8.2 HIPAA, Confidentiality, and End-of-Shift Reporting
Key Takeaways
- HIPAA's Privacy Rule protects Protected Health Information (PHI) — any resident-identifiable health data including name, room number, photographs, diagnoses, vital signs, and payment records; CNAs must limit PHI use and disclosure to the minimum necessary for the job.
- Permitted disclosures without separate authorization include treatment, payment, and health care operations (TPO) — sharing a resident's vitals with the charge nurse is permitted; sharing them with a visitor or on social media is not.
- End-of-shift verbal report follows the SBAR format: Situation, Background, Assessment, Recommendation — a structured handoff that reduces missed information and adverse events.
- Confidentiality breaches include discussing residents in hallways/elevators, leaving charts or screens visible, posting on social media, and texting resident information over unsecured channels; each is reportable and can result in INAR findings.
- Residents have a right to see their own chart, request amendments, and receive a Notice of Privacy Practices from the facility; the CNA routes these requests to the licensed nurse or privacy officer, not to the resident's family.
HIPAA, Confidentiality, and End-of-Shift Reporting
Quick Answer: The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule protects Protected Health Information (PHI) — any resident-identifiable health data. Indiana CNAs may use and share PHI only for treatment, payment, and health care operations (TPO) or as expressly authorized by the resident. End-of-shift report uses the SBAR format — Situation, Background, Assessment, Recommendation — to hand off residents to the oncoming CNA in a structured, complete way. Confidentiality breaches include hallway conversations, visible screens, social-media posts, and unsecured texts; each is reportable under HIPAA and Indiana 410 IAC 16.2.
Protected Health Information (PHI)
PHI is any individually identifiable health information — health data that can be tied to a specific resident. The 18 HIPAA identifiers most relevant to a CNA's day-to-day work:
- Name, room number, medical record number
- Photographs or video of the resident
- Diagnoses, vital signs, lab results
- Medications, treatments, dietary restrictions
- Information about family members or visitors
- Dates of service, admission, discharge
- Phone numbers, addresses, email addresses
- Payment and billing records
The rule is strict: if a piece of information, alone or combined with others, could identify the resident, it is PHI and is protected.
The Minimum Necessary Standard
HIPAA requires that the CNA use, request, or share only the minimum amount of PHI needed to do the task at hand. Examples:
- Giving report to the oncoming CNA: share the resident's ADL status, mobility, intake/output, skin issues, and any change in condition. Do not share the resident's medical history unrelated to care.
- Calling dietary about a meal tray: share the resident's name, room, and diet order. Do not share diagnoses.
- Escorting a visitor: verify the visitor is on the resident's approved list with the nurse; do not disclose other residents' information in the hallway.
The minimum-necessary rule does not apply when sharing PHI for treatment between providers caring for the resident — full clinical sharing is permitted within the care team. But disclosure to anyone outside the team requires either resident authorization or a permitted non-authorization purpose.
Permitted Disclosures: Treatment, Payment, Operations (TPO)
HIPAA allows PHI disclosure without the resident's separate written authorization for three core categories:
| Category | Example for a CNA |
|---|---|
| Treatment | Sharing vitals with the charge nurse; reporting a fall to the LPN; giving end-of-shift SBAR to the oncoming CNA |
| Payment | The facility's billing office submitting claims to insurance (the CNA does not do this directly, but may route forms) |
| Operations | Quality assurance audits, care plan meetings, IDOH surveys, infection-control reporting |
Disclosures permitted by law but requiring care include reporting abuse, neglect, or certain communicable diseases to public-health authorities (see Chapter 1.5 for Indiana mandatory reporting) — these are allowed without authorization but should be routed through the licensed nurse or privacy officer.
Disclosures that are not permitted without authorization include:
- Sharing information with a resident's family member who is not on the approved contact list
- Discussing a resident with a friend, neighbor, or coworker not on the care team
- Posting anything about a resident on social media — even without a name ("my favorite resident today…" can be PHI if the details identify the person)
- Texting resident information over a non-secure app
- Confirming to a caller that a resident is in the facility
Confidentiality Breaches: Common CNA Pitfalls
- Hallway and elevator conversations: discussing a resident where visitors or other residents can hear
- Unattended screens: leaving an EHR screen logged in while stepping away
- Paper charts in view: leaving a chart or worksheet on a counter where visitors can read it
- Social media: any post about a resident, including vague "had a tough day with a resident" posts that include identifying detail
- Unsecured texts: texting PHI over a personal cell phone to a coworker
- Lunchroom chatter: gossip about residents among staff not on the care team
- Family oversharing: telling a family member another resident's diagnosis, room, or condition
A breach must be reported to the charge nurse and the facility privacy officer as soon as it is recognized. Indiana facilities are required to notify the resident and, for breaches affecting 500+ individuals, the U.S. Department of Health and Human Services. A CNA who causes a breach may face facility discipline and, if willful, a substantiated INAR finding.
