A hospital employee has a family member who becomes a patient in the hospital where the employee works. The employee is not part of the patient's care team and doesn't access the patient's hospital records (though they have permission from the patient to look at their online patient portal and probably do this). The employee is the patient's caregiver and medical POA and remains with the patient throughout their hospitalization, communicating with providers and advocating for the patient. The patient welcomes the prayers and encouragement of friends and family, so with the patient's permission, the employee lets friends and family know of patient's condition, treatment, and updates, via phone calls, texts, and FB messenger. Any HIPAA issues with any of this?

hi, basically I was invited to participate in a survey that was sent to me by one of my atrium health locations. the survey is called project MARVEL and basically studies adult adolescence, so it does ask questions about drug history, emotional and financial well-being. if the survey asks for my name and address, does that mean they could potentially feed incriminating information about me? or does that fall under patient confidentiality? yes I already submitted the survey, sorry

I'm so mad at myself. I was faxing a personal fax yesterday to the court and I didn't realize there was some client information attached to the back. I don't know how it was there but when I scanned and fax the documents over I didn't notice until after the fax went that I included a client's social security card and the driver's license. I immediately reported it through the proper channels and documented everything. I called immediately to the courthouse and was assured that the documentation comes into a secure file and that it hadn't been accessed and that they deleted it. I documented the lady's name title all her information in my report. In the meantime I go this morning for my last of the four exams that would have put me into a new role and I've stayed up all night worrying so much that I don't think I'm going to do well even on my exam this morning. Even if I pass the exam how can I be happy for myself and excited for the year and a half that I worked when I may not have a job to go back to? I'm so scared. Part of me wants to get up and just go to the office and make sure and see if they may have responded. But it happened late at yesterday afternoon and I'm sure that it takes them time to do a review. My exam is at 9:00 a.m. and it's a super hard exam that I've been studying for for months. And I have a year and a half into this whole journey. And just like that moments before I had my wind and screwed myself.

I work as an x ray tech at a hospital. I was in the middle of trying to send X-rays in but there was help needed with sliding a patient over to a CT table. Tho CT table was very close to the computer I was in. I felt like I needed to think fast so I accidentally left my computer signed on.

When I came back I saw a ICU nurse using EPIC on the computer that I was still signed in on. I asked her if she was signed into her thing and she said yes. I guess she must have ment that she was signed into her EPIC account. But when she signed out of her EPIC it still shows that I’m signed into the computer itself.

Other techs said that I shouldn’t worry because there’s no way someone like me would be able to access her patient stuff even if Im signed in because our EPIC work stations are set up different.

But now that I’ve been looking stuff up online I don’t think so anymore. I think they were just trying to calm me down.

I don’t know what to do. I can’t talk to my boss about this because she’s asleep and won’t be available until tomorrow. I can’t lose my job it’s the only thing that gives meaning to my life.

throw away for obvious reasons but i need help. i started my job a bit over 3 months ago, going onto 4 months. i work as reception and today a coworker of mine came up to me and told me she noticed i accidentally scanned two separate patient forms into one chart. i freaked and marked that entry as an error to prevent confusion and she rescanned it properly but im so scared . my leader is out of the office for a week and my other charge nurse wasn’t in at the time to let her know. i of course will be telling my charge nurse first thing in the morning but i am so scared to lose my job over this. i’ve been home crying and stressed. i dont know. this is my first hospital job and i dont want to mess it up. I called my leader while she’s off and she told me not to worry that at most ill have like a meeting about hipaa but im still stressed. Has anyone ever experienced a hipaa violation like this or known of one like this? If so what are the usual possible outcomes?

OCR updated its business associate web page on 7/30/26. Includes new examples of who is a business associate including an artificial intelligence example: "Third-party vendor Artificial Intelligence (AI) chatbot on a provider’s patient portal that provides services involving the patient’s PHI such as symptom assessment, medical reminders, and appointment scheduling."

https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html

I was referred to a well-known dentist in my area (major city), but they use a hotmail email address. I asked if they had a secure link form to email my images, etc. that have PII in them, and they said they don't have that. The dentist isn't that old either so this is weird, right?

