A staff nurse assigned to a pediatric unit is notified that their spouse has been admitted to the facility's intensive care unit (ICU) following a severe motor vehicle collision. The nurse is the documented durable power of attorney for healthcare for the spouse. Anxious for a clinical update while completing their pediatric shift, the nurse uses their employee login credentials to access the electronic health record (EHR) to view the spouse's recent computed tomography (CT) scan results. Which of the following statements most accurately evaluates the nurse's action?
- The action is a breach of security protocols because employee electronic health record access is strictly limited to clients under the nurse's direct clinical care.Answer
- BThe action is legally permissible because the nurse is the designated healthcare proxy and has a statutory right to access the clinical information.
- CThe action is acceptable as long as the nurse only views the imaging reports and does not alter or add to the clinical documentation.
- DThe action is permitted provided the nurse notifies the ICU charge nurse that they are remotely accessing the record to streamline communication.
Answer
The action is a breach of security protocols because employee electronic health record access is strictly limited to clients under the nurse's direct clinical care.
The correct statement accurately identifies that using employee credentials to access the medical record of a patient not assigned to the nurse's direct care is a violation of the Health Insurance Portability and Accountability Act (HIPAA) and institutional security policies. Employees must separate their professional access privileges from their personal lives, even when they possess legal proxy rights. The proper procedure is to request clinical updates from the treating staff as a family member.
Step-by-Step Solution
Key Concept
Role-Based Access and EHR Security
Estimated Time:1m 15s