The Overheard Disclosure
A 17-year-old student volunteers at a community health fair. While helping at a registration desk, she overhears a nurse discussing a patient's HIV status with a colleague in a public corridor. The patient is a neighbour. Later, the volunteer's friend asks her, 'Is it true that Mr X is HIV positive?' The volunteer is unsure what to do. She also notices that the registration forms, which include names and phone numbers, are left on an unattended table when staff take a break. The nurse who disclosed is a senior staff member. The volunteer worries that speaking up will get her removed from the programme, and she is not sure whether she has any duty at all as a volunteer.
1. Analyse the confidentiality issues in this scenario and explain the volunteer's ethical position.
Read the worked answer
Two separate breaches are occurring:
- Verbal disclosure: The nurse discussed a patient's HIV status in a public corridor where it could be overheard. Health information should be shared only with those who need it for care, in an appropriate setting. HIV status is sensitive information and disclosure can lead to stigma and harm.
- Physical safeguard failure: Registration forms with names and phone numbers were left unattended. This is a data protection failure regardless of whether anyone actually looked at them.
The volunteer's position:
- She has no duty to confirm or deny anything to her friend. The right response is 'I can't discuss that' - not a lie, but a boundary.
- As a volunteer, she is bound by the same confidentiality expectations as staff, even if she has not signed a formal contract.
- She has an ethical responsibility to report the concerns through an appropriate channel, because patients are at risk of harm. Reporting is not the same as gossiping.
- Her fear of removal is understandable, but most programmes protect good-faith reporters; she should report factually, not accusatorially.
2. Draft what the volunteer should say to her friend and what she should do next, in order.
Read the worked answer
To her friend: 'I can't talk about anyone's health information - that's private. Please don't repeat what you've heard, because it could really harm someone.'
This is brief, does not confirm or deny, and redirects. She should not add details, speculate, or 'correct' the rumour with other information.
Next steps, in order:
- Secure the forms immediately if it is safe and within her role - e.g., alert the desk supervisor or move them behind the desk.
- Report factually to a supervisor or designated privacy lead, describing what she saw and heard, when, and where - without repeating the patient's identity unnecessarily.
- Ask for guidance on what to do if approached again, and request that her name be handled sensitively if possible.
- Document her report briefly (date, time, what happened, who she told).
- Do not confront the senior nurse publicly - that risks escalating the breach and is not her role.
If the internal channel is ignored and the risk continues, she should escalate to the programme manager or privacy officer.
3. The senior nurse later says, 'It was only a corridor, and the patient had already told people.' Evaluate this defence.
Read the worked answer
The defence fails on several grounds:
- 'Only a corridor' - a public corridor is exactly where confidentiality is most easily broken. Setting matters: sensitive information should be discussed in a private space.
- 'The patient had already told people' - the patient's own disclosure does not authorise staff to disclose further. Each disclosure requires its own justification, and staff should share only the minimum necessary with those who need to know.
- 'It was only a colleague' - colleagues may not need the information for the patient's care. Need-to-know, not convenience, governs sharing.
- Seniority is irrelevant to the rule - being senior makes the behaviour more influential and more damaging, not more acceptable.
The correct standard is: share only what is necessary, with whom it is necessary, in a setting that protects privacy. The nurse's comment also suggests a culture problem, so the response should include staff education and a clear reporting route, not just individual criticism.