Is it a HIPAA violation to use a personal email to set up a medical billing account at work?

Question

This question from the workplace stackexchange asks:

I recently resigned from my job ... in NY ... Now I am being asked to tell them all my usernames and passwords for websites I used for my job as a medical biller ie, insurance websites, Medicare, eligibility websites and so forth ... Do I have to give them this information? We don't have company email accounts. So I had to use my personal email to set them up.

My response was that there were probably HIPAA violations involved in this, and she shouldn't give them any information without consulting a lawyer. I've gotten quite a bit of pushback on this of the "you're not answering the question asked" variety, with explanations of "frame challenges" and the like. But I was concerned that the OP was opening him/herself up to potential legal problems, so I thought I would ask on this site.

I realize that there isn't enough information in the question to make a determination as to whether HIPAA violations exist, but does this question suggest that the company has some underlying issues with data security that could rise to the level of HIPAA violations? And could the OP be providing evidence of complicity (albeit unwitting complicity) in such by providing the usernames and passwords they request? And would it be a good idea for the OP to seek out legal advice before doing as the company asks?

Answer 1

HIPAA imposes obligations on some people, but not all people. In the case of security and privacy questions, you would consult 45 CFR Part 164. A patient's actions are not subject to government sanctions, so a patient can provide or decline to provide email addresses following their own judgment. A healthcare or insurance provider would be required to securely keep PII under wraps. The regulations also do not impose obligations on unknowing potentially involved third-parties, i.e. no obligation is imposed on Google to know that an individual is using a Gmail account to transmit PII-related information. The medical provider has an obligation to store and transmit such information securely, which would mean for example that they do not send insecure plain text emails saying "Sally Jones at 12345 67th Ave SW was treated for a loathsome disease, we're coding that as 0102, and we want $500".

That obligation is passed on to employees via employment-contractual obligations, for example that may dictate what computer or software you can use to do the job. If the provider passes the buck to the employee (and I assume that the employee is just an employee), they have violated the security rule. In that case, they may be attempting to mitigate the consequences of their actions or at least check if there were identifiable violations of the privacy rule.

In the scenario where SmithMed provides all of the infrastructure needed to bill insurance companies, it is not a HIPAA violation to inspect computer logs, email etc. to verify that the employee has been complying with security and privacy policies. It would likewise not be a HIPAA violation to inspect third-party accounts (Gmail etc) to determine whether there has been a security / privacy rule violation. That is as far as HIPAA takes you.

Whether or not the ex-employee has an obligation to turn over their email account information is mostly determined by the employment contract, but it is highly unlikely that any such contract has a "gimme your personal email on termination" clause. It is not inconceivable that the employee negligently used their personal account rather than opening a new billing-job only account. Also depending on the email service provider, it may well be a violation of the terms of service to hand over your account information. (Instead, for a certain email provider, the company is expected to set up and pay for a company account). Those are considerations bearing on possible legal impediments to turning over the email information. Needless to say, don't share passwords etc. because that exposes you legally, but that is not about HIPAA.