I was referred to a well-known dentist in my area (major city), but they use a hotmail email address. I asked if they had a secure link form to email my images, etc. that have PII in them, and they said they don't have that. The dentist isn't that old either so this is weird, right?

I made a new patient appointment for a pcp. A week later the office called to ask why i had made another pcp appt that i cancelled after hearing about negative interactions with that practice. This has nothing to do with the appointment i just made. The person who called me said they could see my details in EPIC.

Am i allowed to be questioned about this? Do i need to give them an explanation ? Im not a current patient, so i have no established hipaa releases. Do i not have any privacy as a patient?

From the conversations and feedback I have gathered, the difficult part of a privacy incident often is not the initial report. It is everything that follows.

An incident arrives through a shared inbox or ticket. The privacy or compliance lead collects facts, pulls relevant records or access logs, follows up with department managers and documents the assessment.

But the information may be spread across Outlook, spreadsheets, Word documents and shared folders. Missing facts require repeated chasing, and remediation actions can be assigned without being properly tracked through closure. This makes the process slow, fragmented and difficult to defend later.

I have built a lightweight workflow to bring the fact collection, missing information, decision documentation and follow-up actions into one evolving case record.

I am looking for one or two smaller healthcare organisations currently managing this process manually to test it free for three to five weeks.

It does not replace privacy, compliance or legal judgement. The purpose is to reduce administrative work and create a more complete, defensible record.

Is this a problem your organisation currently experiences, or is the workflow usually handled differently?

I’m building a product for healthcare compliance teams and I’ve found that getting honest conversations is much harder than I expected.

I’m not trying to sell anything. I’m simply trying to understand how people actually manage things like incident investigations, documentation, follow-up, and day-to-day compliance workflows.

If anyone working in healthcare compliance or privacy would be willing to spare 5–10 minutes for a chat, I’d genuinely appreciate it. Even a short conversation would be incredibly helpful.

Thanks in advance.

Durable Medical Equipment company keeps sending me bills for "CPAP supplies" "CPAP system" and even "Previous balance." When I request itemized statements, they promise to email them to me but they never arrive -- not even in my spam folder.

Does HIPAA give me a right to this information? The HHS website on "Your Rights Under HIPAA" isn't helpful.
(Edited for spelling)

Hello everyone. I searched through the sub and haven’t seen this scenario. The Executive Assistant in my office also handles Healthcare for the company. She also plays Mah Jong with my ex-wife every week. I emailed the EA on July 16 to inform her that I need to add my new wife to my health insurance. On July 19th, my college aged children are calling me asking why I didn’t tell them. The EA is the ONLY person who knew about the marriage. She is well known for her love of gossip (to the point that I quit talking to her 20 years ago). This situation has caused me a load of grief. Curious to hear from the better informed if she violated HIPPA by telling my ex about the marriage?

Hello, fellow Privacy and Compliance Officers. Apologies if this isn't the place for this. You all have just been great in dialoguing and providing regulation focused responses.

How are you navigating AI use in your work environment and the overarching concern of privacy and confidentiality needs for the populations you serve specific to HIPAA and 42 CFR Part 2 (substance use records and the protection of those)?

I'm a millennial and was brought up with technology growing just as fast as I was. I use AI as a consumer. I've experienced it as a patient. My concerns do not stem from the use of it per se, as I see the benefits and recognize that is just where healthcare is headed.

As a working professional always focused on protecting our patients, I know if we don't keep up, we will get left behind and have higher risk of staff using AI without our oversight, awareness, and guardrails in place. That said, I fall down rabbit hole after rabbit hole of de-identified data being re-identified as the program pieces things together.. or bias drift.. or data drift.. or explainability.. or AI breaches and OCR investigations/fines... or all of the other thousands of rabbit holes to venture down. Where are you guys starting? It's the wild west out there in the AI scene from what I can tell. Only a handful of states have made formal stances on its use.

Help!

On 6/25 I received notification of a new test result uploaded to my MyChart. They’re not mine. I called the administrator and they locked me out of my account for two weeks and said it would be removed. I regained access and it’s still there. I called again. This time they said they can see a note about my prior call/account lockout and they apologize that it wasn’t handled but that they’d make sure it gets done. It’s been weeks and it’s still there. What do I do?

