7.3 HIPAA, Advance Directives & ND Long-Term Care Ombudsman
Key Takeaways
- The Health Insurance Portability and Accountability Act (HIPAA) legally safeguards all Protected Health Information (PHI), restricting access strictly to healthcare team members with a direct clinical need-to-know.
- CNAs must prevent privacy breaches by never discussing resident care in public areas (hallways, elevators, cafeterias), logging out of electronic health records, properly shielding charts, and never taking photos, recording videos, or posting any resident details on social media.
- Advance Directives—including Living Wills, Durable Power of Attorney for Healthcare (Healthcare Proxies), and DNR orders—legally record a resident's end-of-life and medical care choices, which CNAs must understand, respect, and communicate to the nurse during acute emergencies.
- The North Dakota Long-Term Care Ombudsman Program provides free, confidential, independent advocacy for residents in long-term care, investigating grievances and ensuring resident rights, safety, and quality of life are upheld.
- Resident Councils and Family Councils are independent forums that empower residents and their families to influence facility policies, dining services, and activities; CNAs support councils by assisting with attendance and honoring resident voice.
HIPAA, Advance Directives & ND Long-Term Care Ombudsman
Providing exceptional nursing assistant care requires mastering not only hands-on clinical skills but also the complex legal and ethical protections that safeguard resident autonomy, confidentiality, and representation. In long-term care, three interconnected legal frameworks protect vulnerable residents:
- The Health Insurance Portability and Accountability Act (HIPAA): Safeguards confidential medical and personal data.
- Advance Directives & Code Status Directives: Preserves self-determination in life-sustaining treatments and end-of-life care.
- The North Dakota Long-Term Care Ombudsman Program & Resident Councils: Guarantees independent advocacy, representation, and prompt resolution of resident grievances.
+-----------------------------------------------------------------------------+
| LEGAL SAFEGUARDS IN LONG-TERM CARE |
| |
| [HIPAA PRIVACY RULE] ---> Protects Protected Health Info (PHI) |
| [ADVANCE DIRECTIVES] ---> Enforces Living Wills, Proxies & DNRs |
| [ND OMBUDSMAN PROGRAM] ---> Independent, confidential state advocate|
| [RESIDENT COUNCILS] ---> Democratic resident-run facility forums |
+-----------------------------------------------------------------------------+
1. HIPAA & Protected Health Information (PHI)
Enacted by Congress in 1996, the Health Insurance Portability and Accountability Act (HIPAA) establishes federal standards for the privacy and security of health data. The HIPAA Privacy Rule grants residents comprehensive federal protection over their Protected Health Information (PHI).
What Constitutes Protected Health Information (PHI)?
PHI includes any individually identifiable health information created, received, transmitted, or maintained in any medium (verbal, written paper, or electronic digital format):
- Resident full name, aliases, room number, or telephone number
- Dates (date of birth, admission date, discharge date)
- Social Security Number or Medical Record Number (MRN)
- Clinical diagnoses, medical history, progress notes, and nursing care plans
- Vital signs, laboratory reports, diagnostic imaging, and medication lists
- Photographic images, video clips, or audio recordings of the resident
- Billing records, insurance information, and financial data
+-----------------------------------------------------------------------------+
| THE "NEED-TO-KNOW" PRINCIPLE |
| |
| Being an employee of a healthcare facility DOES NOT give you the right to │
| view, access, or discuss the medical records of every resident in the │
| building. |
| |
| You may ONLY access information for residents SPECIFICALLY ASSIGNED TO │
| YOUR DIRECT CARE during that specific shift. |
+-----------------------------------------------------------------------------+
Permitted vs. Unlawful Disclosures of Information
| Permitted Clinical Communication | Unlawful Privacy Breach (HIPAA Violation) |
|---|---|
| Giving a private shift-to-shift report to the oncoming CNA in a closed conference room. | Discussing a resident's dementia, incontinence, or diagnosis in the hallway, elevator, or cafeteria. |
| Reporting an abnormal blood pressure or fall immediately to the supervising charge nurse. | Telling your spouse, friends, or roommates at home about an interesting resident you cared for today. |
| Answering clinical questions asked by the resident's attending physician or assigned physical therapist. | Answering questions from a curious visitor, neighbor, or family member of another resident. |
| Viewing the care plan of a resident assigned to you for that shift. | Opening the electronic medical chart of a friend, celebrity, neighbor, or family member not assigned to you. |
| Logging off a computer terminal immediately after charting vital signs. | Leaving an active electronic health record (EHR) screen unattended and visible to passersby. |
2. Practical Confidentiality Protocols & Social Media Prohibition
In the modern digital healthcare environment, confidentiality violations occur most frequently through carelessness with paper records, computer terminals, and mobile smartphones.
