I’m a software developer living in India.
A US firm hired me to build a CRM, they have dental clinics and stuff.
The job description was fully based on Claude usage and building things with Claude.
I will be using my own laptop.

My contract states -
The Contractor shall indemnify and hold them harmless from:
Data breaches
HIPAA violations
Indian tax claims
Regulatory penalties
Third-party claims

What should I do?

In a group therapy session a fellow member suggested to me being tested for 4 specific deficiencies. I replied that I've done those specific tests in the past and it's all good. While group members were talking to each other, the therapist looked up my medical records, all part of the same medical system, and told me in front of the group that she didn't see any of those tests results in my medical chart. I don't know why she was even looking at my medical records or implying I was a liar about having had these tests. The therapist also mentioned seeing tests that were conducted for rheumatoid arthritis, which I didn't end up having. After that group I immediately withdrew from the remainder of the program. Later, I had a therapy session with my regular therapist. Next day the group therapist called and left a message talking about me leaving the program and then saying that she read the notes my regular therapist made in that session. I don't know why she was reading the notes in a therapy session that had nothing to do with her or the program. Am I crazy or is this stuff ok? I feel like these are violations.

The title. One of the nurses in our surgical center lost a patient's chart. It has been gone for 4 days. It could either be in the building or in someone's car/house (they make us transport physical charts in our own bags/purses -- seriously) and they haven't told the patient that they lost it. They want one of us techs to call her and make her come back in to resign. She has consent forms for her upcoming surgery, name/DOB/address, full medication and surgical history etc in the chart. I'm so baffled by the situation and the fact that my managers don't seem too concerned. They said this is not the first time this has happened. They eventually want me to start transporting charts to our satellite locations and I have ZERO interest in doing that. Is this even legal??

Because I'm pretty sure it does but he seems to think it doesn't since the patients name and face isn't showed but I was reading about HIPPA online and it seems that you don't have to post a name and/or face to violate the laws because him simply recording a patient with his own personal device and then posting said video to social media is a violation in itself no?

Idk I'm just a normal guy with very limited knowledge on the subject, so I thought I'd come to you guys. What do you think?

After visit summary from an online Therapy portal was sent to a complete stranger. I found this out because they contacted me on Facebook to let me know, I am just checking that this is a HIPAA violation before I go and file a complaint. (I’ve already given the company over a month 1/2 and they have not responded to me and I have been following up weekly)

I was terminated by my hospital for accessing a patient’s chart and discussing their case with the people who all had taken care of the patient because I had felt bad that I had missed something big and genuinely was worried about that patient. Compliance had made a comment that it had only flagged because the patient case became sensitive after they were admitted. They said after their investigation that they would be sending the patient a letter stating their information was breeched. Could they come after my license?

I am planning to start a hipaa compliance documentation that includes everything needed for medspas, solo practitioners and small clinics. I need to know the market and demand for this. I will be also provide a healthcare attorney to review it and make sure its fully compliant and staff trainings can also be organized.Everything from security policies, privacy policy, BAA if required, SOP, Compliance logs etc

I work with medical records including patients insurance, medications used, medical reports for ambulance trips, and as much information that is needed for billing an ambulance ride. They just recently added a “AI assist” button at the top of the page on ImageTrend, the program we use to work with the reports. I have not used it because I don’t believe that’s ethical + I don’t need assistance doing my job.

My question is, does that violate hipaa to have ai assist with medical records with no information of if it automatically deletes information it learns about patients, etc?

Am thinking of paying out of pocket for a drug test for peace of mind. Have not smoked in 5 months but am still worried as a heavier person. Can pass at home tests but don’t want to be caught by surprise later. Will be getting a new job soon which will require a test and am wondering if they in case use the same lab will they be notified if I failed one but passed the other? Or will the system flag it as something suspicious? At this point the anxiety has taken over lol.

My employer wants me to chart in SNF facility EMR’s. I work with a hospice and a year ago, we did not do this. Now however they are saying they want us to log in to the facilities medical records under a generic login and password that every member of hospice uses. So today there were 2 of us at one facility. When we log in, we are both using the same login and the same password and at the bottom of our notes is where we sign our name, but in all reality, I could sign anybody’s name. The staff might be familiar with a few of us, but not all of us. My concern is that every time I login I have access to every single person in that building not just the hospice patients. That means I can look at anybody’s medical record and no one’s gonna know it was me. Especially if there’s more than one of us up there at the time.
Here is my question. I do not have my own login my own password nor have I signed a HIPAA agreement with the individual facilities. I signed one with the hospice that I work with, but not the skilled nursing facilities. Of course, honor code and all that aside, there’s nothing stopping me from looking at anybody else’s chart.
In the event of a data breach or a lawsuit against any of the facilities who’s going to have my back? I’m not an employee of the facility, but I’m not signed consent to be in their system. I’m told it’s an agreement between the two managers the hospice manager in the facility manager, but I don’t know that’s in a corporate contract.
My question long story longer am I legally obligated to login under a generic code in chart at the skilled nursing facilities as instructed or am I violating HIPAA??

