Paul is a 12-year-old male diabetic. He maintains his personal digital assistant (PDA), hand-held device, that interfaces with his glucometer and provides information based on inputted data from him and his parents. This information is transmitted to his MD/hospital, school nurse, case manager (CM), and to the parents home computer. All in an attempt to better control his diabetes. You are his CM. 
The PDA sends an update to you since Paul’s blood glucose levels have been rising steadily for the last 5 days. The physician has left a message for you to contact this family and have them come in for an evaluation. You know that both of his parents work so you send an e-mail message to the parents via their home computer asking them to bring Paul in for an assessment. Since you are in a hurry and will be seeing other patients when they return from work, you decide to add more information to the message than normal reviewing with them the importance of maintaining control over the diabetes and expressing your concern since Paul has not checked in with you lately. You tell them that you think he might be over-doing it since he is trying to play football. You ask how they are doing and if they are still attending their counseling sessions.
Paul’s 4-year-old sister, Lilah, sends your email out to all of the diabetic lists that both Paul and his parents belong. They interact with people on these lists regularly. 
The parents are outraged that this information was sent everywhere. Imagine that you are the designated Privacy Officer in a healthcare institution.
Explain the following:

How would you feel in this situation?
What is the problem? (Clearly state the problem)
What ethical principles would guide you in this case?
What are the alternatives for solving this dilemma?
What are the consequences for each alternative generated?
In your opinion, what is the first choice from the alternatives and why?
Does your choice take into consideration all of the persons involved and the consequences to each of them?
If the worst case scenario would occur based on your choice, could you live with your decision?
Based on your choice, what is your plan of action?
What types of monitoring procedures would you develop?
What would you include in your sanctions for violations policy?
How would you address the following?

Tracking each point of access of the patients database including who entered the data
Nurses in your hospital have an access code that only gives them access to their Units patients. A visitor accidentally comes to the wrong unit looking for a patient and asks the nurse to find out what unit the patient is on.