+-----------------------------------------------------------------------------+
| FOUR CORE CONFIDENTIALITY SAFEGUARDS |
| |
| [1. VERBAL PRIVACY] ---> Lower your voice; never talk in public |
| areas (hallways, cafeteria, elevators). |
| |
| [2. PAPER SECURITY] ---> Keep care sheets face down; discard in |
| locked HIPAA shredding bins only. |
| |
| [3. COMPUTER SECURITY] ---> Never share passwords; log out whenever |
| stepping away from the workstation. |
| |
| [4. ZERO DIGITAL TOLERANCE] ---> NEVER photograph, record, or post about |
| residents on social media platforms. |
+-----------------------------------------------------------------------------+
The Absolute Ban on Social Media & Digital Photography
The use of personal smartphones and social media platforms (Facebook, Instagram, TikTok, Snapchat, X, etc.) in healthcare settings is subject to strict zero-tolerance enforcement:
- Never Take Photographs or Videos: CNAs are strictly forbidden from taking photos or videos of residents, resident rooms, treatments, or facility interiors on personal smartphones—even if the resident gives verbal permission or requests the photo.
- Never Post Resident Stories: Even if no names are mentioned, posting descriptive scenarios (e.g., "Had the sweetest 92-year-old lady in Room 12 bake cookies with me today!") is a direct federal HIPAA violation because the resident can be identified by context.
+-----------------------------------------------------------------------------+
| CONSEQUENCES OF A HIPAA PRIVACY BREACH |
| |
| [FACILITY PENALTIES] ---> Immediate termination of employment. |
| [STATE REGISTRY] ---> Disciplinary investigation, revocation of |
| CNA certification, and permanent listing on |
| the ND Nurse Aide Registry disqualification log|
| [CIVIL PENALTIES] ---> Federal fines up to $50,000 per violation |
| (up to $1,500,000 per calendar year). |
| [CRIMINAL PENALTIES] ---> Federal criminal charges, fines up to $250,000,|
| and up to 10 YEARS IN FEDERAL PRISON. |
+-----------------------------------------------------------------------------+
3. Advance Directives: Types, Purpose & Clinical Significance
Advance Directives are legally recognized written documents that allow an individual to declare their medical treatment preferences and appoint surrogate decision-makers in advance of losing cognitive capacity or decision-making ability.
+-----------------------------------------------------------------------------+
| TYPES OF ADVANCE DIRECTIVES |
| |
| [LIVING WILL] |
| - Written declaration specifying desired or refused life-prolonging |
| medical treatments in the event of terminal illness or persistent coma. |
| - Addresses ventilators, feeding tubes, dialysis, and resuscitation. |
| |
| [DURABLE POWER OF ATTORNEY FOR HEALTHCARE (HEALTHCARE PROXY)] |
| - Designates a specific trusted surrogate (Healthcare Agent / Proxy). |
| - Agent makes medical decisions ONLY when the resident loses capacity. |
| |
| [DO NOT RESUSCITATE (DNR) ORDER] |
| - A medical order signed by a physician directing staff NOT to perform |
| CPR or advanced cardiac life support if heart or breathing stops. |
| |
| [FULL CODE STATUS] |
| - Resuscitation order directing staff to initiate ALL life-saving measures|
| (chest compressions, defibrillation, artificial breaths) in arrest. |
| |
| [POLST / MOLST ORDERS] |
| - Actionable medical orders translating resident preferences into medical |
| orders that travel across all care settings (EMS, ER, nursing home). |
+-----------------------------------------------------------------------------+
Living Will vs. Healthcare Proxy Comparison
| Document Feature | Living Will | Durable Power of Attorney for Healthcare |
|---|---|---|
| Primary Function | Specifies what treatments the individual wants or refuses. | Designates who has legal authority to make medical decisions. |
| When It Takes Effect | Typically only when terminally ill, permanently unconscious, or in end-stage disease. | As soon as the attending physician certifies that the resident has lost decision-making capacity. |
| Scope | Limited to specific scenarios and treatments outlined in the text. | Broad authority to make all medical, surgical, diagnostic, and palliative decisions. |
4. CNA Responsibilities Concerning Code Status & Emergencies
Every nursing assistant must understand the immediate clinical implications of a resident's code status:
+-----------------------------------------------------------------------------+
| EMERGENCY ACTIONS: FULL CODE VS. DNR STATUS |
| |
| [IF A FULL CODE RESIDENT EXPERIENCES CARDIAC / RESPIRATORY ARREST] |
| 1. Shout for help / activate the facility emergency code alert. |
| 2. Call for the AED (Automated External Defibrillator) & crash cart. |
| 3. Immediately initiate Cardiopulmonary Resuscitation (CPR). |
| 4. Deliver high-quality chest compressions and rescue breaths. |
| |
| [IF A CONFIRMED DNR RESIDENT EXPERIENCES CARDIAC / RESPIRATORY ARREST] |
| 1. Summon the charge nurse immediately. |
| 2. DO NOT INITIATE CPR OR CHEST COMPRESSIONS. |
| 3. Stay with the resident, provide gentle touch, and ensure dignity. |
| 4. Provide emotional comfort and support to family members present. |
+-----------------------------------------------------------------------------+
[!IMPORTANT] DNR Does NOT Mean "Do Not Care": A Do Not Resuscitate order applies only at the moment of cardiac or respiratory arrest (when the resident has no pulse or breathing). It does not mean withholding daily nursing care, medications, wound care, oxygen for comfort, pain management, meals, or compassionate personal hygiene. A DNR resident receives the exact same attentive, high-quality care as a Full Code resident.
