Confidentiality-Information Security Practice Test 2
Confidentiality-Information Security NCLEX Practice Test
Confidentiality-Information Security is a key topic within the NCLEX test plan, located under Safe and Effective Care Environment → Management of Care → Advocacy → Confidentiality-Information Security. This section underscores HIPAA compliance, professional boundaries, and safe information handling in nursing practice. Each test contains 50 questions designed to mirror the difficulty and variety of the real exam.
This is the 2nd part of the Confidentiality-Information Security series. To explore all practice tests under this topic, use the “Back to Main Topic” button at the end of the page.
Continue Learning
In the Confidentiality-Information Security Study Cards section, shared by real NCLEX candidates, you’ll find concise summaries and high-yield insights related to the most tested concepts. It’s a perfect space to reinforce challenging topics and sharpen your recall through quick, focused repetitions. Short, powerful, and repeatable!
Confidentiality-Information Security Practice Test 2
A client is in an outpatient substance misuse treatment center, and will be moving to their hometown. They request a copy of their protected health information. What is an acceptable response by the nurse to this client?
- "Our clinic can provide you a copy of your PHI once your clinic bills are paid in full."
- "Our clinic will only allow you to review your PHI on a computer within the clinic."
- "Our clinic will provide your PHI, but you must pick up the copy at the front desk."
- "Our clinic can send your PHI to your email after you make a formal request."
Explanation: Answer reason: " Clients have a legal right to access their health information in the form and format they request when readily producible, after completing the facility’s required request/identity-verification process. Providing access cannot be conditioned on paying outstanding bills, so delaying release until bills are paid is inappropriate. Limiting access to only onsite viewing is overly restrictive because copies/electronic transmission are permissible methods of access. Requiring in-person pickup is not necessary when secure electronic delivery is feasible and aligns with the client’s request for access while relocating.
Mr. Leskyf is admitted to the local psychiatric facility. While in the cafeteria, his wife overhears two health care workers discussing his condition. Which term would most accurately describe this situation?
- Libel
- Breach of ethics
- Breach of confidentiality
- Verbal assault
Explanation: Answer reason: Discussing a patient’s condition in a public cafeteria allows incidental listeners (including family members not currently being engaged for care purposes) to hear sensitive information. This constitutes an unauthorized disclosure of PHI and violates privacy/confidentiality standards and facility policy. Libel requires a false written statement, and verbal assault involves threatening or abusive language toward another person, neither of which is described here.
A nurse cares for an unconscious client whose spouse is at the bedside. How will the nurse respond to a visitor asking about the client's condition?
- "I can't speak with you about someone else."
- "I will refer you to the spouse to answer your questions."
- "There is significant brain injury resulting in unconsciousness."
- "You will have to ask the client what happened."
Explanation: Answer reason: " Confidentiality requires the nurse to protect a client’s private health information and disclose it only to individuals authorized by the client or legally permitted. A visitor has no automatic right to receive updates, even if a spouse is present at the bedside. Redirecting the visitor to the spouse can still result in inappropriate disclosure because the nurse would be facilitating access rather than verifying authorization or using the facility’s approved information-sharing process. Providing clinical details or telling the visitor to ask the unconscious client are both unsafe and unrealistic, and they fail to uphold privacy standards.
A nurse lawyer provides an education session to the nursing staff regarding client rights with emphasis on invasion of client rights. The nurse lawyer asks a staff nurse to identify a situation that represents an example of invasion of client privacy. Which situation, if identified by the student, indicates an understanding of a violation of this client right?
- Threatening to place a client in restraints
- Performing a surgical procedure without consent
- Taking photographs of the client without consent
- Telling the client that he or she cannot leave the hospital
Explanation: Answer reason: Photographing a patient without consent is an unauthorized capture of identifiable information and is a direct breach of privacy/confidentiality standards and institutional policies. By contrast, performing a procedure without consent is primarily an informed-consent/battery issue rather than a privacy violation. Restricting a client from leaving and threatening restraints relate more to false imprisonment and coercion, not privacy.
A mental health nurse answers the phone. A police officer asks if a patient is still being treated on the unit, and the nurse tells the officer that the patient was discharged. Which of the following is correct regarding the nurse's response?
- The response was a breach of patient confidentiality.
- The response was correct, because the nurse did not give out patient information.
- The response was correct, because the nurse only released
Explanation: Answer reason: Providing a patient’s presence on a unit, current treatment status, or discharge status to an unauthorized caller is protected health information and generally requires patient consent or a valid legal mandate. A police officer does not automatically have the right to receive confirmation of hospitalization/discharge without proper authorization, a warrant/subpoena, or an applicable exception. Even minimal “directory” information is typically limited and may be restricted further in behavioral health settings, where privacy protections are especially strict. The safest nursing action is to decline to confirm or deny and route the request through the facility’s established release-of-information process.
