A man approaches the nurses' station. He says he's the brother of a patient on your unit and asks what room she's in and how she's doing — he "just flew in and wants to surprise her."
You don't recognize him. The patient hasn't listed visitor restrictions, but she also hasn't confirmed who's allowed to receive updates.
Family-sounding details aren't verification. Well-intentioned visitors — and people impersonating them — both tend to know just enough to sound convincing.
The safer default is to let the patient decide who hears what, every time, not just when something feels off.
Checking with the patient first isn't overcaution — it's the standard. She may want him to know everything, or nothing. That's her call, not an assumption made at the desk.
This single habit prevents the majority of front-desk disclosure incidents.