Master of Science in Physician Assistant Studies Program
Confidentiality, Privacy, HIPAA, and Protected Information Policy
Policy Title: Confidentiality, Privacy, HIPAA, and Protected Information Policy Program: Master of Science in Physician Assistant Studies
Effective Date: November 1, 2026 Last Reviewed: November 1, 2026 Review Cycle: Annually Responsible Offices: PA Program Director, Director of Clinical Education, PA Faculty, and NLU Office of Student Affairs/appropriate University offices Related ARC-PA Standards: A3.01, A3.04, A3.05, A3.06, A3.08, A3.14, B2.13 – B2.19, C1.01, C1.02 Related University Policies: NLU Student Guidebook, University Catalog, FERPA requirements, NLU information/privacy policies, Student Email Policy, applicable information- security policies, and clinical-affiliate policies.
1. Purpose
The National Louis University (NLU) Physician Assistant (PA) Program is committed to protecting the confidentiality, privacy, dignity, and security of patients, students, faculty, staff, clinical preceptors, clinical affiliates, and members of the University community. This policy establishes expectations for the collection, use, access, storage, transmission, discussion, documentation, and disclosure of confidential and protected information throughout the PA curriculum.
The policy applies during:
Didactic coursework; Classroom instruction; Laboratory activities;
•
•
•
Simulation;
•
Standardized patient encounters; Interprofessional education;
•
•
Community engagement;
•
Health fairs;
•
Service-learning activities;
•
• Supervised Clinical Practice Experiences (SCPEs); • Clinical site activities;
Program-sponsored activities; and
•
• Non-clinical activities when students possess or have access to confidential or protected information.
The policy applies regardless of whether information is communicated verbally, electronically, visually, photographically, in writing, or through another medium.
2. Policy Statement
All NLU PA students are expected to protect confidential and protected information and to comply with:
1. Applicable federal and state privacy laws; 2. HIPAA and its implementing regulations, when applicable; 3. FERPA and University requirements governing educational records; 4. National Louis University policies and procedures; 5. NLU PA Program policies; 6. Clinical-affiliate privacy and confidentiality requirements; 7. Professional ethical standards; and 8. Applicable patient-care and information-security requirements.
When multiple requirements apply, students must comply with the most restrictive applicable confidentiality, privacy, security, or clinical-site requirement.
Nothing in this policy limits or replaces an applicable law, University policy, or clinical-affiliate requirement.
3. NLU University Policy Alignment
This PA Program policy supplements NLU's University-wide requirements.
NLU states that student privacy rights are generally governed by FERPA and makes its Student Guidebook and University Catalog available as primary sources for University policies. (National Louis University)
NLU also maintains a process for authorization to release protected health information and identifies HIPAA and FERPA as applicable privacy frameworks. (National Louis University)
NLU's published information-security materials emphasize that University records may exist in electronic, written, printed, taped, or filmed forms and that confidential or personal information must not be improperly accessed or disclosed. (National Louis University)
Accordingly, NLU PA students are required to comply with both University requirements and PA Program-specific confidentiality requirements.
4. Definition of Confidential and Protected Information
For purposes of this policy, confidential or protected information includes, but is not limited to:
Patient information
Patient name; Date of birth;
•
•
Address;
•
Telephone number;
•
Medical record number; Social Security number;
•
•
Diagnosis;
•
Medical history;
•
Medication information;
•
Laboratory results;
•
Imaging;
•
Treatment information;
•
Procedures; Photographs;
•
•
Videos;
•
Voice recordings; Genetic information; Insurance information; Billing information;
•
•
•
•
• Any information that could reasonably identify a patient.
Student information
Grades;
•
Academic records;
•
Remediation information; Progression decisions;
•
•
Disability or health information; Personal identifying information;
•
•
Student conduct matters; Advising information;
•
•
Clinical evaluations;
•
Personal communications; and
•
• Other information protected by FERPA or University policy.
Clinical and institutional information
Clinical-site proprietary information;
•
Preceptor information;
•
Staff information;
•
Internal communications;
•
Passwords;
•
Security credentials; Facility procedures;
•
•
• Non-public operational information; and • Any information designated confidential by NLU or a clinical affiliate.