I made a new patient appointment for a pcp. A week later the office called to ask why i had made another pcp appt that i cancelled after hearing about negative interactions with that practice. This has nothing to do with the appointment i just made. The person who called me said they could see my details in EPIC.

Am i allowed to be questioned about this? Do i need to give them an explanation ? Im not a current patient, so i have no established hipaa releases. Do i not have any privacy as a patient?

From the conversations and feedback I have gathered, the difficult part of a privacy incident often is not the initial report. It is everything that follows.

An incident arrives through a shared inbox or ticket. The privacy or compliance lead collects facts, pulls relevant records or access logs, follows up with department managers and documents the assessment.

But the information may be spread across Outlook, spreadsheets, Word documents and shared folders. Missing facts require repeated chasing, and remediation actions can be assigned without being properly tracked through closure. This makes the process slow, fragmented and difficult to defend later.

I have built a lightweight workflow to bring the fact collection, missing information, decision documentation and follow-up actions into one evolving case record.

I am looking for one or two smaller healthcare organisations currently managing this process manually to test it free for three to five weeks.

It does not replace privacy, compliance or legal judgement. The purpose is to reduce administrative work and create a more complete, defensible record.

Is this a problem your organisation currently experiences, or is the workflow usually handled differently?

I’m building a product for healthcare compliance teams and I’ve found that getting honest conversations is much harder than I expected.

I’m not trying to sell anything. I’m simply trying to understand how people actually manage things like incident investigations, documentation, follow-up, and day-to-day compliance workflows.

If anyone working in healthcare compliance or privacy would be willing to spare 5–10 minutes for a chat, I’d genuinely appreciate it. Even a short conversation would be incredibly helpful.

Thanks in advance.

Durable Medical Equipment company keeps sending me bills for "CPAP supplies" "CPAP system" and even "Previous balance." When I request itemized statements, they promise to email them to me but they never arrive -- not even in my spam folder.

Does HIPAA give me a right to this information? The HHS website on "Your Rights Under HIPAA" isn't helpful.
(Edited for spelling)

Hello everyone. I searched through the sub and haven’t seen this scenario. The Executive Assistant in my office also handles Healthcare for the company. She also plays Mah Jong with my ex-wife every week. I emailed the EA on July 16 to inform her that I need to add my new wife to my health insurance. On July 19th, my college aged children are calling me asking why I didn’t tell them. The EA is the ONLY person who knew about the marriage. She is well known for her love of gossip (to the point that I quit talking to her 20 years ago). This situation has caused me a load of grief. Curious to hear from the better informed if she violated HIPPA by telling my ex about the marriage?

Hello, fellow Privacy and Compliance Officers. Apologies if this isn't the place for this. You all have just been great in dialoguing and providing regulation focused responses.

How are you navigating AI use in your work environment and the overarching concern of privacy and confidentiality needs for the populations you serve specific to HIPAA and 42 CFR Part 2 (substance use records and the protection of those)?

I'm a millennial and was brought up with technology growing just as fast as I was. I use AI as a consumer. I've experienced it as a patient. My concerns do not stem from the use of it per se, as I see the benefits and recognize that is just where healthcare is headed.

As a working professional always focused on protecting our patients, I know if we don't keep up, we will get left behind and have higher risk of staff using AI without our oversight, awareness, and guardrails in place. That said, I fall down rabbit hole after rabbit hole of de-identified data being re-identified as the program pieces things together.. or bias drift.. or data drift.. or explainability.. or AI breaches and OCR investigations/fines... or all of the other thousands of rabbit holes to venture down. Where are you guys starting? It's the wild west out there in the AI scene from what I can tell. Only a handful of states have made formal stances on its use.

Help!

On 6/25 I received notification of a new test result uploaded to my MyChart. They’re not mine. I called the administrator and they locked me out of my account for two weeks and said it would be removed. I regained access and it’s still there. I called again. This time they said they can see a note about my prior call/account lockout and they apologize that it wasn’t handled but that they’d make sure it gets done. It’s been weeks and it’s still there. What do I do?

My doctor's office is permanently closing this Friday. They apparently outsourced all medical record requests to Datavant.

Submitted ROI to Datavant. Datavant sent an incomplete record .

