NR 360 Week 5 Data Security Brief Memo Example

Memorandum

To: Nurse Manager, 5 South Medical Unit

From: Student Name, RN, staff nurse and BSN student

Date: Month Day, Year

Re: Data security brief: open charts on hallway computers facing the visitor corridor

The Exposure

Our unit uses eight computers on wheels for documentation and medication administration. During medication passes, nurses park them in the hallway outside patient rooms, and in the east hallway, which is also the route visitors take from the elevators to the family lounge, the screens face the corridor. Over three day shifts last week I noted, at the start of each hour, whether any hallway computer was unattended with a patient's chart visible. On 14 of 36 checks, at least one was. Typically the screen showed the medication administration record or the flowsheet, including the patient's name, room number, diagnoses on the banner, medication names and recent vital signs. The screens lock after 15 minutes without activity, and most unattended screens I saw had been left for between two and ten minutes while a nurse was in a room.

Who Could See What

The people with a line of sight are visitors walking past, patients walking in the hallway, and staff from other departments such as transport, dietary and environmental services. Visitors are the main concern, because they pass the east hallway computers within arm's length many times a day, and a name on a banner together with a diagnosis such as a psychiatric condition, a sexually transmitted infection or a substance use disorder is exactly the kind of information patients most want protected. The route is routine rather than malicious: nobody has to try to see the screen. The duration is short, minutes at a time, but it repeats every medication pass.

Why It Matters

The HIPAA Privacy Rule requires covered entities to have reasonable safeguards to limit incidental uses and disclosures of protected health information, and the Department of Health and Human Services has explained that incidental disclosures are permitted only when reasonable safeguards are in place (U.S. Department of Health and Human Services, n.d.-b). A screen showing a chart to anyone walking past is not an incidental disclosure protected by reasonable safeguards; it is an avoidable one. The HIPAA Security Rule adds physical safeguards for workstations, requiring policies on workstation use and on physical placement to restrict viewing by unauthorized people, and it lists automatic logoff as a technical safeguard for electronic systems (U.S. Department of Health and Human Services, n.d.-a). Our hospital policy goes further than the law in one respect: it requires staff to lock or close a chart whenever they step away from a workstation, regardless of how long. The unit's practice is falling short of our own policy, not only of federal requirements.

There is also a professional obligation that sits apart from the law. The nursing Code of Ethics places the protection of patients' privacy and the confidentiality of their information within the nurse's duty to promote and protect the patient (American Nurses Association, 2015). A nurse who leaves a chart open in a visitor corridor is rarely thinking about privacy at that moment; she is thinking about the patient in the room. The brief's recommendations are designed with that in mind, so that protecting privacy does not depend on a nurse remembering it in the middle of a medication pass.

What Would Make It Less Likely

Four controls are proposed, chosen because they fit the work rather than stopping it. First, privacy filters on all eight computers on wheels, which limit viewing to someone directly in front of the screen; these cost roughly 40 dollars each and can be ordered through supply chain. Second, a proximity badge tap-to-lock, which our computers already support but which is not enabled on this unit; informatics has told me it can be turned on so that tapping a badge on the reader locks the screen in one motion, which nurses are far more likely to do than a keyboard sequence. Third, a parking rule for the east hallway only: park computers with the screen facing the wall, which costs nothing. Fourth, reduce the automatic lock time from 15 minutes to 5 on hallway computers; this is a configuration change for informatics and should be tested on one computer first, because too short a timeout interrupts nurses documenting at the bedside and encourages workarounds such as moving the mouse to keep sessions alive.

A rule requiring a full logout every time a nurse steps away would be more secure on paper and would fail in practice, because logging back in takes about 40 seconds and a nurse steps away dozens of times a shift. The proposed controls aim for the level of protection nurses will actually keep.

What I Am Asking You to Decide

I am asking for approval to request privacy filters for the eight computers, to ask informatics to enable badge tap-to-lock on the unit, and to post the east hallway parking rule. I will repeat the same hourly count over three shifts one month after these changes and bring the result to the next staff meeting. The shorter timeout can wait for the informatics test. None of these requires new staff time, and together they would make an avoidable disclosure much less likely without slowing medication passes.

References

American Nurses Association. (2015). Code of ethics for nurses with interpretive statements.

U.S. Department of Health and Human Services. (n.d.-a). Summary of the HIPAA Security Rule. Retrieved September 28, 2026, from https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html

U.S. Department of Health and Human Services. (n.d.-b). Incidental uses and disclosures. Retrieved September 28, 2026, from https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/incidental-uses-and-disclosures/index.html