We build software for healthcare teams, so we end up seeing how a lot of small practices actually run day to day. The EHR is almost never the problem. It's everything that grew up around it.

The stuff we keep running into:

1. Vendors nobody signed a BAA with. Someone signs up for a scheduling or reminder tool to save time, and a year later it's full of patient data. Lately it's AI note takers.
2. Shared logins. Three people on one front desk account means you can't tell who looked at what. HIPAA expects unique user IDs, and this one comes up in audits.
3. People who left but still have access. Portals, billing, the shared drive. Offboarding usually covers the EHR and stops there.
4. PHI sitting in email and texts. Lab results sent from a personal phone, an error alert with a patient's name in it, a spreadsheet export in a shared folder. Those copies live outside every control you've set up.
5. Audit logs nobody reads. Most systems keep them. Almost nobody looks unless something already went wrong.
6. A risk analysis from years ago. It's required, and an outdated one is one of the most common problems OCR cites. Every time you add a tool, it should get updated.

None of this needs a big budget. A vendor list with BAA status, an offboarding checklist, named accounts, and someone checking access once a month covers most of it.

We're not attorneys, so run specifics by your compliance person.

If you manage compliance for a small practice, which of these has been the hardest to actually fix?

One I have no provider/patient relationship with, but I do have a personal relationship with them (went to HS with them 30+ years ago, socialized with them at reunions, Facebook friends, etc). What is the best way for me as a patient to respond to this?

If it matters, they are now showing in my Upcoming Appointments section for an appt in November and one in December, but they are not my provider at this practice (I didn't even know they worked for a different office for this company). I do have an appointment with my provider, tomorrow, which is why I was looking at that section of my online account.

Thanks!

Hi everyone, I think what just happened to me was a HIPAA violation although I’m not sure how to go about addressing it and ensuring it doesn’t happen again.

For context I haven’t spoken to my mother in over 10 years. It ended with policed being involved and advising her not to contact me. I moved away from her across state lines 10 years ago and have successfully cut off contact after tremendous effort due to keeping an extremely low profile and private life.

Now on to the situation: about a year ago, I went to see my primary care doctor and they had a new space within their office that did bloodwork onsite, so I didn’t have to go get it elsewhere. I proceeded to get blood work done while at appointment. I guess I was under the impression that the service was included in the co-pay I had already paid when I checked-in as I never received a bill and I didn’t realize it was a separate business (labcorp). I realize now that that was stupid of me to assume but I just didn’t think about it, I have good insurance. (Also I’ve worked very hard to be debt-free a few years ago and check my credit score every month and this bill hasn’t shown up).

Fast forward to this week, apparently Lapcorp never billed my insurance and sent a bill of almost $1,000 to collections. No one called me and instead a collections agency called my estranged mother this week for some reason. They gave her my first and last name, which led to her being able to figure out that I have since been married and who my husband is. She has not contacted me directly, but has already contacted my husbands family, my work, and my other family members, and has made multiple social media posts (of course she is embellishing by claiming I’m in trouble with thousands of dollars of debt and is ‘just trying to help’)

Needless to say, I am experiencing my worst nightmare. I panicked and paid the bill immediately and will try to sort out what happened with my insurance. I asked the collections agency how they got my mom’s number and they told me that they received it from labcorp and gave me their contact info. Labcorp claims they don’t have that phone number on file had no idea where the collections agency could have gotten it. After further back and forth said they must have received it from my primary care doctors office. (I also called my doctors office and confirmed they only have my number on file). Ultimately they were VERY unsympathetic about the situation and blamed the collections agency and then my drs office. At one point they even said I could have avoided the situation if I had paid my bill (but again I didn’t know about the bill!!!!!)

Questions
- Did the collections agency commit Hipaa by contacting and giving my new name to my mother?

- How do I go about ensuring none of these places contact my mother in the future and remove this phone # from their file? Labcorp and my doctors claim they don’t have her contact info on file but it had to have come from somewhere - they are uninterested in getting to the bottom of it, so I feel like they will need to be compelled to do so. I just really can’t go through all of this again.

Edit to add context: I’m currently 35 years old, so not a minor. I also am not, nor have I ever been covered under her insurance.

How an EOB from our insurance company addressed solely to my husband disclosing all the details of our adult children's and my visits isn't a violation of HIPAA? Because it feels pretty violating. I've been hiding them from him but I don't know how long I can do that. He's not a great person and he simply does not need access to this information because he will use it to hurt people.

There seems to be a big misconception, that my software is competing with consultants.

That's really not what I'm trying to do. If anything, I think consultants could be some of the people who benefit from it the most. A consultant might be working with several organizations at once, reviewing policies, analyzing documents, investigating incidents and keeping track of recommendations and follow-ups.

