2

Dentist office just printed my password (to their portal) on their paperwork.

Surely this is a HIPAA violation (or against best practices, HIPAA or otherwise).

Can anyone confirm if so and point me to any resources?

I have looked independently but am unclear.

|improve this question
  • 2
    HIPAA prevents giving your information to other parties. If they use it internally or give it to you that is not giving it to someone else. – Putvi Oct 22 '19 at 20:34
  • Hello! Welcome to Law.SE. Please read our tour page. You can see the link at the bottom of the page. – isakbob Oct 25 '19 at 3:52
3

This is not a HIPAA violation. HIPAA requires that personal information not be revealed to people lacking a statutorily-defined interest, without the patient's consent. A password itself is not "personal information", though having it could lead to such information. An example of personal information would be the fact that you personally had a certain tooth filled (not that "somebody had a tooth filled"). Protected information can be revealed to certain people, such as the lab that they send samples to, or your insurance company. This is covered by what is known as "The Privacy Rule". There is a related rule, the Security Rule, which essentially says "you need to keep information safe". An example of a required security rule standard is that the provider must

Implement policies and procedures to address the final disposition of electronic protected health information, and/or the hardware or electronic media on which it is stored

HHS recommends degaussing, but other means of satisfying the rule exist (burning, dissolving in acid). Tossing in the trash would not satisfy the rule. Password management falls under the weaker category of "addressable", that is, a provider needs to think about how they will manage passwords, but there is no specific requirement regarding what you have to do (unlike the requirements of Data Backup, Written Contract. Incident Reporting or Media Disposal). Printing and distributing to customers your account and password would, on the other hand, be a reportable incident.

Information about your name, the dental procedure done, and the cost of the procedure, is probably also on the paperwork that they give you, and that even more than your password is protected information. A provider is allowed, indeed required, to disclose protected information to the patient. The assumption is that once you have processed that information, you will destroy or protect the paperwork, as you see fit.

|improve this answer
  • 1
    This is incorrect. The password would be identifiable, but its going to the patient is the reason it is ok. – Putvi Oct 22 '19 at 20:33
  • 1
    Why do you think that printing information constitutes disclosing it? – user6726 Oct 22 '19 at 21:18
  • It is disclosing because it could be given to some other party. If it is given to the patient or used internally that is obviously ok. – Putvi Oct 22 '19 at 21:20
  • Oh are you trying to say I said just printing something is disclosing it to a person? No, I'm saying you said the password is not an identifier, but is should be. – Putvi Oct 22 '19 at 21:24
  • 2
    @Putvi How is "Ei8jiDAnff9Y1l0&YVK9" an identifer? (I don't use that password, I just got LastPass to generate it for me.) – Martin Bonner supports Monica Oct 23 '19 at 16:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.