Is it a HIPAA violation to use a personal email to set up a medical billing account at work? This question from the workplace stackexchange asks: I recently resigned from my job ... in NY ... Now I am being asked to tell them all my usernames and passwords for websites I used for my job as a medical biller ie, insurance websites, Medicare, eligibility websites and so forth ... Do I have to give them this information? We don't have company email accounts. So I had to use my personal email to set them up. My response was that there were probably HIPAA violations involved in this, and she shouldn't give them any information without consulting a lawyer. I've gotten quite a bit of pushback on this of the &quot;you're not answering the question asked&quot; variety, with explanations of &quot;frame challenges&quot; and the like. But I was concerned that the OP was opening him/herself up to potential legal problems, so I thought I would ask on this site. I realize that there isn't enough information in the question to make a determination as to whether HIPAA violations exist, but does this question suggest that the company has some underlying issues with data security that could rise to the level of HIPAA violations? And could the OP be providing evidence of complicity (albeit unwitting complicity) in such by providing the usernames and passwords they request? And would it be a good idea for the OP to seek out legal advice before doing as the company asks?
HIPAA imposes obligations on some people, but not all people. In the case of security and privacy questions, you would consult 45 CFR Part 164. A patient's actions are not subject to government sanctions, so a patient can provide or decline to provide email addresses following their own judgment. A healthcare or insurance provider would be required to securely keep PII under wraps. The regulations also do not impose obligations on unknowing potentially involved third-parties, i.e. no obligation is imposed on Google to know that an individual is using a Gmail account to transmit PII-related information. The medical provider has an obligation to store and transmit such information securely, which would mean for example that they do not send insecure plain text emails saying &quot;Sally Jones at 12345 67th Ave SW was treated for a loathsome disease, we're coding that as 0102, and we want $500&quot;. That obligation is passed on to employees via employment-contractual obligations, for example that may dictate what computer or software you can use to do the job. If the provider passes the buck to the employee (and I assume that the employee is just an employee), they have violated the security rule. In that case, they may be attempting to mitigate the consequences of their actions or at least check if there were identifiable violations of the privacy rule. In the scenario where SmithMed provides all of the infrastructure needed to bill insurance companies, it is not a HIPAA violation to inspect computer logs, email etc. to verify that the employee has been complying with security and privacy policies. It would likewise not be a HIPAA violation to inspect third-party accounts (Gmail etc) to determine whether there has been a security / privacy rule violation. That is as far as HIPAA takes you. Whether or not the ex-employee has an obligation to turn over their email account information is mostly determined by the employment contract, but it is highly unlikely that any such contract has a &quot;gimme your personal email on termination&quot; clause. It is not inconceivable that the employee negligently used their personal account rather than opening a new billing-job only account. Also depending on the email service provider, it may well be a violation of the terms of service to hand over your account information. (Instead, for a certain email provider, the company is expected to set up and pay for a company account). Those are considerations bearing on possible legal impediments to turning over the email information. Needless to say, don't share passwords etc. because that exposes you legally, but that is not about HIPAA.
Without a jurisdiction, I'll just say that unless the comments made in the reviews and discussions were false, the individual is unlikely to have any claim, particularly given that you've stated that this occurred over the course of a year. However, the individual may be able to argue that they were not given sufficient notice of their performance, for example through performance evaluations, and given the length of time, it likely that one would have occurred. A company may be able to terminate an employee in spite of their overall contributions if they have breached policy - for instance, an otherwise outstanding employee who attracts negative customer reviews based in fact, and who is given ample opportunity and guidance to improve, may cause brand and reputational damage to the company; in this case, it is a commercial decision to retain or terminate the employee. As for what recourse the employee has, if the comments were factual, then it is likely that they will not have any, unless the employer has not adhered to procedural requirements - for instance, in Australia, you are required to provide an employee the opportunity to have a support person present at any meeting which may result in the employee's termination - or the employer broke some other law - for instance, discrimination, bullying or harassment law. Unfortunately, the contributions an employee makes does not necessarily negate the harm they do, and complaints based on an employee's performance are completely valid if factual.
Could the GoDaddy employee self-phishing test constitute a breach of contract? No. There is no contract. It was only the announcement of a gift. That gift might have been unexpected, especially if no similar bonus was given in previous years. The employee's act of filling in his information does not seemingly amount to &quot;consideration&quot;. Filling the data was portrayed as the step to facilitate the delivery of the bonus. Your description --or the article you shared-- has no indication that the employee's fill-in details were devised to benefit the company. Had the company's message been drafted in a way that qualifies it as an offer of contract, the description would be inconclusive because there are no details about: The exact URLs for &quot;(Link for US)&quot; and &quot;(Link for EMEA)&quot;: If the URLs were an alteration of the company's domain, it would be unreasonable for the employee to presume that the offer was legitimate. What data the &quot;failed&quot; employees filled in: Being asked to provide information unrelated to the alleged bonus should have raised suspicions. The contents of the Security Awareness training and what alertness could be reasonably expected from the email recipients even if no training were provided. In the case of companies such as GoDaddy (being in the business of web domains and hosting), one would expect many of its employees (except janitors, etc.) to be more careful or judicious on matters of social engineering than in other industries with less exposure to Internet scams.
