Editing Management of Care (section)

=== Confidentiality and information security ===
Protected health information may be disclosed only to those with a legitimate need to know for treatment, payment, or health care operations, and only the '''minimum necessary''' for the purpose (Health Insurance Portability and Accountability Act of 1996). Practical rules that appear on examinations: do not discuss patients in elevators, hallways, or cafeterias; do not access the record of a patient not in your care, including a coworker, a family member, or yourself in many facilities; log off shared workstations; position screens away from public view; verify the identity and authorization of any caller before releasing information; and do not post anything about a patient on social media, including images that seem de-identified. A nurse may share information with another member of the treatment team caring for that patient. A nurse may not share it with a family member simply because the family member asks, absent the patient's authorization.