And so much of that takes time. The whole point of my platform is to speed up that work, whether that's analyzing documents, getting compliance guidance or managing investigations, so consultants can spend less time on repetitive tasks and more time actually helping their clients.

I've had some really positive feedback from people working in healthcare and compliance, particularly around how much manual work could be reduced.

But I still think there's still some skepticism regarding AI in compliance, people somehow think its replacing the people doing the job. Personally, I see it as giving those people the ability to do more, potentially take on more clients and grow their own businesses.

Also interested in speaking with consultants who are currently managing compliance work across multiple clients. Id be keen to hear which parts of the process take up the most time and whether tools like this could help

There has been someone calling me repeatedly to sexually harass me over the phone however the content of the harassment is worded in a way that it can be interpreted as a medical condition they’re experiencing (even though it’s not physically possible).

think along the lines of inflation kink but presenting it like a medical condition they’re experiencing want me to be aware of?? And what can be interpreted as either sexual gratification or “treatment” needed to relive the condition due to purposefully vague wording.

They gesture to the fact this conversation should be confidential and I can’t tell anybody

To what extent is this person actually protected by hipaa what are my options? What can I do?

Without going into too much detail, I made a post on TT, basically saying healthcare in America is so bad that people would rather take the risk of dying versus getting a medical bill. It was from a personal experience via my job where a pt (who I didn’t identify other than that they were from Germany) was having a stroke and refused transport to a higher level of care. That’s all I mentioned in regards to the possible phi. Well, the post was stating to go much much larger than I’ve ever seen or anticipated. (I don’t post to be TT famous at all, I just like posting because it’s fun and I like sharing my journey.) then I started questioning if I shouldn’t have done that, even though my focus was on how terrible it is that people choose to die versus getting a medical bill that could send them in debt or bankruptcy. So, did I do bad? I deleted the post but it had 32k views so I’m worried it’s too late and now I’m thinking about my management possibly seeing it and omg, I’m worried I’m gonna be fired!! 😩

I go to an independent pharmacy and am so frustrated by them that I want to file a complaint, but am unsure if I’m valid to do so. I’ve been going to this pharmacy since I was a child, and my parents would pick up my prescriptions for me since I was still under their legal care as a minor.

However, I’m 21 now and have since changed the pharmacy’s point of contact to my number when I turned 18 and told them I don’t want them calling anyone else. But, every time I don’t pick up their call that my prescription is ready, they call my mom or dad and tell them to pick it up for me. They even explain to them what each prescription is and what it’s for and how many times a day I have to use it for. This is frustrating because I never authorized this after becoming an adult and I don’t want them to know what I’m being prescribed. I don’t have a good relationship with them and neither the pharmacy or my parents let me know they’ve picked it up, I have to find it out for myself when I show up and they tell me someone already picked it up. We just happen to use the same pharmacy still and they recognize us know from all the years we’ve been there.

To the medical professionals out there, is this breaking hipaa and if I reported them, would anything come of this?

Hi, so I'm not a nurse but I do have a question about HIPPA violations and it's somewhat specific.

My grandma was just taken out if a nursing home and in the process of hiring our own personal caregiver for her, the facility we got her out of had threatened the caregivers we hired, saying they were gonna report them to state for HIPAA violations if we didn't give them my grandma's information. See, when we originally pulled her from that facility, we also took the binder that had all her personal information of her time there, but they want it back. I didn't really think they had any reason for it so I ignored them, only to hear from one of our caregivers that the company had contacted them saying were gonna call the state on them and make a report about HIPAA rules being violated. What do I do? I thought they would be okay considering my grandma and mother gave them consent to look through her files.

Basically title. I’m in an allied health program (rad tech) and doing clinic at a small hospital. Never worked in a hospital setting before, but we use PACS. There was one instance where my preceptor was showing me diff images other techs took to go over anatomy and such. So in the morning, sometimes I would look at images (on patients who I did not assist with) to ID anatomy for education purposes, like I did with my preceptor.

I was chatting with friends who are at other hospitals; one said she is fine to do this, the other said she didn’t think it’s allowed. I’m asking my preceptor the next time I’m in if I’m allowed to or not; I thought it was different from going thru a persons EMR. I feel like I’ve fucked up majorly and don’t want to get kicked out of the program. I feel so stupid.

It has always been my understanding that HIPAA-covered entities have to honor 45 CFR 164.522, Patient Right to Confidentiality in Communications. In other words, patients have the right to request not to be recorded with their PII or their PHI on a physician, hospital, or health insurance provider’s phone lines. With AI now utilized in phone and scheduling systems, the right to private communications becomes even more important, especially since there are no updated HIPAA laws with regard to AI usage and patient privacy.

