The ANA Code of Ethics, ten provisions for leaders

Several nurses tell their manager they fear retaliation if they report unsafe staffing. Which action BEST reflects the nurse leader's obligation under the ANA Code of Ethics?

1. Tell nurses to address staffing concerns directly with the union
   Sending concerns to the union hands the leader's own obligation to a third party and leaves the fear of retaliation inside the organization untouched.
2. Build a protected process for raising staffing concerns
   Provision 6 makes nurse leaders responsible for an ethical work environment, and a safe, non-retaliatory way to raise staffing concerns is the core of that duty.
3. Ask each nurse to submit the concern in a signed memo
   Requiring signed, individual reports increases the exposure the nurses fear; the barrier is retaliation risk, not a lack of documentation.
4. Remind nurses that staffing is set by the budget and cannot change
   Treating staffing as closed to discussion silences exactly the concerns the Code says nurses must be able to raise.

A dying patient's family asks to stay overnight, but unit policy limits overnight visitors to one person. What should the nurse manager do?

1. Make an exception and review the policy with the unit council
   Meeting a dying patient's family needs is a compassionate, patient-centered exception, and taking the policy to the unit council turns one case into a better rule.
2. Let the charge nurse decide each case without documentation
   Undocumented case-by-case decisions produce inconsistent, unfair treatment and leave no record for improving the policy.
3. Ask security to explain the policy to the family
   Bringing in security turns a grieving family's request into an enforcement matter and sidesteps the manager's own ethical judgment.
4. Enforce the policy, since exceptions would be unfair to others
   Rigid enforcement puts rule consistency above the needs of a dying patient and family, which conflicts with the Code's respect for dignity.

A nurse provides telehealth visits from home. Which practice BEST meets HIPAA privacy and security requirements?

1. Working in a shared space while wearing headphones
   Headphones cover what the nurse hears, not what the nurse says or shows on screen; others in a shared space can still overhear and see PHI.
2. Recording visits so that the privacy officer can audit them
   Routine recording creates more PHI to protect and is not a safeguard the rules call for; it adds risk instead of reducing it.
3. Conducting visits in a private room on an approved platform
   HIPAA calls for reasonable privacy safeguards and a platform with security protections covered by a business associate agreement; a private room and an approved tool meet both.
4. Using a personal video app if the patient gives verbal consent
   Consent does not make a non-compliant app acceptable; HHS's COVID-era enforcement discretion for such apps ended in 2023.

A nurse manager finds that the unit has been billing a bedside procedure that was often not documented as performed. What is the MOST appropriate first step?

1. Discipline the staff who entered the charges
   Discipline before any review assumes individual fault for what may be a process or documentation failure.
2. Notify CMS directly before telling leadership
   Bypassing the internal compliance process skips the review that establishes what happened and what is owed before any external report.
3. Stop the charges and not revisit past claims
   Leaving past claims unreviewed keeps known overpayments in place; identified Medicare overpayments must be reported and returned within 60 days.
4. Report it to the compliance office for review
   A possible billing error belongs with the compliance program, which investigates, quantifies any overpayment and decides on refunds or self-disclosure.

ICU nurses report moral distress over aggressive treatment that a patient's family demands against the team's recommendation. Which action by the nurse manager is MOST appropriate?

1. Reassign distressed nurses away from this patient
   Reassignment moves the conflict from some nurses to others and does nothing about the situation itself.
2. Tell staff that family wishes must always be followed
   Families do not hold unlimited authority over treatment, and the absolute rule dismisses the team's legitimate concern.
3. Request an ethics consult and hold a team debrief
   An ethics consultation helps the team and family work through the conflict, and a facilitated debrief treats the nurses' moral distress as a shared unit problem.
4. Refer the nurses to the EAP for individual counseling
   Individual counseling treats moral distress as a personal coping issue and leaves the ethical conflict behind it unaddressed.

A unit's quality improvement team wants to review 200 patient charts to study falls. What does HIPAA require?

1. Using only the minimum PHI needed for the review
   Quality improvement is a health care operations use, which needs no patient authorization but is subject to the minimum necessary standard.
2. IRB approval before any chart can be reviewed
   IRB review applies to research meant to produce generalizable knowledge; an internal QI review of falls is operations, not research.
3. Written authorization from each patient before review
   Authorization is not required for treatment, payment or health care operations, and QI is an operations activity.
4. Removing all identifiers before staff can view charts
   De-identification is not required for internal operations; the rule asks for the minimum necessary PHI, not none at all.

Under EMTALA, a hospital with specialized capabilities (for example, a burn unit) receives a request to transfer an unstable patient it can treat. What is required?

1. It can refuse patients who live out of state
   Residence is irrelevant; a hospital with the capability and capacity must accept wherever the patient lives.
2. It must accept the transfer if it has capacity
   EMTALA's nondiscrimination rule (42 CFR 489.24(f)) requires a hospital with specialized capabilities and the capacity to treat to accept an appropriate transfer of an unstable patient who needs them.
3. It may decline because of the patient's insurance plan
   Insurance status plays no part in the receiving hospital's duty; refusing on coverage is a classic EMTALA violation.
4. It must first obtain prepayment for the transfer
   Payment cannot be a condition for accepting an EMTALA transfer; the duty is set by capability and capacity.

During an ED surge, which practice best maintains EMTALA-compliant, safe prioritization of patients?

