A nurse is caring for a client who has bipolar disorder. The client's employer contacts the nurse to discuss the client's condition. Which of the following actions should the nurse take?

A. Verify the employer's identity prior to disclosing information: While verifying the caller’s identity is important for security, it does not address the requirement for consent before sharing private health information. Identity verification alone does not authorize disclosure. B. Refer the employer to the charge nurse to share the client's information: Referring the employer does not resolve the legal and ethical obligation to protect client confidentiality. Sharing information without client consent is prohibited, regardless of who the nurse contacts. C. Contact the client's family to verify the client's employment status: Involving the client’s family without consent violates privacy and confidentiality. Employment status alone does not justify disclosure of health information to family or employer. D. Obtain the client's permission to share their health care information: Health information is protected under HIPAA and ethical standards. The nurse must secure explicit consent from the client before discussing their condition with the employer to maintain confidentiality and legal compliance.