5.2 Privacy, Confidentiality, HIPAA, and Personal Possessions
Key Takeaways
- Every NNAAP skill that exposes the body starts with privacy: close the door, curtain, or screen; knock; introduce; drape.
- HIPAA protected health information is not discussed in elevators, cafeterias, social media, or with visitors who are not authorized.
- Chart only on assigned clients — curiosity is not a need to know.
- Mail, telephone calls, and visitors belong to the resident; the resident chooses who visits.
- Label dentures, glasses, and hearing aids; report missing items immediately; never accuse another resident; do not open drawers just looking.
5.2 Privacy, Confidentiality, HIPAA, and Personal Possessions
Quick Answer: Every NNAAP skill starts with privacy. Close the door, curtain, or screen before you expose the body. Knock. Introduce. Drape. The Health Insurance Portability and Accountability Act (HIPAA) and 3 CCR 716-1.10 I.2.f both forbid sharing protected health information (PHI) in elevators, cafeterias, social media, or with visitors who are not authorized. Chart only on assigned clients. Mail, phone calls, and visits belong to the resident. Label dentures, glasses, and hearing aids; report missing items immediately; never accuse another resident; do not open drawers "just looking."
Why privacy is the first skill step
On the Colorado skills evaluation, the candidate volunteer is a person whose body you may have to uncover. Credentia still grades privacy as a real step: close the door, pull the privacy curtain, or place a screen before you expose skin. Then drape so only the area you are washing, dressing, or checking is uncovered. If you skip the curtain, you can fail the skill even if the washcloth technique was perfect.
The written exam tests the same habit with stems set in a semi-private room, a hallway shower, or a dining room. Knock before you enter. Wait. Announce yourself. Ask visitors to step out if you must expose the body, or take the resident to a private space. Pulling a gown up in a doorway "for just a second" is a rights fail.
The sequence does not change because you are late, because the roommate is asleep, or because the evaluator is already in the room. The evaluator is scoring whether you create privacy, not whether the room happens to be empty.
HIPAA and confidentiality
HIPAA is the federal Health Insurance Portability and Accountability Act. For the CNA, the working piece is the Privacy Rule: protected health information (PHI) — name plus diagnosis, room number plus treatment, photos, wristband data, chart notes — may be used only for care, payment, and operations by people who need to know.
| Allowed | Not allowed |
|---|---|
| Reporting a new bruise to the licensed nurse assigned to that client | Discussing the diagnosis in the elevator, lobby, or parking lot |
| Charting what you observed on your assigned clients | Opening another aide's assignment and reading charts "to learn the floor" |
| Giving a fact the nurse has authorized to a visitor the resident named | Telling a visitor who is not authorized "she has dementia and a UTI" |
| Using the facility-secure record | Posting a photo, room number, or "rough night with Mr. K in 214" on social media |
| Quiet report at the nurses' station | Gossip in the cafeteria or on the ride home with names attached |
Chart only on assigned clients. Curiosity is not a need to know. If you are not giving care and not asked to cover, stay out of the record. A float assignment gives you a need to know for those residents, not for the whole building.
A family member at the bedside is not automatically authorized to hear everything. The resident — or the legal decision-maker — chooses who gets information. If you are unsure, give no clinical detail and send the question to the licensed nurse.
Confidentiality also covers what you overhear. A diagnosis shouted across the desk is still PHI. You do not repeat it to a roommate, a church friend, or a group text. You do not confirm a celebrity admission. You do not leave a printed assignment sheet on a cafeteria table.
HIPAA does not stop you from reporting suspected abuse or a change in condition to the licensed nurse. Those reports are care, and they are required. HIPAA is not a reason to stay silent when I.2.f says report immediately.
Mail, telephone, and visits
These are rights, not privileges the staff hands out for good behavior.
- Mail. The resident sends and receives mail. You do not open letters "to help" unless the person asks you, in the moment, to open a specific piece. You do not screen outgoing complaints to the ombudsman, the Board, or a newspaper. Sealed mail stays sealed.
