Hipaa Scenarios
40 community-sourced questions and answers. Free — no login.
HIPAA's goal is to catch staff sharing patients' health information with those who do not need the information.
FALSE
One of the privileges of working in health care is that we have access to our family and friends' health information so we can find out when they have an illness.
FALSE
The goal of HIPAA is to protect confidential patient information from improper use or disclosure. If you see an apparent violation, you should report it to your instructor who will immediately assist you in contacting the Privacy Officer.
TRUE
We do not have a right to access anyone's health information including family members unless it is directly needed for the completion of our job responsibilities for a patient. If you accidentally see patient information that is not directly needed for you to perform your job, you cannot share that information with anyone else.
TRUE
Dr. Williams asks Sue, a nurse, to bring up his patient's lab results on the computer screen. Dr. Williams looks around and does not see any other staff or visitors in the area. He asks Sue to turn the monitor so he can see the chart. There is no other person around the desk when the screen is turned towards him. When Dr. Williams is finished, Sue turns the screen back around facing away from public view. Dr. Williams and Sue violated the patient's privacy by turning the screen and viewing the lab results.
FALSE
Julie is a nurse entering notes into a patient chart at the nurse's station where visitors come to ask questions. Jeff, another nurse, steps out of a patient's room and asks Julie for help. Julie leaves the chart open on the desk, then goes to assist Jeff in the patient's room. Q: Leaving the chart open on the desk when the nurse leaves the area is OK because she will be right back and trying to find her place would take too much time.
FALSE
Jennifer, a nurse, and Tom, a physical therapist, are eating lunch together in the cafeteria. They begin discussing a patient that they are both treating. The cafeteria is crowded and others around them can hear them referring to the patient's name and other confidential information. Q: They are violating the patient's privacy in this situation.
TRUE
An adult daughter of an elderly patient is present in the room when his doctor enters to speak with the patient about test results. The patient introduces his daughter to the doctor, and then asks the doctor if the test results are back. The doctor begins to explain the results to the patient. Q: The doctor violated the patient's privacy by talking about the test results with the daughter present in the room. True or False?
FALSE
In a Radiology waiting room, an x-ray technologist calls the next patient by name saying "Jane Smith, we are ready for your to get your sonogram now." Q: The x-ray technologist violated the patient's privacy by calling out her name and test to be performed.
TRUE
Non-Retaliation Policy
There should also be a policy in place to safeguard the rights of a person who, in good faith, reports a privacy violation. Action should not be taken against anyone who, in good faith: Exercises her or his rights, including filing a complaint. Contacts or sends a complaint to the Department of Health and Human Services. Testifies, assists, or participates in an investigation, compliance review, proceeding, or hearing. Believes that an act or practice is against the law. The person reporting the violation must have a reason to believe that there is a problem and may not use or disclose
HIPAA Patient Rights
An Authorization is a form signed by the patient for the use and disclosure of specific PHI that are not related to treatment, payment, or health care operations. There are some uses and disclosures where an authorization is not required. When in doubt about what information is required to have a signed authorization for release, ask!
There are four key parts which work together to protect PHI. One of them is TECHNICAL SECURITY, which is...
the process to identify the access and type of information individuals may access and view on a computer.
There are four key parts which work together to protect PHI. One of them is PHYSICAL SECURITY, which is...
hands-on access to computer hardware, systems, areas, and buildings.
There are four key parts which work together to protect PHI. One of them is TECHNICAL SECURITY MECHANISMS, which is...
processes that automatically monitor systems activity and report suspicious activity.
There are four key parts which work together to protect PHI. One of them is ADMINISTRATIVE PROCEDURES, which is...
policies and procedures that define steps the facility will take to address the above.
Privacy rules
Identify what information is protected and define when and how that information may be used or disclosed.
Security rules
Applies to PHI that is sent electronically from one location to another. Security rules identify steps to take to secure PHI that is in electronic format. They also apply to PHI that may be used or stored by the facility.
