16.1 Legal Regulations: CMS, HIPAA, and OSHA
Key Takeaways
- HIPAA's minimum-necessary rule limits what a hospice nurse may disclose; family members who are involved caregivers may receive relevant care information, while unidentified callers may not.
- OSHA's Bloodborne Pathogens Standard (29 CFR 1910.1030) still applies in private homes: point-of-use sharps containers, no recapping, and a post-exposure plan.
- Billing General Inpatient (GIP) care when routine home care would suffice is a CMS fraud-and-abuse pattern (upcoding), not a family-convenience option.
- Telehealth follows the patient-location rule: a Nurse Licensure Compact multistate license covers other compact states only, and CHPN certification does not expand the nurse practice act.
- Mandatory reporting of suspected abuse or neglect continues during hospice; HIPAA does not block a required report to adult or child protective services.
Practice Issues is 28 of 135 scored CHPN items (about 20.7%). Legal-regulation questions rarely ask you to recite a citation. They ask what the nurse does next when a neighbor calls, a used needle is in the couch, a family wants General Inpatient (GIP) because they are exhausted, or an after-hours triage nurse is speaking to a patient in another state. Wrong answers usually confuse involved caregivers with unauthorized callers, treat respite as GIP, or assume a compact license is a national license.
HPCC reports CHPN results as a scaled score. The passing standard is 500 on a 200–800 scale. That 500 is not 75% correct and is not a license to stop studying when a practice bank hits 75%. Older third-party pages that still say “pass at 75” are describing a previous reporting scale or mixing scaled units with percent correct. Domain 5 items still require the same clinical judgment as pain and symptom items.
HIPAA: minimum necessary, family, and cold callers
The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule lets a hospice use and disclose protected health information (PHI) for treatment, payment, and health-care operations. The minimum necessary standard (45 CFR 164.502(b)) still applies to most non-treatment disclosures: share only the PHI needed for the purpose. A volunteer delivering flowers does not need the opioid list. A funeral home coordinating a transfer needs identity and death information, not the full psychosocial assessment.
Treatment disclosures among the interdisciplinary group (IDG) are not squeezed through a tiny “minimum necessary” straw—nurses, the hospice physician, the social worker, and the chaplain may share what they need to care for this patient. That is not a blank check to gossip in the grocery line.
Family members who are involved in care are treated differently from strangers. 45 CFR 164.510(b) allows relevant information to be shared with a relative, close friend, or other person identified by the patient as involved in care or payment, unless the patient has objected. If the daughter is the live-in caregiver and asks how to give morphine concentrate, teach her. If the patient has capacity and says “do not tell my brother my diagnosis,” honor that.
An unidentified caller is not an involved caregiver. Do not confirm that a named person is on hospice, do not read the medication list, and do not “just tell them she’s comfortable.” Verify identity against the record, offer to take a message, and call back using a number already in the chart. The trap is treating “they sounded like family” as authorization.
OSHA bloodborne and sharps in the home
The Occupational Safety and Health Administration (OSHA) Bloodborne Pathogens Standard (29 CFR 1910.1030) applies to hospice nurses in private residences, not only to inpatient units. Home care adds poor lighting, pets, cluttered floors, no dirty-utility room, and used needles left in tissue boxes or bedding. The agency still owes an exposure control plan, hepatitis B vaccination, personal protective equipment, engineering controls, and post-exposure evaluation.
Do not recap contaminated needles. Place sharps in a puncture-resistant, labeled container at the point of use—in the bedroom, not “later at the office.” Do not leave used needles for the family to throw in household trash. If a stick occurs, wash, report through the agency process, and complete follow-up; “it was only a home visit” is not a defense. The Needlestick Safety and Prevention Act pushes safer devices (needleless connectors, retractable lancets) where feasible. Standard precautions still apply when handling soiled linens and body fluids in the home.
CMS fraud, waste, and GIP upcoding
Medicare hospice is a Part A per-diem benefit with four levels: Routine Home Care (RHC), Continuous Home Care (CHC), General Inpatient Care (GIP), and Inpatient Respite Care (IRC). The Centers for Medicare & Medicaid Services (CMS) and the Office of Inspector General (OIG) repeatedly flag hospices that bill a higher-paying level when the documentation supports a lower one.