- Telephone. The resident has the right to private phone conversations. Do not hover to listen. If the person needs the handset held, hold it without commenting on the call. Do not take the phone away as punishment for a refused bath.
- Visits. The resident chooses visitors. You do not send a visitor away because you dislike the person, because the roommate wants the TV louder, or because the family asked you to "keep that friend out" unless a licensed-nurse care-plan restriction or a safety order exists. If a visitor is unsafe, stay with the resident, call for help, and get the nurse. You still do not invent a visiting ban.
Visiting hours and infection-control limits are facility rules. They do not let you punish a resident by withholding the phone or the mail. If a visitor asks you to "just look at the chart so I know what is going on," that is a HIPAA question, not a courtesy. Send the visitor to the nurse.
Security of possessions
3 CCR 716-1.10 I.2.f names security of possessions. The items that vanish most often are the ones that make a person a person: dentures, glasses, hearing aids, jewelry, wallets, and the sweater from home.
- Label dentures, glasses, and hearing aids according to facility policy before they leave the bedside. A cup without a name is how dentures enter the laundry.
- Keep those devices in the same place every time — labeled cup, case, or drawer the resident knows — not in a meal napkin, not in your pocket, not on the roommate's tray.
- If an item is missing, report it immediately to the licensed nurse and help search. Immediate means now, not at the end of the shift, and not after you "give it one more look tomorrow."
- Never accuse another resident. Theft and loss are nurse-and-administration problems. Accusing a person with dementia of stealing is mental mistreatment and a false allegation.
- Do not open drawers "just looking." Searching a bedside table without a care reason and without the resident's knowledge is a privacy and possessions violation. If you need a sweater the person asked for, ask first. If you must help search because something is lost, involve the resident when possible and tell the nurse.
Facilities often inventory valuables on admission. The CNA still reports a new missing item. An inventory sheet is not permission to shrug. A hearing aid in the linen cart is a reportable loss, not a joke about "another one gone."
Personal possessions also include the clothes the resident chose this morning. Tossing a favorite sweater in the discard bag because it is worn is not housekeeping. Ask, label, and report.
Colorado scenario
You work days in a Colorado assisted-living residence and also pick up shifts at the attached skilled-nursing unit. In the ALF hallway, two CNAs laugh about "the sundowner in 12B and her UTI" while the elevator doors are open. Later, on the SNF hall, Mr. Okonkwo's labeled glasses are gone after a shower. A coworker opens every drawer in the roommate's cabinet "just looking" and says, "It's always the roommate." A visitor Mr. Okonkwo did not invite asks you what medications he takes.
Three rights are on the table. HIPAA: you stop the elevator conversation and do not add details; you report the public discussion of PHI to the licensed nurse. Possessions: you report the missing glasses immediately, help search common areas and the shower, and you do not accuse the roommate. You do not continue the drawer search. Visitors: you do not recite the medication list. You ask Mr. Okonkwo whom he wants in the room and send clinical questions to the nurse. You close the door and pull the curtain before you help him dress, because privacy does not pause for a missing-glasses crisis.
The ALF license does not weaken HIPAA or I.2.f. The SNF OBRA poster does not make the ALF hallway a gossip zone. Same CNA, same duties. If Mr. Okonkwo later asks you to open one envelope from his sister, you open that envelope in front of him. You still do not open the rest of the stack "while you are at it."
Exam traps
- Starting a skill that exposes the body before the door, curtain, or screen is closed.
- Treating "the family is here" as permission to skip the drape.
- Elevator, cafeteria, or social-media talk about a named resident.
- Charting on clients you are not assigned.
- Opening mail, listening to phone calls, or choosing the resident's visitors.
- Accusing another resident of theft, or opening drawers just to look.
- Waiting until the next shift to report missing dentures, glasses, or hearing aids.
Which action violates HIPAA and the client's right to confidentiality?
On the Colorado NNAAP skills evaluation, what must the candidate do before exposing the client's body?
A resident's labeled dentures are missing after breakfast. What is the CNA's correct action?