HIPAA in Daily Work
The rules that apply to you, right now, in your actual job.
Overview
Most HIPAA violations are not caused by malicious actors. They are caused by staff who did not understand the rules, underestimated the risk, or made a habit of shortcuts that seemed harmless. Answer the five questions below with specific, practical reasoning. Generalisations will not score well.
Read before you answer
Most HIPAA violations in practice are not caused by sophisticated cyberattacks — they are caused by workforce members who did not understand the rules, underestimated the consequences of routine shortcuts, or assumed that no harm was done because information was not deliberately shared. The day-to-day application of HIPAA in healthcare and administrative settings requires ongoing attention to how, where, and with whom information is handled — in conversations, in physical documents, on screens, and in electronic communications.
Common workplace HIPAA violations include: discussing a patient's condition or treatment in a hallway, elevator, or other public area where the conversation can be overheard by people with no need to know; leaving patient records or documents visible on desks, on printer trays, or on unlocked computer screens; sending PHI via unencrypted personal email or text message rather than through authorised communication channels; disposing of documents containing PHI in regular recycling bins rather than shredding (or placing them in secure shredding containers); accessing the records of a friend, family member, colleague, or celebrity patient out of curiosity rather than clinical or operational need; and failing to log out of EHR systems when leaving a workstation unattended. Each of these is a HIPAA violation regardless of whether any further harm results.
Disclosures without patient authorisation are permitted for three main purposes — treatment, payment, and healthcare operations (collectively "TPO") — and the minimum necessary standard applies to payment and operations disclosures but not to treatment disclosures between providers. Social media warrants particular care: even seemingly vague descriptions of a patient or their situation can constitute a HIPAA violation if a reasonable person could identify the individual from the context. When a workforce member witnesses a suspected violation, they are expected to report it — to their supervisor, the Privacy Officer, or through a designated reporting mechanism. Workforce members who report in good faith are protected from retaliation, and covered entities are required to document and investigate reported concerns, apply the sanctions policy to confirmed violations, and maintain records of the outcome.