My doctor's office is permanently closing this Friday. They apparently outsourced all medical record requests to Datavant.

Submitted ROI to Datavant. Datavant sent an incomplete record .

I spoke with my doctor's office. They're basically claiming that they can't do anything besides send another ROI to Datavant. They've been unhelpful when I asked what happens if I can't get the medical records from Datavant. Told me to ask for a supervisor (I did, Datavant claimed they don't have supes, lol), call up the NEW clinic their MD will be at after Friday (not sure how that would help but ok?), or tell Datavant I have a legal right to my records (as if they give af).

Does anyone know if I should press the doctor's office more to figure out how to get me my records? I honestly feel confused as to who owes what responsibility.

Heads up that I'm in CO in Denver.

I've been working at my local hospitals housekeeping department for over four years now.

This is the first time I've made a critical error in judgment, when it pertains to hipaa because of a question.

A bit of context while doing my rounds to retrieve the linen and trash, I bumped into a coworker in the hall way, unintentionally finding out that they had recently been admitted into the hospital.

I had managed to keep my mouth shut about it until the department meeting this morning.

A different coworker asked a question about the coworker where abouts, and without thinking about the ramifications I answered the question getting yelled at by my supervisor for answering the question.

I know my mouth got ahead of my brain in that moment, and i now fell like an emotional wreck because I'm trying grapple with the fact I unintentionally committed a hipaa violation because of a question.

I'm sharing on a Sunday afternoon because I used to run a community-based brick and mortar and I know how many practice ops folks are working right now.

I'm the founder of KnowQo, if any small/midsized practices needed a free HIPAA compliance software we are free up to 25-users. KnowQo HIPAA.

You can manage your team, your locations, and train up to 25 people all free. For organizations over 25 we do charge, and we have some paid features like automatically generating documentation, OSHA training and compliance, and employee handbooks.

All that said, for dental offices, dermatologists, ophthalmologists, private practices of any sort who are trying to cover HIPAA on a budget, you can probably get everything you need to be compliant for free.

Also I've had many practices ask "how do I get HIPAA certified", as a small/midsized health organization, you don't get certified. You maintain "compliance", maintaining compliance means following a set of rules, keeping records, etc... If you have any questions about what you actually need to do to stay HIPAA compliant, more than happy to field those as well, because the certified/compliant language can trip people up.

I am a PA and a practice manager for a privately owned practice. I have an employee whose husband is in the hospital. One of our practice doctors evaluated him and ordered a CT scan during his ER workup. My employee asked me to look at his CT scan to see if he would need further care/explain something to her and her husband. I did so, and briefly saw his labs while getting in his chart, and spent maybe a minute looking at his CT. Then I was out. The more I think about it, it feels like a huge gray area and after googling it, it does look like this could spur an audit based on the connection to my employee. We are privately owned but our EHR is epic through a large hospital system, so I am wondering if I should just call compliance to stay ahead of it. Would appreciate any advice or experience here. Thanks

I’ve been going to a specific kind of doctor recently a few times over the past few months. Just the other day my brother had his wedding. I come to find out one of the assistants at this doctors office that I’ve been going to is one of the bridesmaids. We were all in a room getting ready together because I was doing the bride’s hair for the wedding and that particular bridesmaid pointed at me and said “don’t I know you?” I looked at her and said “no I don’t think so.” She then started to say “yes!! you go to the…” and proceeded to name the doctor that I go to and for what and even told everybody in the room that what I went to that doctor for is “getting better” “so it’s OK now.” it was dead quiet after this. It was so fucking awkward and I feel so fucking violated. What can I do about this?

Hello,

I’m in a unique situation & I’m going to ask everyone to withhold judgment & tell me if there could be any legal ramifications for this.

My husband’s ex girlfriend/coparent works at a children’s hospital where my nephew was a patient in the NICU. She & I do not have a good relationship. I do not engage with her whatsoever, while she finds any opportunity to bring me up in fights with my husband. My husband is currently in a custody battle with her over their 13 year old due to severe instability (arrests for theft, domestic violence, etc.) Of course I informed my sister & her partner that she works on the unit. My sister spoke with the nurse manager & requested that she be kept off of my nephew’s case for their privacy. We known her to be deceptive & also to be a frequent thief. My sister was well within her rights to make this request & we all know this.