Here is my question: My mother-in-law’s FEHB plan will usually honor her request not to have her phone calls recorded…except for Capital BC/BS. The Capital BC/BC Federal plan claims they have the right to have a third-party listen in to any phone call…when their customer requests a return on a non-recorded phone line. They take days to return my mother-in-law’s phone calls and have compromised her physical health because of their failure to respond timely, even when her situation was urgent and she needed a referral from a BC/BS nurse to go to the ER.

When Capital BC/BS does return her calls, they insist upon using Microsoft Teams, which is not automatically HIPAA-compliant (but can be made so is my understanding), and then, they want to have a “babysitter” on the phone call, i.e., some insurance company employee who types or transcribes every word she says. My mother-in-law is furious about this state of affairs and refuses to discuss her female health issues with some 3rd party insurance person listening in. She just wants to be able to talk with her assigned case manager, who is a nurse. I don’t blame her for not wanting to share the gory details with an insurance employee vs. just a clinical case manager.

When we question this state of affairs, Capital BC/BS repeatedly insists that they are not violating HIPAA law. The OPM FEHB insurance office also claims that the company can do “whatever it wants to protect its business interests,” and OPM says they do not care about any state’s privacy laws. Capital BC/BS is located in PA, which is a 2-party consent state in terms of phone recording/wiretapping.

However, Capital BC claims it is not violating any PA wiretapping laws either. The PA Insurance Commissioner’s office has expressed disagreement with this claim. But employees in the State Attorney General’s office say they don’t know if PA wiretapping laws apply here, since the health plan, itself, is a Federal employee health plan. My mother-in-law is not old enough for Medicare, so Medicare does not apply.

Are there any Federal attorneys, Federal employees, or even PA attorneys on this sub who might be able to help provide guidance here or suggestions for how to get Capital BC/BS to honor both PA wiretapping laws and 45 CFR 164.522, the Patient Right to Confidentiality in Communications? Every other FEP health insurer in these parts seems to recognize and honor 45 CFR. They return her calls on a HIPAA-compliant, non-recorded phone line, and usually within just a few minutes to hours. There is never any “babysitter” on the phone with them. It is only Capital Blue Cross that seems to operate differently, but aren’t FEHB BC/BS plans supposed to be administered in exactly the same way, across the country?

I left a PCP practice because I didn't like the way they pushed unproven treatments (think injections of random peptides, steroids, etc). I made it clear I was leaving for cause and transferred my records to a new dr. My brother still goes to the practice and was asking about some autoimmune testing. A dr at the old practice pulled up my records at his request and told him my diagnosis.

I'm livid! But am I overreacting? Should I call the front office? TIA!

Title says most of it. I was at work and was trying to remember if this was the hospital I was born at or not. Then I had the very bright idea to lookup my own name in the patient search (stupid I know), because I figured that if my name popped up as a registered patient here, it probably meant this was where I was born. This normally does NOT add a patient to your list or display their chart or any PHI, but I accidentally double-clicked instead of single-clicked, which automatically added me to my own patient list. I removed it immediately, but it had already pulled up my chart and I know for a fact the system logged that I did that.

I looked up my department's policy, and employees are strictly not allowed to look themselves up, resulting in punishments "leading up to and including termination." I’m wondering here, what are my options, and what are the odds I’ll face significant action over this?

I’m planning on reporting this to my supervisor immediately. I think if I explain myself before the system flags it and brings it to his attention first, it might show that I’m being honest and forthcoming about my mistake. This is my first violation of anything, HIPAA or otherwise, but I’m also a new employee here. However, this unit has a lot of problems staying staffed, so I’m sure if I explain myself, they'll be less likely to fire me? Would they really jump straight to terminating someone for only accessing their own chart?

Please let me know so I can get some sleep over all this.

This is a work note:

"Patient had appointment 10/7/2026 at 6:00 PM for x-ray. Please excuse patient from work for his x-ray appointment. Please call the office if any further questions or concerns."

Hello - I have no specfic HIPAA training or knowledge but just had a kind of funny-to-me experience and wonder if that’s just how HIPAA works. I took a pretty bad fall, and my Apple Watch notified all the right people. EMTs came and brought me to the local hospital’s ED. I have been there before, but only once or twice, and not to the ED. Because I didn’t have ID with me they treated me, but “admitted” me under a comically fake name, with a comically old dob, with the comically untrue info on my bracelet. I was observed for 2 days, and the very last thing I did before leaving was to fill out a form with my actual name, address, dob and ssn (I’m in the US if that’s not obvious). When I asked if I should come back with my id they said no, that this form would match them up and the real treatment under the fake name would be merged with my actual record. Is that really all it took; and did they need my full ssn on a piece of paper? I didn’t argue with them, but I do have a thing about only putting the last 4 on paper and asked but they insisted on the whole SSN number. I complied, but sort of wish I hadn’t.