Residents' Rights Under HIPAA
Every resident has the right to:
- See and obtain a copy of their own medical record (request routed through the privacy officer; CNAs do not hand records directly to residents)
- Request an amendment to information they believe is inaccurate
- Receive a Notice of Privacy Practices explaining how the facility uses PHI
- Request restrictions on certain disclosures
- Confidential communications — for example, asking to be contacted only at a certain number
Family members do not automatically have these rights unless the resident has designated a personal representative under a durable power of attorney (see Section 8.3). A spouse asking to see the chart is not automatically entitled — route the request to the nurse and privacy officer.
End-of-Shift Report: SBAR
End-of-shift report is the verbal and written handoff between the outgoing and oncoming CNA. A structured format reduces missed information and adverse events. Indiana CNA programs teach SBAR:
| Letter | Element | What the CNA Reports |
|---|---|---|
| S | Situation | Resident's name, room, current status, and anything acute right now |
| B | Background | Diagnoses, ADL level, mobility, diet, recent changes, family context |
| A | Assessment | What the CNA observed this shift — vitals, intake/output, skin, mood, anything abnormal |
| R | Recommendation | What the oncoming CNA should watch for, scheduled tasks, follow-ups |
Worked SBAR Example
Resident: Mrs. R, Room 214, 87-year-old female.
Situation: "Mrs. R in 214, alert and oriented × 2 this shift. Currently resting in bed, no acute complaints.** Background: "Diagnoses include Type 2 diabetes, right-sided stroke with left hemiparesis, and a Stage II sacral pressure ulcer. Normally needs a two-assist transfer with a gait belt. Diet is mechanical soft, nectar-thick liquids.** Assessment: "Vital signs at 14:00 stable — BP 132/84, P 78, R 16, T 98.4°F oral. I&O: intake 720 mL, output 480 mL. Ate 60% of lunch. Sacral pressure ulcer dressing intact per LPN, no new drainage. Left hand was cool to touch at 13:00, reported to LPN Smith.** Recommendation: "Turn q 2 hours per schedule; next turn at 16:00 to right side. Watch left hand color and temperature — LPN said she will re-check at 16:30. Encourage fluids; goal is 1500 mL by end of shift. Family (daughter) called and asked for a call back; please have the nurse call her.**
Verbal Report Etiquette
- Give report in a quiet, private area — not the hallway, elevator, or cafeteria
- Speak only about residents on your assignment; do not comment on other CNAs' residents
- Use the resident's name and identifiers as needed for accuracy; do not use nicknames or labels
- Be concise — SBAR is a handoff, not a story
- Save questions for the end; let the oncoming CNA finish receiving report first
- Avoid personal opinions about the resident or family
- Do not disclose PHI where visitors can overhear
Common HIPAA Traps
- Confirming a resident is a patient: a caller asks "is John Smith there?" — do not confirm; route to the nurse or designated information desk
- Posting on social media: even positive posts ("so proud of my resident today") can be a breach if the resident is identifiable
- Discussing residents at lunch: lunchroom talk that visitors can overhear is a breach
- Sharing login credentials: a coworker logging in as you is a security violation and falsification risk
- Family questioning: a family member asks "how is Mrs. X doing?" — verify they are on the approved contact list before sharing anything, and share only what is appropriate to the relationship
A CNA wants to post on social media: "Had a great day with my favorite resident — she's 92 and still sharp!" with no name or photo. Is this allowed under HIPAA?
In a SBAR end-of-shift report, which element is the CNA's own observation from the shift?
A visitor at the nurses' station asks the CNA, "How is my mother's roommate doing? She looked upset today." What is the correct CNA response?
Which of the following is a permitted HIPAA disclosure under Treatment, Payment, or Operations (TPO)?