HIPAA Scenarios on the NCLEX
The tested privacy scenarios: elevators, family requests, social media, faxes, chart access.
HIPAA questions are scenario recognition. The exam recycles the same five situations.
The elevator and hallway
Never discuss patients in public spaces: elevators, cafeteria, hallways, the nurses' station within earshot of visitors. Two nurses discussing a patient's HIV status in the elevator is a reportable breach even if no name is used, because the patient can be identified from context. Handoff belongs in a private area. If the exam shows report happening at a crowded desk, that is the violation.
Family requests
A caller says 'I'm her daughter, how is she doing?' → verify identity and the patient's permission first. Patients decide who gets information. Many units use a privacy code: no code, no information. Even confirming that a person is admitted can violate privacy if the patient opted out of the directory. Safe response: 'I can't share whether anyone by that name is here.'
Faxes and printed records
Fax to a verified number with a cover sheet. Misdirected fax → report it per facility policy; it is a breach. Printed handoff sheets go in the shred bin, not the trash. Leaving a report sheet in a public place is a tested wrong action.
Who may access charts
Access follows the need to know rule: only staff currently involved in the patient's care. Looking up a neighbor, a coworker, a celebrity, or your own family member is a violation, and audit trails catch it. A nurse from another unit 'just checking on' a friend's labs is the classic tested breach. Being a nurse is not authorization.
Frequently asked
Can I give report to the next shift at the bedside?
Yes. Bedside handoff is permitted; ask visitors to step out or get the patient's OK for them to stay.
My patient's employer calls asking when she'll be back at work. Answer?
No information without the patient's authorization. Refer the caller to the patient.
I accidentally opened the wrong chart. Is that a breach?
Inadvertent access happens. Close it, don't read further, and follow facility policy on self-reporting.
Quick check
Loading a question…
How ready are you right now?
10 real NCLEX questions, free, in your browser. See how close you are to ready and which subjects are costing you.
Try 10 questions free
Social media
No patient information on social media. Ever. No photos, no room numbers, no 'rough shift, lost a young trauma patient tonight.' De-identified is a trap answer: dates, unit, and details re-identify people in a small town. Posting a photo of an interesting wound 'for education' without written authorization is a breach and a board-of-nursing issue.