Section 2.1: Privacy, Confidentiality, & HIPAA
Key Takeaways
- The Omnibus Budget Reconciliation Act (OBRA) of 1987 guarantees residents the right to physical privacy during all treatments and personal care.
- CNAs must always knock and identify themselves before entering a resident's room, even if the door is open, and wait for permission.
- Draping with bath blankets or privacy curtains is required to prevent unnecessary bodily exposure during hygiene and personal care.
- HIPAA protects Protected Health Information (PHI); discussing residents in public spaces or posting any resident details on social media are severe HIPAA violations.
- If a family member requests clinical details, the CNA must politely redirect the request to the charge nurse.
Privacy, Confidentiality, & HIPAA in Nursing Assistant Practice
In nursing assistant practice, privacy and confidentiality are not merely courtesy behaviors; they are legal, ethical, and clinical mandates enforced under the federal Omnibus Budget Reconciliation Act (OBRA) of 1987 and the Health Insurance Portability and Accountability Act (HIPAA) of 1996. In Utah, the Utah Nursing Assistant Registry (UNAR) and the Division of Professional Licensing (DOPL) place a heavy emphasis on these principles during both the written certification exam and the manual clinical skills exam. Protecting a resident’s personal space and health information is foundational to establishing trust and preserving their human dignity.
1. Physical Privacy: Respecting the Resident’s Environment
A nursing home or long-term care facility is the resident's home. Under OBRA regulations, residents have the right to physical privacy during all aspects of their care, including treatments, personal hygiene, and communications.
Knocking and Entering
Every time a Certified Nursing Assistant (CNA) approaches a resident's room, they must perform the standard entry sequence. This is a critical step tested on the Utah manual skills exam.
- Knock and Pause: Always knock on the door and call out the resident’s name before entering. Even if the door is wide open, the CNA must knock and wait for permission to enter.
- Identify Yourself: State your name and title clearly (e.g., "Hello, Mrs. Jones, I am Sarah, your nursing assistant today").
- State the Purpose: Briefly explain why you are there (e.g., "I'm here to help you get dressed for breakfast").
Exam Trap: Do not assume that a resident who is comatose, confused, or unresponsive does not require a knock. Always treat every resident with the same standard of dignity. Knock, identify yourself, and explain your actions.
Draping and Visual Screens
During physical care—such as bathing, dressing, changing incontinence briefs, or performing perineal care—the CNA is legally obligated to protect the resident's body from visual exposure.
- Privacy Curtains: Always pull the privacy curtain completely around the bed area before initiating any care. This includes shutting the door to the room and closing window blinds if they face a public area.
- Draping Techniques: Use a bath blanket or a clean sheet to cover the resident’s body. Only expose the specific body part that is being washed or treated. For example, during perineal care, keep the resident's chest and legs covered, pulling back the drape only to access the perineum, and replacing it immediately when finished.
- Public Visual Protection: Ensure that if another staff member or visitor enters the room, the privacy curtain prevents them from seeing the resident's exposed body.
2. Informational Privacy & HIPAA Standards
The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that protects a patient's Protected Health Information (PHI). PHI includes any identifying information—such as names, dates of birth, medical diagnoses, treatment plans, social security numbers, and billing records—whether written, electronic, or spoken.
Protecting Patient Records
CNAs handle PHI daily through flow sheets, charts, and electronic documentation systems. Protecting this data requires active vigilance:
- Computer Terminals: Always log off computer systems immediately after documenting care. Never leave a screen visible containing resident data. Never share passwords.
- Paper Charts: Close all paper charts and place them in their designated, secure storage racks. Do not leave charts lying face-up on the nurse's station counter.
- Report Sheets: Many CNAs use shift report sheets to track tasks. These sheets contain highly sensitive PHI. They must never be left in public spaces or taken home. At the end of the shift, they must be disposed of in a designated facility shredder box.
Verbal Confidentiality
Confidentiality extends to verbal communications. Sharing resident information is permitted only with members of the direct healthcare team who have a legitimate "need to know" to perform their duties.
- Elevator and Hallway Discussions: Never discuss a resident's condition, behaviors, or personal details in public areas like hallways, cafeteria lines, breakrooms, or elevators. Even if names are not used, details can easily identify a resident to listening visitors.
- Inquiries from Family and Friends: If a resident’s family member, friend, or visitor asks about the resident’s medical condition, the CNA must redirect them.
- Correct Action: "I would be happy to have the nurse speak with you about Mr. Smith’s progress."
- Rationale: The CNA scope of practice does not permit sharing medical diagnoses, lab results, or clinical prognoses.
Social Media Restrictions
In the digital age, social media is a frequent source of severe HIPAA violations.
- Zero Tolerance: CNAs must never take photos or videos of residents, even if the resident requests it or if it seems harmless. Posting any resident information, photographs, or descriptive stories online is a violation of federal law and will result in immediate termination, registry action by UNAR, and potential criminal charges.
3. Privacy Action Guide
| Clinical Scenario | Common Violation (The Trap) | Correct CNA Action (Exam Answer) |
|---|---|---|
| Entering a resident room | Walking straight in because the door is open. | Knock, wait for response, identify yourself and your role. |
| Bathing a resident | Leaving the resident completely uncovered while fetching clean towels. | Cover the resident with a bath blanket; expose only one limb or area at a time. |
| Discussing a resident | Talking to another CNA about a resident's aggressive behavior in the cafeteria. | Discuss care details only in private shift reports or closed staff conferences. |
| Using electronic charting | Leaving the tablet logged in on the bedside table while helping a roommate. | Log out of the device before moving away from the immediate workspace. |
| Family inquiries | Telling a resident's daughter details of a recent fall or new medication. | Polite redirection: Refer the family member to the charge nurse for clinical updates. |
| End-of-shift notes | Taking a report sheet home "to finish charting later." | Place the sheet in the designated PHI shredder box before leaving. |
4. Scenario: The Unsecured Chart and the Curious Visitor
Scenario: While working a busy day shift at a Utah skilled nursing facility, CNA Maria completes her documentation on Mrs. Gable’s morning intake and output. The charge nurse calls Maria to help with an emergency transfer. Maria leaves Mrs. Gable’s paper chart open on the desk at the nurses' station. A visitor of another resident stands at the desk and begins reading the open chart.
Analysis: This is a direct HIPAA violation. Even though Maria left the desk due to a patient safety emergency, she failed to secure the PHI.
- Consequences: The facility could face regulatory fines, and Maria could face disciplinary action from her employer and UNAR.
- Preventative Action: If called away, Maria should have closed the binder and placed it face down or slipped it into the secure chart rack, which takes less than two seconds.
Utah examiners frequently test whether candidates prioritize privacy even under time pressure. The correct habit is automatic: secure PHI first, then respond to the next urgent task.
After documenting morning vital signs on a facility tablet, a CNA is called to help transfer a resident in another room. What must the CNA do before walking away from the tablet?
At the end of a shift in a Utah long-term care facility, a CNA has a handwritten assignment sheet that lists resident names, room numbers, and care tasks. What is the correct way to handle this sheet?