Confidentiality And Privacy

Historical Context & Motivation

The duty to keep patient information private is far older than modern healthcare law. From the moment healers first recorded observations about a patient's condition, a tension arose between the need for accurate documentation and the patient's reasonable expectation that sensitive details would not be disclosed to others. In early Western medicine, the Hippocratic Oath (circa 400 BCE) included explicit language prohibiting physicians from revealing what they saw or heard in the course of treatment. This ethical tradition persisted for centuries, but it was not codified into binding law until the twentieth century, when advances in electronic record-keeping, insurance billing, and multi-provider care teams dramatically increased the number of people who could access a patient's health data.

Several landmark events accelerated the push for formal patient privacy protections in the United States. The rise of managed care in the 1980s and 1990s meant that insurers, utilization review companies, and administrative staff routinely handled sensitive diagnoses and treatment histories. High-profile breaches—unauthorized disclosures of HIV status, psychiatric records, and genetic test results—underscored the real harm that could follow when confidentiality safeguards were absent. These forces converged to produce the most significant patient-privacy statute in U.S. history: the Health Insurance Portability and Accountability Act (HIPAA) of 1996, followed by its Privacy Rule in 2003 and its Security Rule in 2005.

Understanding this history matters for licensed practical and vocational nurses because the NCLEX-PN expects you to recognize not just the rules themselves but the rationale behind them. Confidentiality protections exist to prevent concrete harms—discrimination, stigma, emotional distress, and erosion of trust in the healthcare system. When patients doubt that their information will remain private, they may withhold symptoms, avoid seeking care, or refuse treatment—outcomes that endanger both the individual and public health.

Core Principles & Definitions

Although the terms confidentiality and privacy are often used interchangeably in everyday conversation, they carry distinct meanings in healthcare law and nursing ethics. Privacy refers to the patient's right to control who can access their personal health information and under what circumstances it may be collected. Confidentiality, by contrast, is the professional obligation of healthcare providers to safeguard information that has already been shared within the therapeutic relationship. A third related concept, security, encompasses the physical and technical measures used to prevent unauthorized access to records. Taken together, these three principles form the foundation of information governance in healthcare.

Visual Explanation — The Layers of Patient Information Protection

As the diagram shows, these three concepts are nested rather than independent. A breach in the security layer—such as leaving a computer terminal unlocked—can expose PHI and violate the nurse's confidentiality obligation, which in turn infringes on the patient's right to privacy. Conversely, strong security measures (encrypted EHRs, badge-access workstations) reinforce confidentiality, which in turn upholds the patient's privacy. For NCLEX-PN purposes, remember that every nurse action that touches patient information must be evaluated through all three layers—does this action preserve the patient's privacy rights, fulfill the provider's confidentiality duty, and comply with institutional security policies?

How HIPAA Works — Rules, Rights, and Exceptions

The HIPAA Privacy Rule — Key Provisions for Nurses

HIPAA's Privacy Rule applies to covered entities (health plans, healthcare clearinghouses, and most healthcare providers) and their business associates (billing companies, IT vendors, transcription services). As an LPN/LVN, you work within a covered entity and are therefore bound by these regulations. The Privacy Rule establishes several patient rights that directly affect day-to-day nursing practice. Patients have the right to receive a Notice of Privacy Practices (NPP) upon admission, the right to access and obtain copies of their medical records, the right to request amendments to inaccurate records, the right to an accounting of certain disclosures, and the right to request restrictions on how their PHI is used or disclosed.

Permitted Uses and Disclosures Without Authorization

HIPAA does not require patient authorization for every disclosure. The rule identifies several categories where PHI may be shared without a signed authorization. The three most common are collectively known as TPO—Treatment, Payment, and Healthcare Operations. Treatment includes sharing information with other providers involved in the patient's care, such as calling the pharmacy to clarify a prescription. Payment involves submitting claims to insurers. Operations cover quality improvement, training, and compliance activities. Beyond TPO, HIPAA permits disclosure in specific situations including public health reporting (communicable diseases, vital statistics), court orders and subpoenas, law enforcement requests under defined conditions, and situations involving serious threats to health or safety. Even in these situations, the minimum necessary standard still applies—share only the information needed to accomplish the purpose.

When Written Authorization IS Required

• Marketing purposes — Using PHI to promote products or services generally requires explicit patient authorization.
• Sale of PHI — Any exchange of PHI for remuneration requires authorization, with narrow exceptions.
• Psychotherapy notes — These receive heightened protection and require a separate authorization even for TPO.
• Research — Use of PHI for research studies typically requires either patient authorization or a waiver from an Institutional Review Board.
• Disclosures to employers — Releasing health information for employer use (beyond workers' compensation) requires written authorization.

Types of Breaches & Common Nursing Scenarios

Understanding the types of confidentiality breaches and common scenarios in which they occur is essential for NCLEX-PN preparation. A breach under HIPAA is defined as the acquisition, access, use, or disclosure of PHI in a manner not permitted by the Privacy Rule that compromises the security or privacy of the information. Breaches can be intentional—as when an employee looks up a celebrity's medical records out of curiosity—or unintentional, such as faxing lab results to the wrong number. The HITECH Act requires covered entities to notify affected individuals, the Department of Health and Human Services (HHS), and in some cases the media when a breach occurs. Penalties range from $100 to $50,000 per violation, with annual maximums of $1.5 million per violation category, and criminal penalties can include imprisonment for up to 10 years.

Verbal breaches are among the most common in clinical settings and the easiest to overlook. Discussing a patient's condition in the elevator, leaving a voicemail with detailed test results, or conducting bedside report within earshot of another patient's visitors can all constitute violations. Electronic breaches have grown significantly with the adoption of EHRs and mobile devices; posting a patient story on social media—even without using the patient's name—can be identifiable through contextual details and has led to disciplinary actions and terminations. Physical breaches involve tangible records that are improperly handled, such as discarding printouts in a regular trash bin rather than a shredding container or leaving patient charts visible at the nursing station.

Worked Example — Navigating a Confidentiality Scenario

The following scenario mirrors the type of situational question you may encounter on the NCLEX-PN. Work through each step as a model for how to analyze confidentiality questions.

Confidentiality — Strengths, Limitations, and Ethical Tensions

While confidentiality is a fundamental principle, it is not absolute. Nurses frequently encounter situations where the duty to maintain confidentiality conflicts with other ethical or legal obligations. Understanding both the strengths of confidentiality protections and their recognized limitations prepares you to navigate these tensions on the NCLEX-PN and in clinical practice.

Connection to Advanced Practice & Emerging Issues

While the NCLEX-PN focuses primarily on the foundational rules of confidentiality and HIPAA compliance, it is increasingly important for practical nurses to be aware of emerging challenges in information privacy. The healthcare landscape is evolving rapidly, and new technologies, care models, and patient expectations create novel confidentiality dilemmas. A working knowledge of these advanced issues will strengthen your clinical judgment and prepare you for ongoing professional development.

For the NCLEX-PN, you are not expected to have detailed knowledge of the 21st Century Cures Act or AI governance. However, you should recognize that confidentiality is a dynamic, evolving obligation rather than a static set of rules. State nurse practice acts may impose additional requirements beyond HIPAA—for example, some states have specific statutes protecting the confidentiality of HIV test results, substance use treatment records (42 CFR Part 2), and genetic information (GINA). As a practical nurse, staying current with your state's requirements is as important as understanding federal law.

Practice Problems

Lesson Summary