PATIENT: My doctor needs to discuss my treatment with other doctors and nurses. But the Privacy Rule prohibits doctors and nurses from discussing private health information if there is a possibility that someone will overhear. What if my doctor needs to discuss my condition with a nurse at a busy nursing station, or with me over the phone from someplace other than a private office? The privacy rule prevents these discussions.
FALSE
PATIENT: The privacy rule will create a government database with all individual's personal health information.
FALSE
PATIENT: The privacy rule prevents my pharmacist from filling my prescription before I show up and sign that consent. Now, instead of having the prescription waiting for me, I'll have to come to the pharmacy, sign a consent, and then wait around for hours while the prescription is filled.
TRUE
PATIENT: The privacy rule prevents a friend or family member from picking up prescriptions for me. Now I'll have to get out of my sick bed to get my medicine.
FALSE
PHYSICIAN: The privacy rule requires me to monitor the activities of my business associates.
FALSE
PHYSICIAN: The privacy rule prevents me from using a sign-in sheet so I can know when a patient has arrived. I can't even call out the names of patients in the waiting room when its their turn for their appointment.
FALSE
HOSPITAL: The privacy rule prohibits semi-private rooms. With two patients in a room, there is no way to guarantee that one won't overhear health information about the other. Now I'll have to rebuild my facility to include only private rooms.
FALSE
HOSPITAL: The privacy rule allows doctors and nurses to see an patient's entire medical record, if I think they need it to do their jobs.
TRUE
PHYSICIAN: The privacy rule requires covered entities to purchase expensive computer equipment.
FALSE
INSURER: How are we supposed to do business under this Rule? It would prohibit doctors from faxing information to us, or to each other, or to their patients.
FALSE
INSURER: What happens when I am required to report information under state law? I assume that if some other law requires me to disclose health information, I won't have to do a big analysis under the privacy rule, or get caught in the middle because the privacy rule might not allow the disclosure?
TRUE
ANYONE: The Privacy Rule is delayed by the Administrative Simplification Compliance Act that was passed in December 2001.
FALSE
This law delays compliance with the Transaction and Code Set standards for covered entities that file a compliance plan. This law does not apply to the Privacy Rule. The compliance date for the Privacy Rule is still April 14, 2003. (April 14, 2004 for small health plans).
TRUE
PATIENT: The Privacy Rule requires my doctor to give my health information to researchers and the police (even if they don't have a warrant) and health plans, all they have to do is ask.
FALSE
PATIENT: When my family member comes to pick me up from the hospital, the doctor will still be able to explain my condition and tell him what to expect when I return home. Right?
TRUE
FAMILY MEMBER: The Privacy Rule would have prevented me from finding out information about my son in a hospital in New York on September 11.
FALSE
Nursing is never practiced in isolation. It is a collaborative team operation. As a result, there are many times when you will need to discuss patient information with colleagues. In doing so, remember you must:
- Only discuss information relevant to the patient's care. - Only include those involved in the patient's care. - Select an area that is as private as possible, and check the surroundings to ensure no one will overhear confidential information who shouldn't.
Leave documents where the public can easily access them, even accidentally. Many of you may use visitors' lounges for conferences. Do not leave your papers or any medical record information where it can be seen by others.
FALSE
Do not leave documents where the public can easily access them, even accidentally. Many of you may use visitors' lounges for conferences. Do not leave your papers or any medical record information where it can be seen by others.
TRUE
When documents containing patient information are no longer needed, shred them or dispose in designated containers.
TRUE
Before you can release information about a patient, you must first confirm the identity of the person requesting information about the patient, whether in person, by phone, or in writing. What methods can be used to verify identity?
- A photo ID - Information that only the patient would know, and which you can confirm, such as the patient's middle name
ALWAYS
Be aware of where you are, who is around you, and what information can be seen or heard. It may not be possible to ensure absolute privacy, but reasonable measures need to be taken to "minimize the chance of incidental disclosure to others."
DON'T
Browse through a patient's chart or other files out of curiosity. Access only the portions of medical record you need to perform your specific role as a student nurse.
Looking for a different version?
CBTs get updated every year. Search for the exact version you're taking (e.g. "cyber awareness 2025").
Search all study materials