5. HIPAA Compliance
The NLU PA Program incorporates the following requirement from its clinical affiliation agreements:
HIPAA Compliance. The students shall comply with the applicable provisions of the Health Insurance Portability and Accountability Act of 1996, and shall take all measures necessary to ensure the confidentiality of any and all information regarding the patients/clients cared for at the Facility/Facilities pursuant to the applicable affiliation agreement.
Students shall comply with applicable HIPAA requirements and clinical-affiliate privacy policies whenever they have access to protected health information (PHI).
Students may access PHI only when authorized and only to the extent necessary to perform their assigned educational or clinical responsibilities.
Students shall not access patient records merely because they have the technical ability to do so.
6. Affiliation Agreement Notification Requirement
The Program also incorporates the following affiliation-agreement requirement:
The parties will notify one another if there are known breaches of this confidentiality.
Accordingly, a student who becomes aware of an actual or suspected breach involving patient, student, University, or clinical-affiliate confidential information must immediately notify the appropriate Program and/or clinical-site authority.
The student must not attempt to independently investigate, conceal, delete, alter, or destroy evidence related to a suspected breach.
The Program will coordinate with the appropriate University and clinical-affiliate officials regarding required reporting, investigation, mitigation, and follow-up.
7. Business Associate Provisions The NLU PA Program recognizes the affiliation-agreement provision addressing circumstances in which the University or another educational institution is determined by the U.S. Department of Health and Human Services, Office for Civil Rights, or another authorized federal or state agency, court, or administrative tribunal to be a HIPAA Business Associate .
Where such a determination applies, NLU will comply with the applicable conditions and requirements established through the affiliation agreement and applicable law.
Students shall follow any additional privacy, security, documentation, or information-handling requirements communicated by NLU or the clinical affiliate.
8. Minimum Necessary Access
Students shall use the minimum necessary information required to accomplish an authorized educational or clinical purpose.
Students shall:
• Access only records they are authorized to access; • Review only information relevant to their assigned educational/clinical responsibilities; • Avoid accessing records of family members, friends, acquaintances, themselves, or other individuals unless specifically authorized for an educational purpose; • Log out of electronic health records when finished; • Protect passwords and authentication credentials; and • Never share usernames, passwords, access cards, tokens, or other credentials.
9. Classroom and Didactic Confidentiality
Confidentiality requirements apply during didactic education.
Students shall not disclose identifiable information discussed during:
Case conferences;
•
Classroom discussions; Problem-based learning; Small-group activities; Patient case presentations;
•
•
•
•
Simulation;
•
Standardized patient encounters;
•
Skills laboratories;
•
Interprofessional education; or Other educational activities.
•
•
When patient cases are used for educational purposes, students shall use only information authorized for educational use and shall avoid unnecessary patient identifiers.
Students shall not discuss identifiable patient information in hallways, elevators, cafeterias, public transportation, restaurants, social gatherings, or other locations where unauthorized individuals may hear the discussion.
10. Clinical Confidentiality
During SCPEs, students shall comply with:
HIPAA;
•
Applicable state privacy laws;
•
NLU requirements;
•
PA Program requirements; and
•
• All clinical-affiliate confidentiality and privacy policies.
Students shall protect patient information during:
Patient interviews;
•
Physical examinations;
•
Chart review;
•
Electronic health record access;
•
Documentation;
•
Case presentations; Sign-out activities;
•
•
Consultations;
•
Patient education; and
•
• Communication with healthcare professionals.
Students shall not discuss identifiable patient information with individuals who are not directly involved in the patient's care or the student's authorized educational experience.
11. Social Media Policy
Students shall not post, publish, transmit, distribute, or otherwise disclose confidential or protected information through social media or online platforms.
This prohibition applies to:
Facebook; Instagram;
•
•
TikTok;
•
X;
•
Snapchat; LinkedIn;
•
•
YouTube;
•
Reddit; Blogs;
•
•
Podcasts;
•
Online discussion boards; Private social-media groups;
•
•
Messaging platforms; Personal websites; and
•
•
• Any current or future social-media platform.
Students may not post patient stories, clinical experiences, photographs, screenshots, recordings, comments, or descriptions that could identify a patient, clinical site, preceptor, staff member, or other protected individual.
