This question from the workplace stackexchange asks:
I recently resigned from my job ... in NY ... Now I am being asked to tell them all my usernames and passwords for websites I used for my job as a medical biller ie, insurance websites, Medicare, eligibility websites and so forth ... Do I have to give them this information? We don't have company email accounts. So I had to use my personal email to set them up.
My response was that there were probably HIPAA violations involved in this, and she shouldn't give them any information without consulting a lawyer. I've gotten quite a bit of pushback on this of the "you're not answering the question asked" variety, with explanations of "frame challenges" and the like. But I was concerned that the OP was opening him/herself up to potential legal problems, so I thought I would ask on this site.
I realize that there isn't enough information in the question to make a determination as to whether HIPAA violations exist, but does this question suggest that the company has some underlying issues with data security that could rise to the level of HIPAA violations? And could the OP be providing evidence of complicity (albeit unwitting complicity) in such by providing the usernames and passwords they request? And would it be a good idea for the OP to seek out legal advice before doing as the company asks?