3

This question from the workplace stackexchange asks:

I recently resigned from my job ... in NY ... Now I am being asked to tell them all my usernames and passwords for websites I used for my job as a medical biller ie, insurance websites, Medicare, eligibility websites and so forth ... Do I have to give them this information? We don't have company email accounts. So I had to use my personal email to set them up.

My response was that there were probably HIPAA violations involved in this, and she shouldn't give them any information without consulting a lawyer. I've gotten quite a bit of pushback on this of the "you're not answering the question asked" variety, with explanations of "frame challenges" and the like. But I was concerned that the OP was opening him/herself up to potential legal problems, so I thought I would ask on this site.

I realize that there isn't enough information in the question to make a determination as to whether HIPAA violations exist, but does this question suggest that the company has some underlying issues with data security that could rise to the level of HIPAA violations? And could the OP be providing evidence of complicity (albeit unwitting complicity) in such by providing the usernames and passwords they request? And would it be a good idea for the OP to seek out legal advice before doing as the company asks?

2
  • I find it highly unlikely that the use of a private email account to log in to a system would be a HIPAA violation. HIPAA doesn't care how people log in to systems, it cares about the security of the data. And if the employee did things improperly, not giving their passwords would not protect them. – Tiger Guy Mar 26 at 9:00
  • @TigerGuy I did a bit of IT work for a health care company, and they not only required that we work only from the office, they used a thumb drive for two-factor authentication. The thumb drive was kept in a locked drawer in the desk and the authentication protocol was tied to the MAC address of the machine. Given that experience, this company's security protocol as described by the OP seems relatively perfunctory. – BobRodes Mar 26 at 23:14
3

HIPAA imposes obligations on some people, but not all people. In the case of security and privacy questions, you would consult 45 CFR Part 164. A patient's actions are not subject to government sanctions, so a patient can provide or decline to provide email addresses following their own judgment. A healthcare or insurance provider would be required to securely keep PII under wraps. The regulations also do not impose obligations on unknowing potentially involved third-parties, i.e. no obligation is imposed on Google to know that an individual is using a Gmail account to transmit PII-related information. The medical provider has an obligation to store and transmit such information securely, which would mean for example that they do not send insecure plain text emails saying "Sally Jones at 12345 67th Ave SW was treated for a loathsome disease, we're coding that as 0102, and we want $500".

That obligation is passed on to employees via employment-contractual obligations, for example that may dictate what computer or software you can use to do the job. If the provider passes the buck to the employee (and I assume that the employee is just an employee), they have violated the security rule. In that case, they may be attempting to mitigate the consequences of their actions or at least check if there were identifiable violations of the privacy rule.

In the scenario where SmithMed provides all of the infrastructure needed to bill insurance companies, it is not a HIPAA violation to inspect computer logs, email etc. to verify that the employee has been complying with security and privacy policies. It would likewise not be a HIPAA violation to inspect third-party accounts (Gmail etc) to determine whether there has been a security / privacy rule violation. That is as far as HIPAA takes you.

Whether or not the ex-employee has an obligation to turn over their email account information is mostly determined by the employment contract, but it is highly unlikely that any such contract has a "gimme your personal email on termination" clause. It is not inconceivable that the employee negligently used their personal account rather than opening a new billing-job only account. Also depending on the email service provider, it may well be a violation of the terms of service to hand over your account information. (Instead, for a certain email provider, the company is expected to set up and pay for a company account). Those are considerations bearing on possible legal impediments to turning over the email information. Needless to say, don't share passwords etc. because that exposes you legally, but that is not about HIPAA.

3
  • Thanks for responding. Does the OP's statement "We don't have company email accounts. So I had to use my personal email to set them up" raise questions about the company as it did for me? Reading between the lines, it seems to me likely that the software the company was using required an email to open an account, the OP was not provided with one by the company, and so used their personal email rather than creating a new personal email account to be used specifically with this account. It seems likely that the OP asked for help and got none or was following directions. – BobRodes Mar 25 at 16:13
  • Yes, this strongly looks like a security-rule violation by the company managing the coding, and tried to shift the burden on the employee. – user6726 Mar 25 at 16:58
  • Thank you. I will share this over there. – BobRodes Mar 25 at 18:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.