A social-media account being private does not eliminate the student's confidentiality obligation.
12. Photography and Patient Images
Students may not photograph, screenshot, record, or otherwise capture patient information or images using personal devices.
This includes:
Cell phones;
•
Tablets;
•
Smart watches;
•
Cameras;
•
Personal computers; Wearable devices; and Other recording devices.
•
•
•
Clinical photographs may be taken only when specifically authorized by the clinical institution and Program, when required for an approved educational purpose, and in accordance with applicable consent, privacy, security, and institutional requirements.
A patient's consent alone does not automatically authorize a student to use a personal device or post the image publicly.
13. Text Messaging Students shall not use personal text messaging to transmit identifiable patient information unless specifically authorized through an approved, secure, HIPAA-compliant clinical communication system.
Students shall not text:
Patient names;
•
Medical record numbers;
•
Diagnoses; Photographs;
•
•
Laboratory results;
•
Clinical documentation; Treatment information; or Other identifiable PHI
•
•
•
through personal or unsecured messaging systems.
Students shall follow the clinical site's approved communication platform and security requirements.
14. Email Students shall use only approved University or clinical-site communication systems when communicating confidential information for authorized educational or clinical purposes.
Students shall not send PHI through personal email accounts.
Students must verify recipients before sending confidential information and must not include unnecessary patient identifiers.
Students shall exercise particular caution with:
Reply-all;
•
Forwarding;
•
Email attachments;
•
Screenshots;
•
Clinical documents;
•
Patient lists; and
•
Auto-complete recipient functions.
•
15. Telephone and Verbal Communication
Students shall protect confidentiality during telephone conversations.
Students shall not discuss identifiable patient information:
In public spaces;
•
• On speakerphone where unauthorized persons may hear; • With individuals who are not authorized to receive the information; or • In a manner that allows patient information to be overheard.
Students shall verify the identity and authority of individuals before disclosing protected information by telephone.
16. Video, Audio, Vlogging, and Recording
Students are prohibited from recording clinical activities, patient encounters, clinical conferences, or other patient-related activities unless expressly authorized by the clinical affiliate and Program.
This prohibition applies to:
Video logs/vlogs;
•
Podcasts;
•
Livestreams;
•
Audio recordings; Video recordings;
•
•
Body cameras; Smart glasses;
•
•
Cell-phone recordings; Screen recordings; and
•
•
Other audio/video technologies.
•
Students may not use clinical experiences as content for a vlog, blog, podcast, social-media post, or other public-facing media.
17. Blogs and Written Publications
Students shall not publish identifiable patient information in:
Blogs; Essays; Articles;
•
•
•
Newsletters;
•
Websites;
•
Online portfolios; Social-media posts;
•
•
Case reports;
•
Presentations; or Other publications
•
•
unless the activity has been formally authorized and all applicable privacy, consent, institutional, ethical, and regulatory requirements have been satisfied.
Educational assignments do not automatically authorize public dissemination of patient information.
18. De-Identification Does Not Eliminate Professional Responsibility
Students should not assume that removing a patient's name alone makes information safe to disclose.
A patient may be identifiable through combinations of:
Age;
•
Location;
•
Occupation; Clinical site;
•
•
Rare diagnosis;
•
Dates;
•
Photographs;
•
Unique circumstances; Family relationships; Treatment history; or
•
•
•
Other contextual information.
•
Students should consult faculty or the appropriate clinical-site authority whenever they are uncertain whether information is sufficiently de-identified.
19. Student-to-Student Confidentiality
Students shall protect confidential information concerning classmates.
Students may not disclose another student's:
Grades;
•
Examination performance;
•
Academic standing;
•
Remediation;
•
Health information; Disability information;
•
•
Conduct matters;
•
Clinical evaluations;
•
Personal circumstances; or Other protected information.
•
•
FERPA and applicable NLU requirements govern student educational records. NLU states that it protects students' rights concerning the privacy and accuracy of educational records. (National Louis University)
20. Electronic Health Record Security
Students shall:
1. Use only their assigned credentials.
2. Never share passwords. 3. Never access records outside their authorized educational role.
4. Log off or lock the workstation when leaving. 5. Protect screens from unauthorized viewing.
6. Never photograph or screenshot the EHR using a personal device. 7. Never copy patient information to unauthorized storage systems.