GIP is short-term inpatient care for pain or other symptoms that cannot be managed in the home or a nursing facility. It is not caregiver vacation, not “the family is tired,” and not a parking place while a nursing-home bed is found. Exhausted caregivers may qualify for respite (IRC), which is a different level with a different medical-necessity story. CHC requires a predominantly nursing-care day of crisis management in the home, not a scattering of aide hours.
Upcoding GIP means billing GIP when RHC (or respite) was the covered level. Related patterns include long GIP stays without daily evidence of uncontrolled symptoms, live discharge right after GIP, recertifying patients who no longer have a six-month prognosis, and kickbacks for referrals. Those facts can support False Claims Act liability. The CHPN action is to document the actual symptom intensity, involve the IDG, and refuse to “make it GIP” for convenience. Certification does not make you the biller, but you are a fact witness in the record.
State nurse practice acts, compact licenses, and telehealth
CHPN is a credential, not a license. Your state nurse practice act still sets scope. A compact multistate license issued by your primary state of residence lets an RN practice in other Nurse Licensure Compact (NLC) jurisdictions, including telehealth, but the patient’s location controls which law applies. A compact license is not a license in non-compact states (examples in 2026 still include California and New York). After-hours triage, virtual IDG, and remote symptom calls to a patient who has traveled out of state require you to be authorized in that state. The compact does not cover APRNs; prescribing across state lines is a separate problem.
Mandatory reporting
Hospice does not create a privacy bubble around abuse. Child abuse, elder abuse, and dependent-adult maltreatment remain mandatory reports under state law. Financial exploitation, unexplained bruising, withheld opioids used as punishment, and a caregiver who isolates the patient from the team are reportable even when death is near. HIPAA’s public-interest provisions allow required reports to protective services. Do not wait for the next IDG meeting to “see how the family feels.” Assess safety, report, document facts, and collaborate with the social worker. The CHPN distractor is “the family is grieving, so do not report.”
| Regulation | What it requires | Hospice example |
|---|---|---|
| HIPAA minimum necessary (45 CFR 164.502(b)) | Limit PHI to what the purpose needs | Volunteer gets first name and allergies for a meal drop-off, not the full MAR |
| HIPAA involved persons (45 CFR 164.510(b)) | Share relevant care info with identified caregivers unless the patient objects | Teach the live-in spouse how to give breakthrough morphine |
| HIPAA + identity verification | Do not confirm care to unknown callers | Neighbor asks if “Mary is on hospice”—do not confirm; take a message |
| OSHA 29 CFR 1910.1030 | Bloodborne plan, sharps, no recapping, post-exposure care in any work setting | Used needle in the sofa; container at the bedside; report a stick |
| CMS hospice levels / False Claims | Bill the medically necessary level; GIP is not respite | Uncontrolled pain → GIP with documentation; tired family → respite, not GIP |
| State nurse practice act + NLC | License where the patient is; compact ≠ all 50 states | Telehealth call to a patient in a non-compact state needs that state’s RN license |
| Mandatory reporting statutes | Report suspected abuse/neglect despite hospice status | Adult child withholding pain medicine as control → APS report now |
Exam trap
If the stem gives an involved caregiver and an unnamed caller, split the actions. Teach the caregiver; protect the stranger. If the stem says the family is exhausted, think respite, not automatic GIP. If the stem is a telehealth call, locate the patient, then the license.
A hospice RN is in the home. The patient's adult daughter, listed as the primary caregiver, asks how to give the next morphine dose. Ten minutes later an unidentified caller asks whether the patient is 'on hospice yet' and wants the medication list. What is the most appropriate HIPAA-aligned response?
A family asks that a hospice patient be moved to a contracted inpatient unit for two weeks because the spouse is exhausted, not because pain or dyspnea is uncontrolled at home. The intake nurse is told to 'make it GIP so the per diem is higher.' What is the correct regulatory analysis?
While changing a soiled bed in a dim bedroom, a hospice RN finds an uncapped used needle in the sheets and sustains a needlestick. Which action set matches OSHA bloodborne requirements in the home?