HIPAA and Confidentiality: The Scenarios That Show Up Every Exam
Confidentiality comes down to one rule: only share client information with people who need it to care for the client. Need to know means involved in this client's care; everyone else is not, no matter who they are, which is why a spouse or adult child is on the no list unless the client agrees or they are the legal decision-maker. The narrow exceptions are things like suspected abuse reporting and certain public health duties.
Confidentiality questions are easy points once you know the rule.
The one rule
Only share client information with people who need it to care for the client.
That is it. Everything else follows.
Need to know = involved in this client’s care. Not need to know = everyone else, no matter who they are.
Who can see the information
Yes:
- Nurses caring for the client
- The client’s providers
- Therapists, pharmacists, and others treating this client
- The client themselves
- The client’s named healthcare agent
- People the client says can know
No:
- Other nurses not caring for this client
- Your own family and friends
- The client’s family, unless the client agreed
- Coworkers who are just curious
- Other clients
- Employers
- Your social media
The client’s spouse or adult child is on the “no” list unless the client says otherwise or they are the legal decision-maker. This surprises students and appears often on the exam.
The situations that get tested
A family member calls and asks about the client.
Do not confirm the client is even there without permission. Do not give information over the phone unless the client agreed and you can verify who is calling.
Best answer: ask the client first, or tell the caller you cannot share information.
A coworker not caring for the client asks about them.
Do not share. Being a nurse at the same hospital is not “need to know.”
Someone looks up a chart they are not caring for.
This is a violation, even if they do not tell anyone. Looking is the violation.
Report it.
A client asks to see their own record.
Clients have the right to see their records. Follow your facility’s process — usually a written request. Do not refuse.
Talking in the hallway or elevator.
A common test scenario. Conversations about clients belong in private areas. Not in the elevator, cafeteria, or hallway.
Social media.
Never post about clients. Not even without names. Details can identify people. This has cost nurses their licenses.
A visitor asks which room a client is in.
Check with the client first. Some clients do not want visitors or do not want people to know they are there.
Police ask for information.
Do not assume you must share. There are legal exceptions, but they are specific. Refer to your supervisor and facility policy.
A client’s information is on a screen or on paper.
Log off. Turn screens away. Do not leave papers out. Shred, do not throw away.
The exceptions
There are a few times you must or may share without permission. These are narrow.
Required reporting:
- Suspected child abuse or neglect
- Suspected elder or vulnerable adult abuse
- Certain communicable diseases
- Gunshot and some other wounds (varies by state)
- Threats of serious harm to a specific person (varies by state)
Also allowed:
- Court orders
- Some public health situations
These vary by state. The NCLEX tests the general idea: abuse reporting and certain public health duties override confidentiality.
Key point: you report suspected abuse. You do not need proof. You do not investigate. You report.
Examples
Example 1 > A client’s sister calls the unit and asks how the client is doing. What should the nurse do?
Do not give information. Ask the client whether they want information shared with their sister, and document their answer.
Example 2 > A nurse overhears two colleagues discussing a client in the cafeteria. What should the nurse do?
Speak to them about it. Move the conversation to a private place. Report it if it continues.
Example 3 > A nurse suspects a child has been abused based on injuries and the parent’s story. What should the nurse do?
Report it to the proper authority. You do not need proof and you do not investigate. Suspicion is enough, and reporting is required.
Example 4 > A client asks the nurse not to tell their family about their diagnosis. What should the nurse do?
Honor it. Document the request. Tell the team so nobody shares it by accident.
The mistakes
Assuming family has a right. They do not.
Sharing “just a little.” Any identifiable information counts.
Thinking no names means it is fine. Details can identify someone.
Looking up a chart out of curiosity. Even a friend or family member’s chart. Especially theirs.
Discussing clients in public areas. Very common in questions.
The short version
Share only with people caring for this client.
Family is not automatic. Coworkers are not automatic. Curiosity is never a reason.
Exceptions are narrow: abuse reporting, certain diseases, court orders.
When in doubt: do not share, and ask the client.
Sources
- NCSBN. 2026 NCLEX-RN Test Plan. https://www.nclex.com/files/2026_RN_Test%20Plan_English-F.pdf
- NCSBN. NCLEX Examination Candidate Bulletin, April 2026. https://www.ncsbn.org/public-files/NCLEX_Examination_Candidate_Bulletin_April_2026.pdf
Mandatory reporting rules vary by state. Follow your own state’s law and your facility’s policy in practice.
Frequently asked questions
Common follow-up questions on Prioritization, Delegation & Management of Care.
Can family automatically receive information about a client?
No. The client's spouse or adult child is on the no list unless the client says otherwise or they are the legal decision-maker, which surprises students and appears often. Being a coworker at the same hospital is also not need to know. When a family member calls, do not confirm the client is even there without permission, and ask the client first or tell the caller you cannot share information.
Is it a violation to look up a chart you are not caring for?
Yes. Looking up a chart you are not caring for is a violation even if you never tell anyone, because looking is the violation. This applies even to a friend or family member's chart, and it should be reported.
Can a client see their own medical record?
Yes, clients have the right to see their records. Follow your facility's process, which is usually a written request, and do not refuse.
When must confidentiality be overridden?
There are narrow exceptions. Required reporting includes suspected child abuse or neglect, suspected elder or vulnerable adult abuse, certain communicable diseases, gunshot and some other wounds, and threats of serious harm to a specific person, and sharing is also allowed under court orders and some public health situations. These vary by state, but the general idea tested is that abuse reporting and certain public health duties override confidentiality. You report suspected abuse without needing proof and you do not investigate.
What are common confidentiality mistakes on the exam?
Assuming family has a right to information, sharing just a little when any identifiable information counts, thinking no names means it is fine when details can identify someone, looking up a chart out of curiosity, and discussing clients in public areas like the elevator or cafeteria. Never post about clients on social media, even without names, because details can identify people and this has cost nurses their licenses. When in doubt, do not share and ask the client.
3,000+ NCLEX questions with think-like-a-nurse rationales, unfolding case studies and adaptive mock exams: free to start, no card required.
Start Free Trial →