I had terrific treatment, and it was a major, highly respected network, so I’m not worried about anything, and I’m not complaining about anything, but I do wonder how much more secure a piece of paper is. I’m Not looking for any advice, and I was treated respectfully and am not complaining, I just was struck by the process.

Still feel like heck but that’s on me.

He changed things in his favor and added a bunch of lies. It was not in my digital records 11 months ago. He recently changed it without disclosure. How can I get the original copies?? Who do I contact?? I'm in Germany but I'm assuming it's similar around the world.

A bit of context: I’m an MA working for a tiny internal medicine office in WA state, I’m also responsible for medical records and prior authorizations. I was working on a PA yesterday that needed visit notes from a different office showing the patient tried and failed other medications. My work and their office both use EPIC, so I can easily get a hold of them if either of my providers needs to see them. I was under the impression that if something was not at least ordered by them, I can’t send it to another office/insurance. I don’t want to find out the hard way that I can’t do this.

My toddler has had physical therapy for most of his life, because of his premature birth. Recently, we moved to another state and had to find a new therapist.

At his old facility, ​there were multiple therapists working with multiple kids in a shared space with multiple parents observing. Nobody seemed to mind this. (There was, in fact, a sense of community, since we were all enduring similar difficult situations.)

When we started going to this new facility, it seemed to be much the same. This is a much smaller facility, so most of the time, there are only a couple of kids receiving therapy in the shared space at one time. I brought my child in, observed his therapy, encouraged him to try hard, and comforted him, when he failed. Just like always.

Now, after a month and a half of this, they are telling me that I won't be able to observe anymore. I'll have to wait in another room, while my child receives his therapy.

The reason they give is that my presence violates the privacy of the other children, because I might see or hear something privileged. So, they say it is against HIPAA.

Is that true? If it is, why did they let me violate their privacy for over a month? Why did the previous facility let me and other parents do it for years? Don't I have the right to be present for my minor child's appointment?

Sorry for the long post. Thanks in advance for any information you can provide.

-------- Update --------

I asked for a copy of their privacy policy. In a nutshell, it said, "We follow HIPAA. If you want specifics, our Notice of Privacy Practices is available on request." So, I requested it, and everybody looked at me like I'd asked for the moon. They ultimately said there isn't really any such document, except as part of their employee handbook. They said they would search through "all five hundred pages" and give me a copy, next week.

A privacy incident happens. Then comes the back and forth.

What happened? Who was involved?
What information is still missing?
Does this need further investigation?
What actions need to be taken?
How do we document the reasoning properly?

For many healthcare teams, that means jumping between emails, spreadsheets, Word documents and follow-up messages, everything is just scattered everywhere, because of this teams are wasting time when they do not need to!

Thats the problem Ive been working on solving. Ive built a workflow that brings the investigation into one place. It helps teams gather the facts, identify whats missing, work through the assessment, document the reasoning and track follow-up actions, with document analysis and privacy and compliance guidance built into the same workflow. The goal is simple. The goal is simple. Spend less time chasing information, reviewing documents, finding answers and putting defensible documentation together, while keeping the final judgement with the privacy or compliance professional.

Im now speaking with healthcare privacy and compliance teams who deal with these investigations regularly. If this is part of your role, Id be interested to hear how you're handling it today and where most of your time gets lost.

Building a product that handles PHI and every thread I read says the same thing, HIPAA is 80% process and 20% software. I buy it, the BAAs and risk analysis and the policies are clearly most of the work.

But what is the 20%? Because the code is where PHI moves, a bug there leaks real patient data which is a worse day than a missing policy doc. Beyond encryption, access control and keeping PHI out of the logs, I'm not sure where the software bar sits for a real assessment.

So for the code-security slice on its own, what are you all running. And not just the scan, I mean keeping the records that show the control ran and got reviewed since that is what the risk analysis seems to want. How do healthtech teams here split the software side from the compliance side?

I’ve built a workflow for US healthcare privacy/compliance teams and would appreciate feedback from people who actually handle privacy incidents.

The idea is to reduce the back-and-forth between emails, spreadsheets and documents by putting the investigation into one workflow: fact gathering, identifying missing information, decision support, follow-up actions and the case record, alongside document analysis for reviewing policies and compliance materials, and guidance for privacy/compliance questions.

What would you change, add or remove? And is there anything here that would stop you from using something like this in a real privacy team?