8. Follow clinical-site cybersecurity requirements. 9. Immediately report suspected unauthorized access.
NLU's published information-security materials similarly emphasize individual responsibility for information accessed through University systems and prohibit unauthorized use or disclosure of confidential information. (National Louis University)
21. Personal Devices
Personal devices may not be used to store, photograph, record, or transmit PHI unless specifically authorized and secured according to applicable NLU and clinical-site requirements.
Students are responsible for maintaining appropriate:
Password protection;
•
Device security;
•
Encryption where required;
•
Screen-lock functions; Software updates; and
•
•
Physical control of devices.
•
Lost or stolen devices that may contain confidential information must be reported immediately.
22. Clinical Site Confidentiality
Students shall also protect proprietary and confidential information belonging to clinical affiliates.
Students shall not disclose:
Internal clinical-site policies;
•
Non-public operational information;
•
Staff information;
•
Preceptor information;
•
Patient census information;
•
Security procedures;
•
Internal communications; Proprietary materials; or Other confidential information
•
•
•
unless authorized.
Clinical-affiliate confidentiality requirements remain applicable throughout and after the student's rotation.
23. Use of Patient Cases for Educational Purposes
Students may discuss clinical cases for legitimate educational purposes when:
• The discussion occurs within an authorized educational environment; • The information is limited to what is necessary; • Appropriate privacy protections are maintained; and • The discussion complies with the clinical site's requirements.
Students shall use the minimum necessary identifying information and should use de-identified cases whenever possible.
24. Student Responsibility Following Graduation or Withdrawal
Confidentiality obligations do not end when a student:
Completes a course; Completes a rotation;
•
•
Graduates;
•
Withdraws; Transfers;
•
•
Leaves NLU; or
•
• Ends an affiliation with a clinical site.
Students remain responsible for protecting confidential information obtained during their educational experience.
25. Reporting a Privacy or Confidentiality Concern
Students must immediately report actual or suspected:
HIPAA violations; Privacy breaches;
•
•
Unauthorized record access;
•
Lost or stolen patient information;
•
Misaddressed email;
•
Unauthorized photographs; Unauthorized recordings; Social-media disclosures; Text-message disclosures;
•
•
•
•
• Lost devices containing protected information; or • Other confidentiality concerns.
Reports should be made to the appropriate clinical-site authority and/or the NLU PA Program Director, Director of Clinical Education, or designated University reporting office, as appropriate.
NLU provides established incident-reporting and issue-resolution mechanisms for students. (National Louis University)
A student who discovers a possible breach should report rather than conceal the event.
26. No Retaliation for Good-Faith Reporting
Students who report suspected privacy violations or other misconduct in good faith will be protected from retaliation consistent with applicable NLU policy.
NLU's published Whistleblower Policy encourages students, faculty, and employees to report University-related misconduct and provides protection against reprisal for good-faith disclosures. (National Louis University)
27. Investigation and Corrective Action
A suspected confidentiality violation may be reviewed by the appropriate combination of:
PA Program Director;
•
Director of Clinical Education;
•
PA faculty;
•
Clinical Education Committee;
•
• Student Evaluation and Progress Committee; • NLU Student Affairs; • NLU Information Technology/Security; • NLU Privacy/Legal personnel; • Clinical-affiliate leadership; and/or • Other appropriate University officials.
Depending on the circumstances, corrective actions may include:
Counseling; Remediation;
•
•
Additional HIPAA/privacy training;
•
• Restriction of clinical or EHR access; • Professionalism intervention; • Removal from a clinical activity; • Referral to the Student Evaluation and Progress Committee; • Academic consequences; • Disciplinary action under NLU policy; and/or • Clinical-site action.
Nothing in this policy limits consequences required by law, University policy, or a clinical- affiliate agreement.
28. Education and Training
Before students participate in activities involving patient information, the Program will provide instruction regarding:
HIPAA;
•
Patient confidentiality;
•
Privacy; FERPA;
•
•
Information security; Appropriate EHR use;
•
•
Social media; Photography;
•
•
Text messaging;
•
Email;
•
Electronic communications; Clinical documentation;
•
•
Incident reporting; and
•
• Clinical-affiliate confidentiality requirements.
