Student Nurse HIPPA Violation

[MN17]

I'm a nursing student and just started out with hospital clinicals this semester. My clinical instructor spoke briefly about a student who cut and pasted information from the EHR into their nursing care plan and how it saved them a lot of time.

Yesterday I was in my patient's chart and copied and pasted some information into my personal gmail account to help me complete my care plan. I was having trouble copying some lab values, so I took a couple of screenshots, pasted them into my gmail account and sent myself the email.

At the time I was in a hurry and obviously wasn't thinking it through. Later that day I realized how serious my error was. I sent PHI through an unsecured email system. I was HIPPA trained a few months back and of course, after the fact I remembered that we were not supposed to remove copies of PHI from the facility. This definitely would be considered removing PHI from the facility.

I know I messed up, and I know that there could be severe penalties for my error. My question is, what would you do? What is the likelihood that my breach will be discovered? Would it be better to turn myself in now, or just wait it out and see if it comes back to haunt me?

Please don't lecture me about how badly I messed up--I already know that.

[MN17]

Please forgive the misspelling, I meant HIPAA of course.

[BuckyBadgerRN, ASN, RN]

Chances are VERY good that you'll be found out, so confessing ahead of that might be in your best interest. HOWEVER, no matter what, you should fully expect to be kicked out of your program, what you did was such a gross and blatant violation that they really have no choice. You've compromised your entire school from ever being invited back through those doors as a clinical site--you ARE a guest there and they do not have to invite students in.

[JustBeachyNurse, LPN]

The fact that you not only took screen shots but accessed your personal unsecured gmail account from a facility computer will likely be caught sooner than later. They often track keystrokes in addition to what exact sites are accessed.

Your best and only option is to come forward to your instructor before the facility contacts your school.

[KRVRN, BSN, RN]

The screen shots had the pt name on them I assume? It's probably best to self report and admit it was a mistake.

[anitalaff, BSN, RN]

If you took screenshots and sent them to email through your phone, then that action cannot be tracked. If you accessed your mail account through the facility computer, it can. I don't have any advice about what you should do.

I wonder who this instructor was who advised students to copy and paste from patients' health records? I'd like to have a quiet word with that person.

[llg, PhD, RN]

If you took screenshots and sent them to email through your phone, then that action cannot be tracked. If you accessed your mail account through the facility computer, it can. I don't have any advice about what you should do.

I wonder who this instructor was who advised students to copy and paste from patients' health records? I'd like to have a quiet word with that person.

I would probably be having a not-so-quiet word with the Dean and that faculty member would never be teaching at my hospital again.

Wow!

[FolksBtrippin, BSN, RN]

Did you take the screenshot with your phone, like a photo? Did you send it through your phone? We are not able to cut and paste or screen shot in the EMR even if we tried.

I do not believe in throwing yourself under the bus for no reason. When it protects someone, or helps someone, then yes.

[kaylee.]

sleep on it, don't rush into reporting it, especially when not thinking things through is what caused this to begin with (I say that because you realized right after what you did!).

If the teacher hadn't made the suggestion, you probably would not have done it. So its not entirely on you.

Yes that was bad, but you are a student. You learned how easily a slip up can occur. that is a valuable lesson.

Call me unethical and a terrible nurse. It is unlikely to be "found". Sorry, but if you knew with a high level of confidence, that you would be kicked out without consideration of the situation, why would you risk everything over this?

I dont see the world in black and white.

[JustBeachyNurse, LPN]

sleep on it, don't rush into reporting it, especially when not thinking things through is what caused this to begin with (I say that because you realized right after what you did!).

If the teacher hadn't made the suggestion, you probably would not have done it. So its not entirely on you.

Yes that was bad, but you are a student. You learned how easily a slip up can occur. that is a valuable lesson.

Call me unethical and a terrible nurse. It is unlikely to be "found". Sorry, but if you knew with a high level of confidence, that you would be kicked out without consideration of the situation, why would you risk everything over this?

I dont see the world in black and white.

If she used the hospital computer to access gmail from the same computer she was working in she has a high risk of getting caught knowing how the security of 21CFR Part 11 compliance for EMR work.

I didn't even think of the other scenario: If she used her phone to take pictures and emailed using her personal device not the brightest choice but delete the photos & email immediately. If someone saw you and reports you then confess and apologize.

Again, If you accessed gmail from the hospital computer while having the EMR screen open (Im surprised cut & paste and screenshots eye not disabled) then it will likely set a flag off in IT security it may take a bit for them to catch up with you. Review you school policy and any policy paperwork you received from the hospital to determine how to proceed. If you have student malpractice insurance from NSO or Marsh/ProLiablity both have clauses for HIPAA violations. Call for advice

[nurse2033, MSN, RN]

What isn't clear is if patient information was in the screen shot. As an educator (different legal status than a student) I take screen shots of labs all the time. But, I am always careful to leave any patient identifier out of the screen shot. I think this is a critical difference. If the patient name or number was visible, then yes it is an obvious violation.

[carolinapooh, BSN, RN]

That might explain the cutting and pasting mentioned by the instructor - do so without PHI.

We used to do that all the time - without IDing information, however. Without ID it's just a bunch of lab values.

OP, if it was just the numbers, I'd relax. And for those who wanted to hang the instructor - my guess is, if this is what she meant, you might be able to put a stop to it, but you couldn't nail her for a HIPAA violation. There's no difference in cutting and pasting the numbers and RECOPYING them to another piece of paper for your report!