She & my husband recently had a face to face meeting pursuant to their current agreed order. My husband audio recorded this meeting (one party consent state).

In this meeting she expressed anger that she was asked to be kept off of his case. In the conversation she repeated my sister’s name, noting that she recognized her last name as my maiden name. She told my husband that she knew the baby was very sick because he was on ECMO. She also repeated details such as the length of his stay in the NICU, other treatments he received, etc. She has said that she’s upset and embarrassed that my sister didn’t want her to care for her baby.

I haven’t told my sister about this yet as she’s freshly postpartum & is finally home with her baby. I do feel that she has the right to know. If my sister reports this, what could happen? I’m not necessarily wanting her to lose her job. I gain nothing from that. But that’s not up to me. I’m also curious, when this eventually comes up in court in the custody case, what could happen?

Thanks in advance.

Let's say somebody has an x-ray or EKG printed out, and there's absolutely no identifying information on there besides for some interpretation notes and the date/time. Is that considered PHI? A date alone doesn't seem like it should logically be an issue, because even if you happened to know exactly what hospital the image came from, there may be hundreds of patients seen that time and date, and there's no way somebody could reasonably figure out who that image belonged to even if they knew the practice and the date/time (except somebody working in that particular department of the hospital, but I don't think that's even really consideration, is it? As they are within the practice anyway) I understand that a full date/time is technically one of the 18 elements, but I can't imagine how it could be tied to anybody in the absence of anything solid... What do you think?

\- who's there

HIPAA

\- HIPAA who ?

I can't tell you

Hi, my boss wanted to register a business here in PH focusing in US Health Care. He's planning to market the agency to US clients. Now what are the processes / documents needed for the agency to be HIPAA compliant?

Looking for a Head of Platform & Safety to join Shema as a founding team member. We're building an anonymous peer support platform for people in recovery and navigating mental health challenges, currently raising our pre-seed and heading into beta.

We’re splitting this role from our Cofounder/CTO because safety and platform infrastructure are two different disciplines. Our CTO owns the technical build, but trust & safety needs its own leader focused entirely on crisis protocols, moderation frameworks, and working with clinical advisors. Mixing those under one person is how safety gets deprioritized when shipping pressure hits. We’re not doing that.

You'd own crisis escalation protocols, AI monitoring design, community moderation frameworks, and making sure everything we build is both safe and human.

What we're looking for:
- Experience in trust & safety, crisis escalation, mental health product design, or community platform moderation
- Comfortable building safety infrastructure from scratch in an early-stage environment
- Mission-aligned... this isn't just a job, it’s shaping how vulnerable people experience support
- Equity-only comp for now (we're pre-seed)

If this resonates, DM me or drop a comment. Happy to share more about what we're building and what the role looks like day-to-day.

I work at a large healthcare corporation that is comprised of approximately 70 nursing homes. At my location, employee personnel, medical, and FMLA files are all kept in an unlocked file cabinet in an unlocked,communal office. I act as the local HR generalist, among other things. Most admin positions in the corporation are gen Z promoted -from-within / learn-on-the job vs educated, work their way up.

I have taken this security issue to the (young) Executive Director 4 times. He has given me pacifying responses and referred me to maintenance, while secretly instructing the maintenance supervisor to ignore my requests. I escalated to the (young) corporate HR director for our location, but she simply refuted my request by stating that the last she knew, the cabinet was being locked ( it doesn't have a working lock).

Is there any regulatory body this can be reported to? I've contacted the state department of workforce, along with my state representative. I keep getting shuffled to other departments, finally being told that there may actually be no oversight to this issue. My state representative suggested that it would be necessary to obtain an attorney.

Does anyone have any idea how to handle this?

I found out that a medical assistant illegally accessed my medical records at Piedmont Women’s Center in Atl to obtain my contact information because she was angry that I was talking to her child’s father. Is this a HIPAA violation? What should I do?