Training access has a defined purpose
Nursing students need appropriate information to learn and participate in care. HHS explains that supervised health-professional training falls within HIPAA health care operations. Covered entities may structure their minimum-necessary policies to allow trainee access, including access to entire records when appropriate to those policies.
That does not create unrestricted permission to browse records or take patient material into any educational setting. The clinical site and school should define which access, assignments, systems and disclosures are authorized. HIPAA is one part of the privacy framework; it is not a substitute for the placement agreement and applicable institutional requirements.
Clarify the assignment before collecting information
For each clinical assignment, ask what information the learner actually needs. Can the learning objective be met through a supervised discussion, a fictional case or an approved de-identified extract? Avoid collecting extra detail simply because it might be useful later.
Students should know:
- Which records they may open and for what purpose.
- Where notes or assignment files may be stored.
- Whether any information may leave the clinical system.
- Which communication and learning platforms are approved.
- Who reviews material before it is presented or submitted.
- How to report a lost device, misdirected message or mistaken disclosure.
These are orientation questions, not permission to create a separate personal record archive. If the assignment instructions conflict with the clinical site’s privacy rules, resolve the conflict with the instructor and site before proceeding.
Avoid improvised de-identification
HHS recognizes expert determination and a specified identifier-removal method with an additional condition about known identifiability. Changing a name to initials or omitting a room number does not, by itself, show that either method has been satisfied.
In a fictional assignment, a student includes an unusual diagnosis, the date of admission and a recognizable family story. Even without a name, that combination deserves privacy review. A better educational design may retain the clinical reasoning problem while using a fully fictional scenario clearly labeled as such.
Do not use an unapproved consumer account or application to transform identifiable information. First establish whether the organization permits that tool and that use.
Make feedback privacy-conscious too
Instructors should be able to discuss the student’s reasoning without distributing more patient information than the approved activity requires. Check who can access submitted work, whether it will be shown to a wider class and what retention process applies.
If a mistake occurs, use the site and school reporting routes promptly. The lesson should address both the immediate disclosure and the assignment design that made it possible. For presentations beyond the clinical placement, consult confidentiality in case presentations before reusing earlier coursework.
Sources
- HHS: Trainee Access to Patient Medical Information (accessed 2026-09-17).
- HHS: Guidance on De-identification of Protected Health Information (accessed 2026-09-17).