5. The North Dakota Long-Term Care Ombudsman Program
Under the federal Older Americans Act and North Dakota state law, every state operates a dedicated Long-Term Care Ombudsman Program. In North Dakota, this program is administered through the North Dakota Department of Health and Human Services (ND HHS), Aging Services Division.
+-----------------------------------------------------------------------------+
| NORTH DAKOTA LONG-TERM CARE OMBUDSMAN |
| |
| [STATUS] ---> Independent, third-party resident advocate |
| [AUTHORITY] ---> Federal Older Americans Act & ND Century Code § 50-10.1|
| [COST] ---> 100% Free, confidential service for residents/families|
| [ACCESS] ---> Unrestricted, unannounced access to long-term care |
| facilities, residents, and clinical records |
+-----------------------------------------------------------------------------+
Primary Functions of the Long-Term Care Ombudsman:
- Advocating for Resident Rights: Champions resident autonomy, dignity, quality of care, and quality of life in nursing homes, basic care facilities, and assisted living centers.
- Investigating & Resolving Grievances: Receives and investigates complaints made by or on behalf of residents regarding care deficiencies, physical environment, food quality, billing disputes, staff conduct, or involuntary discharges.
- Empowering Residents & Families: Educates residents, family members, and facility staff on resident rights, advance care planning, and state/federal regulations.
- Confidentiality & Resident Direction: Operates under strict confidentiality. The ombudsman investigates only what the resident requests and proceeds only with the resident's explicit consent.
CNA Interactions with the Long-Term Care Ombudsman:
- Facilitate Access: Never block, delay, or interfere with an ombudsman seeking to visit a resident.
- Respect Meeting Privacy: Step out of the room and close the door when an ombudsman meets with a resident.
- Assist Residents in Reaching Out: If a resident expresses a desire to contact the ombudsman, the CNA must promptly provide the ombudsman's contact information or notify the charge nurse/social worker to assist the resident.
6. Resident Council & Family Council: Structure & Support
Federal OBRA regulations mandate that Medicare- and Medicaid-certified long-term care facilities provide dedicated space, administrative assistance, and private meeting accommodations for Resident Councils and Family Councils.
+-----------------------------------------------------------------------------+
| RESIDENT COUNCILS VS. FAMILY COUNCILS |
| |
| [RESIDENT COUNCIL] [FAMILY COUNCIL] |
| - Self-governing democratic forum - Self-governing forum organized by |
| composed entirely of residents. family members and legal guardians.|
| - Elects resident officers. - Provides mutual family support. |
| - Discusses dining, activity plans, - Advocates for facility improvements|
| roommates, policies, & concerns. and resident welfare. |
| - Submits formal written recommendations to facility administration. |
| - Facility administration MUST respond in writing to council concerns. |
+-----------------------------------------------------------------------------+
CNA Role in Supporting Councils:
- Assisting with Attendance: Check the activities calendar, remind interested residents of upcoming council meetings, and assist them with grooming, dressing, and timely transport to the meeting room.
- Respecting Privacy: Staff members do not attend Resident Council meetings unless specifically invited by the council to give a presentation or answer questions.
- Implementing Council Feedback: Actively incorporate council recommendations (such as preferred dining routines or activity choices) into daily caregiving.
A Certified Nursing Assistant observes a coworker taking a photograph of an elderly resident in the activity room using a personal smartphone and posting it on social media with an affectionate birthday greeting. How should this action be evaluated under federal HIPAA regulations?
A nursing assistant enters the room of a resident who has a documented Do Not Resuscitate (DNR) order and discovers that the resident is unresponsive, pulseless, and not breathing. What is the immediate, correct action for the CNA?
Which of the following statements accurately describes the primary function of the North Dakota Long-Term Care Ombudsman?
A resident's visitor approaches a CNA in the facility hallway and asks detailed questions regarding the medical condition, diagnostic lab results, and prognosis of another resident in the next room. How should the CNA respond?