Training Module — New Hire 03: HIPAA & Confidentiality

Policy Reference: NC-04 — HIPAA Privacy

Learning Objectives

By the end of this module, you will be able to:

1. Define Protected Health Information (PHI) and give three examples.
2. Explain the Minimum Necessary standard and apply it to your role.
3. Identify three situations where patient information may be shared without a written authorization.
4. Describe what to do if you suspect a PHI breach.
5. List three HIPAA violations that could result in disciplinary action.

Key Points

What Is PHI?
Protected Health Information (PHI) is any information about a patient's health condition, care, or payment for care that could identify them. This includes:

• Name, address, date of birth, phone number
• Medical diagnoses, medications, treatment plans
• Photos, even without names if they show identifiable features
• Information in visit notes, schedules, or care plans

The Minimum Necessary Rule
You should only access, use, or share the minimum amount of patient information needed to do your job. If you're a companion aide, you don't need to know a patient's complete medical history — only what's necessary to provide safe, appropriate companion care.

When Can You Share Without Authorization?
HIPAA allows sharing PHI for:

1. Treatment — Telling the on-call nurse about a change in a patient's condition
2. Payment — Billing for services rendered
3. Operations — Supervisor reviewing your visit note for quality purposes

Everything else requires written patient authorization.

The Golden Rules for Caregivers

• Never discuss patients outside of work — not with friends, family, neighbors, or on social media.
• Never photograph patients — not even for "personal memories."
• Lock your phone — if you use it for scheduling, it contains PHI.
• Don't leave paperwork visible — schedule printouts, visit notes, and care plans contain PHI.
• Don't discuss patients in public — not in hallways, waiting rooms, parking lots, or restaurants.

Social Media Is the #1 HIPAA Risk for Caregivers
Posting anything about your work that could identify a patient — even without using their name — is a HIPAA violation. "Just helped my sweet 90-year-old patient get dressed 😊" is a violation if anyone could identify who you mean. Don't post about patients. Period.

If You Suspect a Breach
A breach is any unauthorized access to or disclosure of PHI. Examples: leaving a care plan at a patient's home visible to others, sending a text about a patient to the wrong number, or losing a phone with patient schedules on it.

Report immediately to your supervisor. Do not try to assess or handle it yourself. Under HIPAA, affected patients must be notified within 60 calendar days of discovering a breach. Delays in reporting to your supervisor shorten the time available for investigation and notification, which can result in federal penalties for the agency.

Device Security — Screen Lock and Auto-Logoff
If you use any electronic device (phone, tablet, laptop) that contains or accesses patient information:

• Enable a screen lock with a PIN, password, or biometric authentication.
• Set the device to auto-lock after no more than 15 minutes of inactivity.
• Never leave a device unlocked and unattended in a patient's home or any public area.
• Log out of all patient-related applications when your session is complete.

Real-World Scenario

Linda is a home health aide. After a tough shift where her patient had a particularly difficult day, she posts on Facebook: "Some days this job is heartbreaking. You really bond with your patients and it's hard to watch them struggle. Today was one of those days." Several of Linda's Facebook friends live in the same neighborhood as her patient. One of them recognizes the timeframe and general description.

Is this a HIPAA violation? Potentially yes — if the post could enable identification of the patient, it may constitute impermissible disclosure of PHI. Even without using the patient's name.

What Linda should have done: Keep her feelings private, or share them in a general way that could not be connected to any specific patient — and only with people who have no connection to her work.

The lesson: When in doubt, don't post. The momentary relief of venting is not worth your job, a $100–$50,000 fine, and the damage to a patient's privacy.