Case Scenarios: Using technology safely

The following scenarios are designed to help nurses apply the Confidentiality and Privacy – Personal Health Information practice standard when using technology in practice. They highlight common situations involving personal devices, AI tools, electronic systems, recordings, social media and record retention, and reinforce that nurses are accountable for protecting personal health information. Nurses should use approved and secure tools, limit collection, use and disclosure to what is needed, obtain consent when required, follow employer policies and seek guidance when privacy expectations are unclear.

Scenario 1: Using wearable or personal devices

Personal devices and wearables can create privacy risks if they collect, store, sync or display client information. Nurses are accountable for protecting personal health information and should understand these risks before using technology in practice. Nurses should use only employer-approved devices, apps and secure communication methods, and avoid entering identifiable client information into personal tools. If expectations are unclear, seek guidance from your employer or privacy officer before using the device for any practice-related purposes.

Scenario 2: Using an unapproved AI app with client information

Nurses remain accountable for the accuracy, appropriateness and confidentiality of documentation supported by AI. Nurses must use only technologies that are approved by their employer, meet legislative requirements, employer policies and appropriate privacy safeguards. Entering personal health information into unapproved AI apps or digital tools may create privacy, security, retention and disclosure risks. If expectations are unclear, you should seek guidance from your employer or your organization’s privacy officer before using unapproved AI apps.

Scenario 3: Using technology in shared or public spaces

Nurses must take reasonable steps to protect client information when using electronic systems in shared, public or high-traffic areas. This includes limiting access to the minimum information needed, positioning screens to reduce the risk of others viewing client information, logging out or locking screens when stepping away, and ensuring records are not left open or unattended. Practices that are common on a unit do not replace a nurse’s accountability to safeguard personal health information. If the physical environment or workflow makes privacy difficult to maintain, raise the concern with your employer or designated privacy officer and follow organizational policies for secure use of electronic systems.

Scenario 4: Bedside recording during care

Clients and families may wish to record information to support understanding and continuity of care; however, recordings can also capture personal health information about other clients, staff or care interactions. Nurses should take reasonable steps to provide care in a private setting to maintain confidentiality. Before continuing, consider whether the recording is permitted by organizational policy, whether the client or substitute decision-maker understands what is being recorded and how it may be used or shared, and whether others may be visible or audible. Where possible, support the client’s learning in a way that protects privacy, such as moving to a private space, limiting the recording to the information needed, or offering written instructions. If there is a risk of recording other clients or confidential information, pause and seek guidance from your employer or privacy officer.

Scenario 5: Use of personal devices to capture client information

A photograph of a client or wound is personal health information, so nurses should confirm there is a clinical need and follow employer policies, including use of approved devices before taking, storing or sharing the image. Nurses should obtain and document client consent, determine how the photograph will be used, stored, accessed, retained and disposed of, and limit it to the minimum information needed for the authorized purpose. Nurses should follow organizational policies for clinical photography and mobile device use and seek guidance from a manager or privacy officer if unsure whether using a personal phone is appropriate.

For more information:

Scenario 6: Recording care for clinical or educational purposes

Recordings used for clinical teaching or quality improvement purposes involve personal health information and must be handled according to legislation, employer policies and privacy requirements. Nurses should confirm the recording is necessary, obtain and document any required consent, explain how it will be used, stored, accessed, retained and disposed of, and limit it to the minimum information needed. Nurses should use approved devices, ensure recordings are securely stored, and seek guidance if the recording may be used beyond the client’s care team or for a different purpose.

Scenario 7: Discussing clients or workplace concerns online

Nurses must protect confidentiality and privacy when using social media or online platforms. Nurses should not post or discuss identifiable client information unless the client has provided informed consent and the disclosure is permitted by legislation and employer policy. Even without names, details about a client, workplace, situation or timing may identify clients or co-workers. Nurses should avoid sharing confidential workplace information online and use appropriate organizational reporting processes for concerns about care, safety, privacy or workplace practices.

For more information:

Scenario 8: Storing and retaining records when closing a practice

Nurses in independent practice may be considered health information custodians for records related to the nursing services they provide. If so, they are responsible for collecting, using, disclosing, retaining, transferring and disposing of personal health information in a way that is consistent with the Personal Health Information Protection Act, 2004 (PHIPA), CNO standards and any applicable organizational policies. Nurses must ensure records remain secure, accessible as required, and protected from theft, loss, unauthorized access, use, disclosure, copying, modification or disposal until custody and control of the records passes to another legally authorized person. When closing a practice, nurses must ensure that records are not abandoned and should seek guidance from legal counsel and the Office of the Information and Privacy Commissioner (IPC) of Ontario to confirm record retention, transfer, client access and disposal requirements.