Security: Privacy and Informatics

Core Concepts

Privacy, confidentiality, and security are three different things

Remember the relationship this way: privacy is the promise (the patient's right to control access), confidentiality is the duty (the professional's obligation to protect information disclosed during care), and security is the lock (the safeguards that keep information from being accessed, altered, lost, or stolen).

PHI and the HIPAA framework

Protected health information (PHI) is any information — in any form, paper, electronic, or spoken — that relates to a person's health, treatment, or payment and that can identify the person (name, birth date, medical record number, and so on). Almost everything a nurse documents is PHI.

HIPAA (a US law) has two rules that matter most in practice:

• The Privacy Rule sets standards for how PHI may be used and disclosed. It gives patients rights: to access their own records, request corrections, receive a notice of privacy practices, and receive an accounting of certain disclosures. It also establishes the minimum necessary standard — use or disclose only the smallest amount of information needed for the task.
• The Security Rule requires safeguards for electronic PHI: unique user IDs, audit controls (logs of who viewed what), transmission security (encryption), and contingency plans.

HIPAA applies to covered entities — health plans, healthcare clearinghouses, and providers who transmit health information electronically — plus their business associates (for example, billing or transcription companies) through contracts. It does not apply to everyone who happens to hold health information, and it is not the only privacy law that exists. Nurses should follow the stricter of the law, the professional code, and facility policy.

Informatics: the systems nurses use every day

• Electronic health record (EHR): the legal record of care. It supports continuity — information travels with the patient across shifts, units, and facilities — and makes information searchable and analyzable.
• Computerized provider order entry (CPOE): providers enter orders directly into the system instead of writing them by hand, which removes transcription errors and can trigger decision support (allergy warnings, dose checks).
• Barcode medication administration (BCMA): scanning the patient's wristband and the medication packaging verifies the "rights" of medication administration before the drug is given.
• Clinical decision support: alerts, reminders, and evidence links embedded in the record that flag problems such as allergies or drug interactions.
• Patient portals: patients can view parts of their own record, message the care team, and manage appointments, which supports engagement and self-management.
• Telehealth: care delivered at a distance, which extends access but adds privacy considerations for video and data transmission.

Informatics brings benefits and new risks. Data-entry errors, alert fatigue (so many warnings that clinicians start ignoring them), wrong-patient selection from a drop-down list, and security breaches are all real. Technology assists — it does not replace the nurse's verification and judgment.

Security measures in everyday practice

• Authentication: unique user IDs and strong passwords. Passwords are never shared, never written on sticky notes, and never borrowed.
• Automatic lock: workstations time out after inactivity. Locking the screen before stepping away, even for a moment, is a habit.
• Positioning: monitors are turned away from hallways, waiting areas, and doors so casual passersby cannot read them.
• Physical safeguards: identification badges, locked offices and supply areas, and restricted areas.
• Encryption: data is scrambled so it is unreadable if intercepted.
• Audit trails: the system records who opened which record and when. This is how unauthorized viewing is detected — and why "just looking" is a documented, discoverable act.
• Breach response: a breach is any unauthorized acquisition, access, use, or disclosure of PHI. Suspected breaches are reported promptly per facility policy — never concealed.

The nurse's role: protecting information at the bedside

• Verify before revealing. Before releasing any information — to a caller, a visitor, or even another staff member — confirm the person's identity and their need to know. Do not confirm or deny a patient's presence to a caller without following the facility's verification process.
• Keep conversations private. Discuss patient matters in private spaces, in low voices. Be mindful of hallways, elevators, and waiting rooms.
• Protect the screen and paper. Log off or lock workstations, position monitors away from public view, and do not leave printed reports with identifiers lying around.
• Share the minimum. Give only the information needed, to people involved in the patient's care. Family members generally receive information only with the patient's permission; a patient can also restrict all sharing ("confidential" status).
• Document professionally. The record is a legal document: accurate, objective, timely. Never write negative opinions about patients or colleagues.

How It Works: Handling a Request for Information

1. Stop and identify the requester. Who is asking — a patient, a family member, a colleague, a caller? What do they claim to need?
2. Check authorization. Does the patient have capacity and has the patient authorized sharing with this person? Is the requester actually involved in the patient's care? Facility policy defines the process.
3. Apply minimum necessary. Share only the smallest amount of information that accomplishes the legitimate purpose.
4. Choose a safe channel. Private conversation, secure messaging, the patient portal — not a hallway, not an unsecured text, not a public voicemail.
5. Document the interaction if required (per facility policy, e.g., for certain disclosures).
6. If anything is uncertain, decline and escalate. "I'll check with the charge nurse / privacy officer" is a complete, professional answer.

Common Confusions