1. Prioritizing patients who arrive by ambulance
   Mode of arrival is not acuity; ambulance patients go through the same triage criteria as walk-in patients.
2. Triage with a validated tool such as the ESI
   A validated acuity tool such as the Emergency Severity Index ranks patients by clinical urgency and expected resources, which keeps prioritization safe and free of financial factors.
3. Seeing patients strictly in arrival order
   First-come order ignores acuity, so a critically ill patient can wait behind minor complaints during a surge.
4. Delaying triage until staffing increases
   Postponing triage leaves emergencies unrecognized; triage matters most when the department is overwhelmed.

A hospital earns accreditation from The Joint Commission. Which requirements is it then "deemed" to meet?

1. Magnet Recognition Program standards
   Magnet is a separate ANCC recognition with its own application and appraisal; accreditation earns no Magnet credit.
2. State nurse practice act requirements
   Nurse practice acts are state licensing laws for individual nurses; accreditation does not substitute for them.
3. OSHA workplace safety regulations
   OSHA rules apply on their own; accreditation does not deem a hospital compliant with workplace safety law.
4. Medicare Conditions of Participation
   CMS grants deemed status to hospitals accredited by an approved organization such as The Joint Commission, treating them as meeting the Medicare Conditions of Participation without a routine state survey.

During a mass casualty event, a family calls to ask whether their relative was brought to the hospital. The patient is unconscious. Under HIPAA, what may staff do?

1. Share limited facts if it is in the patient's best interest
   When a patient is incapacitated, the Privacy Rule (45 CFR 164.510(b)) lets staff use professional judgment to tell family the patient's location and general condition if that serves the patient's best interest.
2. Share information only after the family shows legal guardianship
   Notifying family does not require proof of legal authority; the rule relies on staff judgment about the patient's interest.
3. Refuse to confirm anything until the patient can consent
   HIPAA does not require waiting for consent when the patient cannot give it; a blanket refusal withholds information the rule allows.
4. Release the full record, since HIPAA is waived in disasters
   The Privacy Rule stays in force during disasters; a limited waiver covers only certain provisions, and disclosures to family stay limited to what is relevant.

A nurse executive is reviewing ED practices for EMTALA compliance. Which practice would constitute a violation?

1. Screening by a nurse practitioner designated in the bylaws
   EMTALA allows qualified medical personnel named in the bylaws or rules, including nurse practitioners, to perform the screening exam.
2. Transferring a stabilized patient to a higher level of care
   EMTALA restricts transfers of unstable patients; moving a stabilized patient to a higher level of care is permitted.
3. Verifying insurance before the medical screening examination
   A hospital may not delay the medical screening exam or stabilizing care to ask about payment or seek authorization (42 CFR 489.24(d)(4)); verification before screening does exactly that.
4. Collecting insurance details once screening is underway
   Routine registration, including insurance questions, is allowed as long as it does not delay screening or treatment.

Federal hospital regulations require which mechanism for handling patient complaints?

1. A grievance process with a written reply
   The patient-rights Condition of Participation (42 CFR 482.13(a)(2)) requires a grievance process with set time frames and a written notice of the decision.
2. A suggestion box reviewed by the quality committee each year
   An annual suggestion-box review gives no timely response to the person who complained and does not meet the grievance requirement.
3. Referral of all complaints to the marketing department
   Complaints go through a grievance process approved by the governing body, not a marketing function.
4. A verbal apology and service recovery at the bedside
   Bedside resolution is the right start, but a concern that is not resolved promptly becomes a grievance that needs the formal process and a written reply.

Before enrolling a patient in continuous remote monitoring at home, which step BEST respects the patient's autonomy?

1. Rely on the general consent signed at admission
   A general admission consent says nothing about a new program's data collection and review, so it cannot stand in for specific informed consent.
2. Enroll the patient and explain the program at the first visit
   Enrolling first and explaining later makes consent an afterthought; agreement must come before data collection begins.
3. Explain the data use and limits before consent
   Autonomy requires informed, voluntary agreement: the patient needs to know what is monitored, who reviews it and how to stop before agreeing.
4. Ask the family to sign the consent for the patient
   A patient with decision-making capacity makes the choice; family involvement with the device does not transfer the decision.

A hospital is adding a secure texting platform for clinicians to exchange patient information. Which step does the HIPAA Security Rule require?

1. Limit system access to physicians and nurse managers
   Access should follow role-based need, which includes many staff nurses; a job-title limit is neither required nor workable.
2. Obtain written authorization from every patient in it
   Exchanging PHI for treatment needs no patient authorization.
3. Notify HHS of the new system before it goes live
   No rule requires telling HHS about new systems; notice to HHS applies to breaches.
4. Complete a risk analysis that covers the new system
   The Security Rule requires a risk analysis of threats to electronic PHI (45 CFR 164.308(a)(1)), and a new system that holds ePHI has to be included before go-live.

After an unauthorized disclosure of PHI affecting several hundred patients, what does the HIPAA Breach Notification Rule require?

1. Notify only patients who ask about the breach later
   Notice is owed to every affected individual, not just those who ask.
2. Wait until the internal investigation is fully complete
   The 60-day clock starts at discovery; the investigation runs alongside notification and cannot push it past the deadline.
3. Discipline the staff involved before any reporting
   Workforce sanctions are a separate policy step and never a precondition for required notification.
4. Notify the patients involved and HHS by the deadlines
   A breach of unsecured PHI requires notice to each affected individual within 60 days of discovery, and notice to HHS on the timeline set by the number affected.