Which is a nursing care error that violates the Health Insurance Probability and Accountability (HIPAA)?

• A. Administering a stronger dose of drug than was ordered
• B. Refusing to give a patient's daughter information over the phone
• C. Informing the patient's medical power of attorney of a medication change
• D. Leaving a copy of the patient's history and physical in the photocopier

Answer: (D)

Protecting patient privacy and PHI (protected health information) is central to HIPAA. The HIPAA privacy rule requires that confidential health information be handled in a way that prevents unauthorized access, disclosure, or exposure, and that PHI is only accessed by those who have a legitimate need to know and are authorized.

Leaving a copy of the patient’s history and physical in the photocopier is a direct privacy breach. Anyone who passes by could see sensitive information, and there’s a risk the document could be seen, copied, or misused. This violates the principle of safeguarding PHI and the “minimum necessary” standard that guides who should access information and how it’s protected. The proper practice is to ensure PHI is retrieved promptly, securely stored, or disposed of appropriately (for example, by shredding) and to log off or lock devices when not in use.

The other scenarios involve safety or authorization considerations rather than a privacy violation. Administering a stronger drug dose than ordered is a medication error and a safety issue, not a HIPAA violation. Withholding information from a patient’s daughter over the phone can be appropriate if there’s no authorized disclosure or if identity and authorization aren’t confirmed, and it aligns with privacy protection. Informing a legally authorized representative, like a medical power of attorney, of a medication change is typically expected and permitted under HIPAA when the individual is authorized to receive such information.