Training may occur through:
Orientation;
•
Course instruction; Clinical preparation; Clinical-site orientation;
•
•
•
Annual training;
•
Online learning modules; and
•
• Just-in-time education when required.
Students may be required to complete clinical-site-specific HIPAA/privacy training before beginning an SCPE.
29. Student Acknowledgment
Prior to participating in activities involving protected or confidential information, students must acknowledge that they understand and agree to comply with this policy.
Students acknowledge that:
1. Patient information is confidential. 2. Student educational records are protected. 3. Access to information is limited to authorized purposes. 4. Personal devices may not be used improperly to capture or transmit protected information. 5. Social media may not be used to disclose protected information. 6. Patient photographs and recordings are prohibited unless specifically authorized. 7. Confidential information may not be disclosed through text, email, telephone, blogs, vlogs, podcasts, or other media. 8. Suspected breaches must be reported promptly. 9. Confidentiality obligations continue after graduation or separation from NLU.
30. Continuous Quality Improvement
The PA Program will review this policy annually as part of its continuous programmatic assessment process.
The Program may evaluate:
HIPAA/privacy training completion; Reported confidentiality incidents;
•
•
Clinical-site feedback; Preceptor feedback; Student evaluations; EHR-access concerns; Social-media concerns; Privacy complaints; Incident-report trends;
•
•
•
•
•
•
•
Clinical-affiliate requirements; and
•
• Changes in University, federal, state, or accreditation requirements.
Findings may be incorporated into the Program's annual program effectiveness and CQI processes consistent with ARC-PA Standards C1.01 and C1.02.
31. Relationship to Other Policies
This policy should be read together with the:
NLU Student Guidebook; NLU University Catalog; NLU FERPA requirements;
•
•
•
• NLU HIPAA authorization procedures; • NLU Student Email Policy; • NLU information-security requirements; • NLU Student Code of Conduct; • NLU incident-reporting procedures; • NLU PA Program Student Handbook; • NLU PA Program Occupational Exposure, Injury, Illness, and Incident Reporting Policy; • NLU PA Program Student Dress, Professional Appearance, and Identification Policy; • Applicable clinical affiliation agreements; and • Clinical-affiliate policies.
Where an applicable law, University policy, or clinical-affiliate policy establishes a more restrictive requirement, the more restrictive requirement shall apply.
ARC-PA 6th Edition Alignment This policy provides strong support for several ARC-PA requirements, particularly those concerning student safety, professional conduct, clinical education, privacy, and program governance.
ARC-PA Area
Policy Alignment
Published and consistently applied student/program policy
A3.01
Professional identification and representation in clinical settings
A3.04
Protection of students and appropriate incident reporting
A3.05
Professional boundaries and appropriate healthcare relationships
A3.06
Professional behavior and student responsibilities
A3.14
Student identification and professional representation
B2.13
Prevention of misrepresentation
B2.14
Clinical education, safety, and responsibilities
B2.16 – B2.19
Policy effectiveness incorporated into continuous programmatic assessment
C1.01
Program resources/governance reviewed through CQI
C1.02
Recommended ARC-PA Supporting Evidence
A3/B2 confidentiality and privacy evidence package :
1. NLU PA Program Confidentiality, Privacy, HIPAA, and Protected Information Policy 2. NLU Student Guidebook 3. NLU FERPA information 4. HIPAA training documentation 5. Student HIPAA/privacy acknowledgment 6. Clinical-site HIPAA/privacy orientation documentation 7. NLU PA Program clinical affiliation agreement containing the HIPAA Compliance provision
8. Student incident-reporting procedure 9. Evidence of annual policy review 10. Sample student orientation materials
11. Clinical-site/preceptor orientation materials 12. Evidence of social-media/privacy training 13. Clinical EHR access/security training documentation
NLU's public FERPA resources specifically identify FERPA protections for student educational records and provide a HIPAA authorization process for protected health information. (National Louis University)
Page 1 Page 2 Page 3 Page 4 Page 5 Page 6 Page 7 Page 8 Page 9 Page 10 Page 11 Page 12 Page 13 Page 14 Page 15 Page 16 Page 17 Page 18 Page 19 Page 20Powered by FlippingBook