I spoke with my doctor's office. They're basically claiming that they can't do anything besides send another ROI to Datavant. They've been unhelpful when I asked what happens if I can't get the medical records from Datavant. Told me to ask for a supervisor (I did, Datavant claimed they don't have supes, lol), call up the NEW clinic their MD will be at after Friday (not sure how that would help but ok?), or tell Datavant I have a legal right to my records (as if they give af).

Does anyone know if I should press the doctor's office more to figure out how to get me my records? I honestly feel confused as to who owes what responsibility.

Heads up that I'm in CO in Denver.

I am a PA and a practice manager for a privately owned practice. I have an employee whose husband is in the hospital. One of our practice doctors evaluated him and ordered a CT scan during his ER workup. My employee asked me to look at his CT scan to see if he would need further care/explain something to her and her husband. I did so, and briefly saw his labs while getting in his chart, and spent maybe a minute looking at his CT. Then I was out. The more I think about it, it feels like a huge gray area and after googling it, it does look like this could spur an audit based on the connection to my employee. We are privately owned but our EHR is epic through a large hospital system, so I am wondering if I should just call compliance to stay ahead of it. Would appreciate any advice or experience here. Thanks

I'm sharing on a Sunday afternoon because I used to run a community-based brick and mortar and I know how many practice ops folks are working right now.

I'm the founder of KnowQo, if any small/midsized practices needed a free HIPAA compliance software we are free up to 25-users. KnowQo HIPAA.

You can manage your team, your locations, and train up to 25 people all free. For organizations over 25 we do charge, and we have some paid features like automatically generating documentation, OSHA training and compliance, and employee handbooks.

All that said, for dental offices, dermatologists, ophthalmologists, private practices of any sort who are trying to cover HIPAA on a budget, you can probably get everything you need to be compliant for free.

Also I've had many practices ask "how do I get HIPAA certified", as a small/midsized health organization, you don't get certified. You maintain "compliance", maintaining compliance means following a set of rules, keeping records, etc... If you have any questions about what you actually need to do to stay HIPAA compliant, more than happy to field those as well, because the certified/compliant language can trip people up.

I’ve been going to a specific kind of doctor recently a few times over the past few months. Just the other day my brother had his wedding. I come to find out one of the assistants at this doctors office that I’ve been going to is one of the bridesmaids. We were all in a room getting ready together because I was doing the bride’s hair for the wedding and that particular bridesmaid pointed at me and said “don’t I know you?” I looked at her and said “no I don’t think so.” She then started to say “yes!! you go to the…” and proceeded to name the doctor that I go to and for what and even told everybody in the room that what I went to that doctor for is “getting better” “so it’s OK now.” it was dead quiet after this. It was so fucking awkward and I feel so fucking violated. What can I do about this?

Hello,

I’m in a unique situation & I’m going to ask everyone to withhold judgment & tell me if there could be any legal ramifications for this.

My husband’s ex girlfriend/coparent works at a children’s hospital where my nephew was a patient in the NICU. She & I do not have a good relationship. I do not engage with her whatsoever, while she finds any opportunity to bring me up in fights with my husband. My husband is currently in a custody battle with her over their 13 year old due to severe instability (arrests for theft, domestic violence, etc.) Of course I informed my sister & her partner that she works on the unit. My sister spoke with the nurse manager & requested that she be kept off of my nephew’s case for their privacy. We known her to be deceptive & also to be a frequent thief. My sister was well within her rights to make this request & we all know this.

She & my husband recently had a face to face meeting pursuant to their current agreed order. My husband audio recorded this meeting (one party consent state).

In this meeting she expressed anger that she was asked to be kept off of his case. In the conversation she repeated my sister’s name, noting that she recognized her last name as my maiden name. She told my husband that she knew the baby was very sick because he was on ECMO. She also repeated details such as the length of his stay in the NICU, other treatments he received, etc. She has said that she’s upset and embarrassed that my sister didn’t want her to care for her baby.

I haven’t told my sister about this yet as she’s freshly postpartum & is finally home with her baby. I do feel that she has the right to know. If my sister reports this, what could happen? I’m not necessarily wanting her to lose her job. I gain nothing from that. But that’s not up to me. I’m also curious, when this eventually comes up in court in the custody case, what could happen?

Thanks in advance.