An 8-year-old hospitalized due to a bowel obstruction is to be discharged home with a temporary colostomy. The parents' primary language is Vietnamese and their English proficiency is very limited. What is the best approach for the nurse to use when instructing the parents on how to care for the child at home?
- Demonstrate the procedure using simple English phrases
- Give the parents written instructions with picture illustrations
- Tell the parents to have a friend or relative come in to translate
- Use an interpreter via the telephone interpretation service
Explanation: Answer reason: A trained medical interpreter supports informed decision-making, prevents errors from misunderstandings, and allows real-time clarification and teach-back. Using friends/relatives as translators risks inaccuracies, omissions, and confidentiality problems, and may distort sensitive information. Simple English phrases or pictures can support learning but are insufficient as the primary strategy when English proficiency is very limited and the care is high risk.
A nurse cares for a school-age client with the human immunodeficiency virus (HIV). The client’s parents report they do not intend to inform the school of the diagnosis. Which response by the nurse is appropriate?
- "Your child’s diagnosis is private, and it is your right to maintain confidentiality."
- "The healthcare provider is legally required to inform school officials of the diagnosis."
- "The client will need an individualized education plan to attend school."
- "The school must be informed to protect school personnel and other students."
Explanation: Answer reason: " HIV status is protected health information and should not be disclosed without appropriate consent except in specific, legally defined reporting situations. Schools generally do not require notification of a student’s HIV diagnosis for attendance because standard precautions are the primary method to protect staff and students. Telling parents they “must” disclose or that the provider is “legally required” to inform the school is inaccurate in most settings and violates confidentiality principles. The nurse should support privacy rights while reinforcing routine infection-control practices and addressing any safety concerns through appropriate channels.
A multidisciplinary care team is discussing an ethical dilemma regarding whether or not to tell the partner of a patient who is HIV sero-positive the status of the patient. The patient has requested that the status be kept confidential. The team decides to tell the partner. On what ethical basis have they made this decision?
- Confidentiality has been prioritized below autonomy.
- The team values veracity over autonomy.
- The team prioritizes autonomy higher than duty.
- Fidelity is valued higher than veracity.
Explanation: Answer reason: Ethically, clinicians may breach confidentiality when there is a serious, foreseeable risk of harm to an identifiable third party and disclosure is necessary to reduce that risk. Informing a sexual partner about HIV exposure reflects prioritizing the protection of others’ ability to make informed decisions about their own health and preventing harm, even when the patient requests secrecy. This is not primarily about truth-telling as an abstract duty (veracity); it is about overriding confidentiality in the context of competing obligations to others’ rights and safety. Options focusing on fidelity or ranking autonomy “higher than duty” do not fit the scenario because the key conflict is confidentiality versus duties to warn/protect third parties.
A nurse is caring for a patient suspected to be the victim of abuse. The patient agrees to tell the nurse about his/her experience if the nurse agrees not to tell anyone about it. Ethical standards require the nurse to act in which of the following ways?
- The nurse uses the principle of veracity and informs the patient that they will only tell the information to the appropriate authorities.
- The nurse promises to not tell in order to obtain safety information as a matter of fidelity.
- The nurse explains to the patient that the nurse must obtain the information by the principle of duty.
- The nurse informs the patient that the nurse does not need to know this information citing the principle of confidentiality.
Explanation: Answer reason: Veracity requires the nurse to be truthful about limits of confidentiality and what must be reported. In suspected abuse, nurses have legal/ethical mandatory reporting duties, so promising secrecy would be deceptive and could obstruct protection and follow-up. The best response is to explain up front that information will be shared only with those who must know (e.g., appropriate authorities) to ensure safety and comply with reporting laws. A common error is invoking fidelity to justify a promise of nondisclosure; ethical loyalty cannot override mandated reporting and patient protection.
A nurse receives a phone call from a family member asking for health-related information on a client being treated for suspected myocardial infarction in the Emergency Department. The nurse explains she cannot disclose personal information about the client without the client’s consent. The nurse knows this represents which of the following ethical principles?
- Accountability
- Autonomy
- Beneficence
- Confidentiality
Explanation: Answer reason: Refusing to share ED treatment information with a family member without the client’s consent directly reflects protection of privacy and compliance with information-security standards (e.g., HIPAA). Autonomy relates to the client’s right to make decisions, but the key issue here is safeguarding information rather than choosing a treatment. Beneficence and accountability involve acting in the patient’s best interest and being responsible for care, respectively, but they do not specifically address nondisclosure of protected health information.
The nurse is in an elevator and overhears two staff members discussing a client's condition. Which ethical principle does the nurse recognize may be potentially violated by this conversation?
- Beneficence
- Confidentiality
- Autonomy
- Veracity
Explanation: Answer reason: Protected health information must be shared only with individuals who have a legitimate need to know and in a manner that prevents unauthorized disclosure. Discussing a client’s condition in a public setting like an elevator risks being overheard by visitors or other patients, which constitutes a breach of privacy and confidentiality. Beneficence focuses on promoting the client’s good, not information control; autonomy concerns the client’s right to make informed choices. Veracity relates to truth-telling, which is not the primary issue in this scenario.
