) to a non-authorized party; the client did not consent and the employer has no legal right to this information
-
C
Acceptable if the nurse believed it was for public health
-
D
Only a problem if the client finds out
Explanation
THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA) PRIVACY RULE protects all individually identifiable health information (Protected Health Information, PHI). An employer is NOT an authorized recipient of health information without specific patient authorization or a legally defined exception. HIV STATUS DISCLOSURE: HIV status is a particularly sensitive category of PHI; many states have additional state laws beyond HIPAA requiring extra protections for HIV status, mental health records, and substance use treatment records; unauthorized disclosure of HIV status has historically led to discrimination in employment, housing, and relationships — HIPAA specifically addresses these sensitivity concerns. AUTHORIZED DISCLOSURES WITHOUT PATIENT CONSENT: For treatment (other healthcare providers involved in care); for payment (insurance billing); for healthcare operations (quality improvement within a covered entity); public health reporting (specific communicable diseases — state laws define which); law enforcement (specific circumstances); abuse/neglect reporting; judicial/legal proceedings. NOT AUTHORIZED: Employer; family members (unless designated by the patient); friends; media; other parties the patient hasn't specifically authorized. CONSEQUENCES OF HIPAA VIOLATIONS: Civil penalties: $100-$50,000 per violation depending on culpability, up to $1.9 million per violation category per year; Criminal penalties for willful violations: up to $250,000 fine and 10 years imprisonment; Professional: license investigation, discipline; Employment: termination. NURSE RESPONSIBILITY: Never discuss patient information outside of clinical necessity; use minimum necessary information; be aware of surroundings when discussing PHI (hallways, elevators, public spaces); log off computer access promptly.
Source: NCLEX-RN Test Plan: Safe Care — HIPAA and Confidentiality