Dentist office just printed my password (to their portal) on their paperwork.
Surely this is a HIPAA violation (or against best practices, HIPAA or otherwise).
Can anyone confirm if so and point me to any resources?
I have looked independently but am unclear.
This is not a HIPAA violation. HIPAA requires that personal information not be revealed to people lacking a statutorily-defined interest, without the patient's consent. A password itself is not "personal information", though having it could lead to such information. An example of personal information would be the fact that you personally had a certain tooth filled (not that "somebody had a tooth filled"). Protected information can be revealed to certain people, such as the lab that they send samples to, or your insurance company. This is covered by what is known as "The Privacy Rule". There is a related rule, the Security Rule, which essentially says "you need to keep information safe". An example of a required security rule standard is that the provider must
Implement policies and procedures to address the final disposition of electronic protected health information, and/or the hardware or electronic media on which it is stored
HHS recommends degaussing, but other means of satisfying the rule exist (burning, dissolving in acid). Tossing in the trash would not satisfy the rule. Password management falls under the weaker category of "addressable", that is, a provider needs to think about how they will manage passwords, but there is no specific requirement regarding what you have to do (unlike the requirements of Data Backup, Written Contract. Incident Reporting or Media Disposal). Printing and distributing to customers your account and password would, on the other hand, be a reportable incident.
Information about your name, the dental procedure done, and the cost of the procedure, is probably also on the paperwork that they give you, and that even more than your password is protected information. A provider is allowed, indeed required, to disclose protected information to the patient. The assumption is that once you have processed that information, you will destroy or protect the paperwork, as you see fit.