A well-known celebrity is admitted to the psychiatric unit. Several RNs from other units drop by and express an interest in seeing the patient. What is the best response?
- “Please be discreet and do not interrupt the work flow.”
- “How did you find out that the patient was admitted to this unit?”
- “Please wait. I need to call the nursing supervisor about this request.”
- “I’m sorry; the patient has asked that only family be allowed to visit.”
Explanation: Answer reason: ” The core principle is protecting patient privacy and enforcing visitation boundaries, especially on a psychiatric unit where confidentiality is critical. The appropriate nursing response is to deny access to staff who are not involved in the patient’s care and to do so without confirming or discussing clinical details. This option sets a clear limit while preserving privacy and reducing unit disruption, aligning with HIPAA and professional ethics. In contrast, redirecting to “be discreet” minimizes the issue and does not stop an improper visit, and calling a supervisor delays immediate boundary-setting when the nurse can appropriately refuse the request.
The nurse supervises an LPN/LVN and an unlicensed assistive personnel (UAP). The nurse determines a breach of client confidentiality has occurred when which action is observed?
- The LPN/LVN places confidential client information on a desk outside the client’s room when called into another client’s room next door.
- The LPN/LVN informs the UAP, who is providing care to a client, that the client requires assistance with ambulation.
- The LPN/LVN provides the client’s room number to the client’s adult child via telephone.
- The LPN/LVN informs the x-ray technician that a client scheduled for a chest x-ray has methicillin-resistant Staphylococcus aureus (MRSA).
Explanation: Answer reason: Client confidentiality requires safeguarding protected health information from being viewed by unauthorized individuals. Leaving confidential materials unattended in a public or semi-public area (e.g., a desk in a hallway) creates an avoidable risk of disclosure to visitors, other clients, or staff without a need to know. In contrast, sharing ambulation assistance needs with a UAP involved in the client’s care and notifying radiology about MRSA are permissible disclosures for treatment and safety. Giving a room number to an adult child over the phone is not automatically a breach if the recipient is verified and information is minimal, but it still does not surpass the clear security violation of unattended PHI in an accessible area.
A 16-year old male calls the clinic because he's worried that he might have gonorrhea. However, he doesn't want his parents to know. What should the nurse tell him?
- "We can test you without parental consent, but if there are positive results, we must notify the health department."
- "We can test and treat you, but your parents will see it on your chart."
- "I'm sorry, but you are a minor. We will need a parent's consent before we can do anything."
- "We can test and treat you. All results will be kept confidential."
Explanation: Answer reason: " Minors can generally consent to evaluation and treatment for sexually transmitted infections to promote access to care and public health. The nurse must also explain the legal limits of confidentiality, including mandatory reporting of certain infections to public health authorities for surveillance and partner-notification efforts. This option accurately balances adolescent confidentiality with required reporting, supporting informed decision-making. A common pitfall is offering absolute secrecy; confidentiality is not unlimited when reporting requirements apply.
The nurse supervisor overhears a nursing colleague giving a change of shift report to another nursing colleague. Which statement about a client would cause the nurse to intervene?
- "This client is able to bathe themselves."
- "I went to high school with this client."
- "This client needs range of motion exercises every 4 hours while awake."
- "This client requires a kosher diet."
Explanation: Answer reason: " Change-of-shift report must be limited to clinically relevant, need-to-know information to protect client privacy and maintain professional boundaries. Revealing a personal relationship/recognition introduces unnecessary identifying social information and can promote gossip or biased care, violating confidentiality expectations. The other statements describe functional status, required therapies, and diet needs, which are appropriate components of handoff communication for safe continuity of care. A supervisor should redirect the report to objective clinical data and remind staff about privacy and boundary standards.
The nurse has received a needlestick injury after giving a client an intramuscular injection, but has no information about whether the client has human immunodeficiency virus (HIV) infection. What is the most appropriate method of obtaining this information about the client?
- The nurse should personally ask the client to authorize HIV testing.
- The charge nurse should tell the client about the need for HIV testing.
- The occupational health nurse should discuss HIV status with the client.
- HIV testing should be performed the next time blood is drawn for other tests.
Explanation: Answer reason: Post-exposure evaluation requires a confidential, standardized process to determine source-patient HIV status and guide timely prophylaxis decisions. Occupational/employee health is the appropriate service to obtain informed consent, coordinate source testing per policy and law, and document the exposure while maintaining privacy. Having the injured nurse directly request testing can create coercion concerns and breaches of professional boundaries. Testing later “when blood is drawn” delays risk assessment and can inappropriately bypass consent requirements.
Think you’re ready for the NCLEX?
Run through a full 150-question exam just like the real thing. You’ll hit the 85-question checkpoint and get a clear report showing where you stand.