HIPAA Training for Oncology Nurse Navigators: Privacy and Patient Communication

Oncology nurse navigators help patients coordinate complex care, understand next steps, and connect with the right members of the care team. Because these conversations may involve diagnoses, treatment plans, appointments, and family concerns, protecting confidentiality is part of everyday navigation—not a separate task.

Effective HIPAA training helps you recognize protected health information (PHI), choose appropriate communication methods, and share information only in ways permitted by law and your organization’s policies. The HIPAA Privacy Rule addresses how PHI may be used and disclosed; the HIPAA Security Rule addresses safeguards for electronic protected health information (ePHI).

Protect Patient Privacy and Confidentiality

Discuss patient information only for an appropriate work purpose, and access records only when needed for your assigned responsibilities. Avoid discussing cases in elevators, hallways, cafeterias, or other places where people without a care-related need could overhear.

Follow your organization’s policies for identity verification, record access, documentation, and reporting suspected privacy incidents. If you are unsure whether a disclosure is permitted, pause and ask your privacy officer, supervisor, or another designated resource rather than guessing.

Privacy protection does not require eliminating every possible incidental disclosure. It does require reasonable safeguards to limit avoidable exposure—for example, speaking quietly, positioning screens away from public view, and securing records when they are not in use.

Identify Protected Health Information

PHI is individually identifiable information about a person’s past, present, or future health, health care, or payment for care. It can include a cancer diagnosis, pathology results, treatment schedule, referral details, insurance information, or appointment information when linked to an identifiable patient.

PHI may be spoken, written, printed, photographed, or stored electronically. A name paired with a treatment update, a patient portal message, or a document containing identifying details may all reveal protected information. Information does not stop being PHI simply because it appears in a text, email, calendar entry, or conversation rather than a medical chart.

The minimum necessary standard generally calls for reasonable efforts to use, disclose, or request only the PHI needed for the purpose. Apply your organization’s policies to your role and task; the standard has exceptions, including certain disclosures for treatment.

Apply Reasonable Safeguards in Patient Communication

Before sharing information, confirm who you are speaking with and whether the person is authorized or otherwise permitted to receive it. Use approved communication channels, verify contact details, and include only what is needed to address the patient’s request or coordinate care.

In shared work areas or public spaces, lower your voice, move to a private location when practical, and avoid displaying names or clinical details where others can see them. If someone overhears a limited detail despite reasonable precautions, that may be an incidental disclosure; it is not a reason to disregard safeguards or share more than necessary.

Discuss Patient Information With Family Members

A family relationship alone does not automatically give someone access to a patient’s health information. When the patient is present, you may generally share information directly relevant to a family member’s involvement in the patient’s care or payment if the patient agrees, has an opportunity to object and does not object, or your professional judgment supports that the patient does not object.

If the patient is unavailable, a provider may, in some circumstances, use professional judgment to decide whether sharing information is in the patient’s best interest. Any information shared should be relevant to that person’s involvement. A personal representative may have authority to act for the patient, subject to applicable rules and exceptions. Follow your organization’s verification and documentation procedures, and ask for guidance when authority or the patient’s wishes are unclear.

Secure Electronic Communication and Telehealth

Use organization-approved email, messaging, patient portals, and telehealth platforms for patient communication. Check the recipient and address before sending, avoid unnecessary clinical detail, and follow policies for encryption, access controls, secure devices, and storing or deleting messages. The HIPAA Security Rule applies to ePHI handled by covered entities and their business associates.

Email communication is not categorically prohibited for communicating with patients, but reasonable safeguards are still important. Follow organizational policy, consider the sensitivity and amount of information, and honor reasonable requests for confidential communication by an alternative means or at an alternative location.

For telehealth, use a private setting when feasible. If privacy is limited, use safeguards such as speaking quietly, avoiding speakerphone, and helping the patient find a place where others are less likely to overhear. These telehealth privacy safeguards reduce the risk of incidental disclosures while allowing necessary care conversations to continue.

Follow Navigator Scope and Disclosure Responsibilities

Share information only as permitted by HIPAA, applicable law, your role, and your organization’s policies. Use established workflows for care coordination, referrals, authorizations, and requests from outside parties. Do not assume that a caller’s familiarity with the patient, urgency, or stated relationship is enough to justify disclosure.

Stay within your professional scope. You can help patients understand navigation steps and connect them with clinicians, but route questions requiring clinical judgment—such as interpreting results, recommending treatment, or assessing symptoms—to the appropriate licensed clinician. Document communications according to policy, and promptly report a suspected misdirected message, unauthorized access, or other possible privacy or security incident through the required process.

Use Plain Language and Confirm Patient Understanding

Explain privacy choices and communication plans in clear, everyday language. Ask patients which contact methods are safe and convenient, whether messages may include appointment details, and whether anyone else may receive information about their care. Record and follow communication preferences using your organization’s process.

Use teach-back to confirm understanding: ask the patient to describe the next step or how they will receive follow-up information. Offer an interpreter or other communication support when needed, and avoid relying on family members to interpret sensitive information when qualified assistance is available.

In daily practice, strong navigation combines careful handling of PHI, appropriate communication safeguards, respect for patient preferences, and clear explanations that help patients take part in their care.

FAQs

What information is protected under HIPAA?

HIPAA protects individually identifiable information about a person’s health, health care, or payment for care when it is held or transmitted by a covered entity or business associate. It can include diagnoses, treatment details, appointment information, insurance data, and identifying details linked to health information, whether communicated orally, on paper, or electronically.

When may an oncology nurse navigator discuss a patient’s condition with family?

A navigator may generally share information relevant to a family member’s involvement in care when the patient agrees, has an opportunity to object and does not object, or the circumstances support a reasonable judgment that the patient does not object. If the patient is unavailable, professional judgment may permit a limited disclosure in some circumstances. Confirm the person’s role and follow organizational policy; ask for guidance when permission or authority is uncertain.

How can navigators protect privacy during calls in public areas?

Move to a private location whenever practical. If you cannot, speak quietly, avoid speakerphone, verify the other person’s identity before discussing PHI, and limit the conversation to information needed for the task. Do not continue a sensitive discussion if you cannot take reasonable steps to reduce the risk of others overhearing.

What safeguards apply to patient communication by email or telehealth?

Use approved systems and follow organizational policies for access, encryption, device security, and documentation. Verify email addresses and telehealth participants, limit unnecessary details, and use a private setting for telehealth when feasible. Email communication is permitted when reasonable safeguards are applied; telehealth privacy safeguards may include lowering your voice and avoiding speakerphone when a private setting is not available.