The tort for this kind of activity is called public disclosure of private facts, and almost every U.S. state recognizes that this tort is invalid under the First Amendment in the absence of a legal duty not to disclose of the type existing between an attorney and client, or a psychotherapist and a patient, or a contractual non-disclosure agreement, that does not exist between roommates. There is nothing illegal about your roommate's conduct. Your best move at this point is to take responsibility for your own conduct, to repent and to convince the world that you're doing your best to get on the straight and narrow going forward. If your former roommate insisted on payment for not disclosing the information, that would be extortion, but there is nothing wrong with going ahead and disseminating it without trying to obtain something of value from you for not doing so.
You violated Facebook's Terms of Service, and it's entirely within your contractual agreement with them for them to close your account. You agreed to abide by the contract you "clicked through" when you signed up and opened a Facebook account. They didn't break any laws when you broke your contract with them. You clearly broke the contract by violating the TOS. They are not breaking any laws by not restoring your account. What you see as the value of your personal or business data doesn't really mean anything; it was your choice to use Facebook in the first place, and your mistake to break the TOS. You could try hiring a lawyer to make a case that you see a difference between the personal data you want to retrieve and the business data that caused the violation, but that's up to you; Facebook is under no legal obligation (this could be different, according to your jurisdiction and national laws) to restore any or all access to your account or data, but it's possible they could be persuaded.
This notice has no legal power what so ever. This has been, and is being, used as a legal backup and a scare tactic. For the most part, if someone gets some sort of "sensitive" information in an email, and it was not intended for them - this notice will serve as a scare tactic to make people get rid of it because of the legal sound of the disclaimer. Also, the senders are preparing themselves for a legal battle by having the notice in email’s body. In case that the sender sent some “sensitive” data to the wrong recipient, they can be potentially held liable for privacy breach of information similar stuff. So, when they show up in court they can potentially use the argument that they did everything within their power to protect the information by adding the disclaimer and the fact that the privacy breach happened is due to a natural human error. Basically, there is no disclaimer that can protect against actual libelous or defamatory content. The most a disclaimer can accomplish in this respect is to reduce the responsibility of the company, since it can prove that the company has acted responsibly and done everything in its power to stop employees from committing these offenses. [1] If you as an employee of a company shared sensitive information or personal information by mistake, you, and the company are still liable for your own action. It can be argued in court that the recipient’s email was not verified, that a human error is not an excuse because the information could have been encrypted with a password, the information could have been transmitted via a phone call or in person, and a bunch of other excuses that will hold the company liable for damages. There is no legal doctrine or theory under which an email confidentiality disclaimer is enforceable in a circumstance like this. There is virtually no scholarly analysis of the impact of email disclaimers and very little analysis by non-scholars. One of the few authors who have commented on the subject suggests that the misconception that email disclaimers have validity may arise from the mistaken belief that the Electronic Communications Privacy Act (ECPA) somehow applies. Michael Santarcangelo, “Do Email Disclaimers Matter?,” Sec. Catalyst (Oct. 17, 2007). But, as this author points out, the ECPA prohibits only “intercepting” emails. Emails that arrive at their destination—even if the sender did not intend that destination—are not emails that have been intercepted in transit, and the ECPA is therefore inapplicable. In short, the ECPA is focused on the criminal intent of the interceptor, not the ability of the sender to execute his or her own intentions. With regard to communications with lawyers, the rules are a little different. Model Rule of Professional Conduct 4.4(b) states, “A lawyer who receives a document relating to the representation of the lawyer’s client and knows or reasonably should know that the document was inadvertently sent shall promptly notify the sender.” It is noteworthy that the rule requires only notice and doesn’t require refraining from reading the document or prohibit other use of the document. And a number of states haven’t even adopted Rule 4.4(b), so there may not be a requirement even to notify the sender in certain states. Nonetheless, if a court is examining “fairness” in connection with waiver of privilege, a disclaimer on an email sent to a lawyer might help. [4]
It would merely be a &quot;jerk move&quot;. HIPAA only applies to &quot;covered entities&quot;: Healthcare Providers Health Plans Healthcare Clearing Houses (i.e. Paying for your health care) Business Associates of the Above) Source: CDC page on HIPAA
In the absence of a contractual agreement saying otherwise, the lawsuit would probably just be subject to normal rules of tort liability. In that case, the contractor would probably lose his case unless he could prove that the one worker infected another through an act of negligence or could otherwise prove that the infected worker knew he was infected and posed a risk to others. In the basic negligence situation, the contractor would likely rely on the general duty we all have to avoid creating unreasonable risks of injury to third parties, and he would need to argue that Worker A somehow breached that duty. Coming to work knowing you're infected would almost certainly satisfy that standard, but it might be enough to simply show that Worker A was at a large gathering of unmasked people whose vaccination status was unknown. From there, he would also need to prove that breaching that duty caused him some injury, presumably by infecting Workers B through M, causing a work slowdown, causing missed deadlines, causing late fees, etc. The contractor might also pursue a claim for reckless, rather than negligent, conduct, if Worker A knew he was infected and came to work just the same. Or he might pursue an intentional tort claim if there was some reason to believe that Worker A was actually trying to get other people sick, as opposed to just ignoring the fact that such a risk existed. As I understand it, several states have also passed laws limiting liability for exposure to COVID in the workplace, so it's possible that none of these claims would be viable, no matter how strong the evidence.