Question

Difficulty: MediumConfidentiality and Information Security

An adult client is evaluated in an outpatient clinic and tests positive for a sexually transmitted infection (STI). Later that day, the client's spouse, who is officially listed as the emergency contact in the electronic health record (EHR), calls the clinic. The spouse states, "I know my partner was tested today. As their spouse and emergency contact, I have a right to know the results so I can protect my own health." There is no signed authorization form on file permitting disclosure to the spouse. Which of the following is the most appropriate response by the nurse?

  1. "I cannot confirm or share any test results without explicit authorization from the client."Answer
  2. B
    "Because you are listed as the emergency contact, I can have the healthcare provider call you back with the results."
  3. C
    "I understand your concern, but I can only suggest that you discuss this matter directly with your spouse."
  4. D
    "I am required to report this to the health department, who will contact you regarding partner notification."

Answer

The nurse must state that they cannot confirm or share any test results without explicit authorization from the client.
Under standard privacy regulations, a nurse cannot disclose Protected Health Information (PHI)—which includes confirming whether a test was performed or sharing its results—to a spouse or family member without explicit, documented consent from the competent adult client. Being listed as an emergency contact only permits information sharing during an actual medical emergency where the client is incapacitated. It does not grant proxy access to routine medical records or STI test results. The nurse must provide a neutral response that neither confirms nor denies the client's health status.

Step-by-Step Solution

1
Identify the caller's request and relationship to the client.
The caller is the spouse and designated emergency contact, requesting STI test results.
Determining the caller's identity is the first step in assessing what information, if any, can be legally released.
2
Review the electronic health record for a signed HIPAA release of information.
There is no signed authorization form on file permitting disclosure to the spouse.
Written consent is legally required to share Protected Health Information (PHI) with family members in non-emergency situations.
3
Evaluate the legal permissions granted by an 'emergency contact' designation.
An emergency contact designation only allows information sharing during a true medical emergency where the client is incapacitated, not for routine test results.
Nurses must differentiate between proxy access to routine records and emergency notification protocols.
4
Formulate a response that maintains strict confidentiality.
The nurse must decline to provide the information without confirming or denying that the client was even seen at the clinic.
Even confirming that a test was performed is a breach of confidentiality.

Key Concept

Confidentiality and Release of Protected Health Information (PHI)
Rate this question