Privacy, HIPAA, and Advance Directives

HIPAA Basics for CNAs

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 created national standards for protecting health information. The information it protects is called protected health information (PHI) — any information that identifies a person and relates to their health, care, or payment for care. For a CNA, PHI includes a resident's diagnosis, vital signs, medications, diet order, code status, and even the fact that a person is a resident in the facility.

Two rules govern a CNA's daily work:

• Need to know: You may access only the information you need to perform your assigned tasks. Reading the chart of a resident you are not assigned to — even out of concern or curiosity — is a HIPAA violation.
• Minimum necessary: When you do share information, share only what the listener needs. Telling the oncoming CNA "Mrs. L is on a pureed diet and needs feeding assistance" is appropriate; discussing her psychiatric diagnosis is not.

Who May Receive Information

Only members of the health care team directly involved in the resident's care may receive PHI. Family members, friends, other residents, and callers have no automatic right to information — even a spouse's questions are directed to the nurse. Common CNA violations to avoid:

1. Discussing residents in elevators, the cafeteria, the parking lot, or the break room
2. Telling a neighbor or friend that someone they know is in the facility
3. Posting anything about work — even without names — on social media
4. Leaving charts or report sheets where visitors can read them, or computer screens open and logged in
5. Giving information over the phone to someone claiming to be family

Violations can cost the CNA their job, their certification, and the facility heavy federal fines. If someone asks you for information about a resident, the correct response is always: "I can't discuss that — let me get the nurse for you."

Physical Privacy During Care

HIPAA covers information; OBRA covers the body. Physical privacy is the CNA's responsibility in every task:

• Knock on the door, identify yourself, and wait for a response before entering
• Close the door and privacy curtain before any care that exposes the body
• Drape the resident with a bath blanket so only the area being cared for is exposed
• Do not discuss one resident's care in front of another resident or roommate
• Provide privacy for toileting, and never leave a resident exposed on a bedpan or commode

Advance Directives

An advance directive is a legal document that states a person's wishes about future medical care, written while the person is still able to decide. The main types:

Key distinctions the exam tests: a living will is written by the person; a DNR or POLST is a physician's order based on the person's wishes. A DNR covers resuscitation only — it does not mean "do not treat." A resident with a DNR still receives full comfort care, medications, food, fluids, and personal care.

The Patient Self-Determination Act

The Patient Self-Determination Act (PSDA) of 1990 requires facilities receiving Medicare and Medicaid funds to ask every new resident whether they have advance directives, to inform them in writing of their right to accept or refuse treatment and to create directives, and to document the answer in the medical record. A facility may not condition admission or care on whether the resident has a directive.

The CNA's Role When Directives Come Up

CNAs are often the person a resident trusts enough to say, "I've been thinking about one of those living wills." The correct response is narrow and clear:

1. Listen respectfully and acknowledge the concern
2. Report it to the charge nurse promptly — the nurse arranges social work, chaplain, or administrative follow-up
3. Never interpret, explain, or advise on legal documents — that is outside CNA scope of practice
4. Never witness or sign a resident's advance directive as a staff member
5. Never discourage the resident or express personal opinions about their choices

If a resident with a DNR order is found unresponsive and not breathing, the CNA follows facility emergency policy — calling for help and knowing the resident's code status guides what the team does. The CNA never decides on their own whether to start resuscitation based on what a family member says; only the written physician's order governs.