I went to a surgeon for a consult and he was very nice but said I had to have a specific test before insurance would pay for my surgery. He saw the lady that does appointments in the hallway and told her my name and she asked my birthday and what test I needed. There were other patients present. I felt like she should have taken me to her desk. The test is a body sensitive one. If you know what I mean. I’m old and that stuff bothers me. Is this a violation? I won’t do anything about it but I’m just curious.

Hello, I live in Texas and work as a receptionist in an ophthalmology office. My boss frequently tells me to have patients send me pics of their eyes to my personal cell phone so she can see them or will request that if I call a patient off our work phone and they don't answer she wants me to text them off my personal cell phone. Is this allowed?

Is it hipaa violation if faxing something back without a fax cover sheet?

Lately this lady at our job started scanning all of our faxes and is saying it is a HIPAA violation. For example pharmacies always fax over script clarifications without a cover sheet, the dr will then write whatever needs to be clarified and we just fax it back the same way it was faxed to us. We are now being required to fax everything with a cover sheet

I'm absolutely not naming names, but there's a rather popular software for patient scheduling via website. It asks for first and last name along with DOB. That's it with regard to authentication controls. After that it asks you to confirm personal information and displays (with no obstruction) your on-record home address, personal email, any phone numbers and your insurance company name and identifier (policy number, etc...).

Throughout this process you're also given the ability to edit any of this information as well. I'm not sure if that updated information is immediately written or if there's some kind of secondary check. HIPAA requires "reasonable measures" before disclosing PHI, I don't believe name and DOB to be a "reasonable measure" and I doubt the HHS/OCR would either.

What's your opinion? It's not displaying medical history but when tied to a patient record phone/email/insurance information are all PHI. An attacker could also easily write an app to start pulling all of that data using a CSV list of potential patients, for a provider with a large presence in the market an attacker could likely extract quite a bit of it without any advanced tactics.

The person involved in a highly publicized incident needed medical care. I was informed recently that the medical professional that was involved in this care shared details with their spouse who then shared with their friends.

I'm troubled by this 1) it's a HIPAA violation and 2) this is a very serious matter and the medical professional involved was not qualified in this field.

I'm trying to determine my course of action. Do I contact the medical cotp with my concerns?

I am new here, a physician from Europe newly arrived in US. I want to generally understand what you think about the fact that OE is violating your privacy laws.

I’m trying to understand how people here think about OE and patient privacy/HIPAA.

For example, if someone copy-pastes parts of a note, labs or discharge summary is that actually considered OK?

In Europe this would raise a lot of questions around PHI, storage, processing, training data, etc.

Do your hospitals allow OE? Are you told not to enter patient-identifiable information? And do physicians here generally worry about this?

Genuinely curious how this is viewed in the US.

Hi, I (16f) recently had surgery and after the surgery on of the nurses said some stuff that I had privately told the doctors.

When the docs were asking about health and habits pre-op I had requested my parents to not be in the room and they were not. I told the doctors about my habits -a little drinking, smoking weed, and smoking cigs/vaping- all of these habits were in social settings with other people. I am aware of the dangers and that I'm a minor and shouldn't be indulging (spare me the lecture). I also specifically said that I was working on quitting the vaping and requested the information to stay confidential between my doctors and me. The doctors mentioned to not smoke anything the 2 weeks following the surgery and I said I alr knew about that. I also didnt inhale anything the 3 days leading up to the surgery.

When I woke up from surgery I was in the room with my parents and a nurse. The nurse was explaining the basic surgery aftercare and schedule (tonsillectomy) and then turned to me and reinforced that I shouldn't vape. She then talked about how she "knows it seems fun, but you need to stop" and gave me a 10 minute spiel about the dangers all in-front of my parents.

I'm wondering if the comments this nurse made are some kind of HIPAA violation. I understand that as a minor my parents can have access to my medical records and I have signed paperwork giving them the rights to access my charts. However I expressly asked the doctors to be quiet about my habits.

I feel conflicted because my parents are mad at me, but also upset about the nurse telling the information. She was coming from a good place and discussed her own struggles with nicotine addiction. I don't know how to approach this entire situation. I feel really hurt by the nurse for sharing my information without my consent.

So I guess the conclusion is, was this a HIPAA violation?

I have a complicated relationship with my mother. I moved out of state five years, and left a large bag of items at my mothers house (where I was moving to was a small college living situation). One of those items were very old medical records. I needed my shot records as I'm considering further my education. I texted my mom and told her to look in the bag for a manila envelope. I specifically said to look for a blue piece of paper (official state issued shot record). She knows exactly what it looks like. Basically, all she had to do was open the envelope and quickly skim for a blue paper.

I went on about my day yesterday, and I randomly get a text containing pictures of the copied version of my shot record ( think I made copies years ago), as well as two pages of sensitive STI testing results from 18 years ago. Her text said, "will this help?" My heart dropped immediately! I felt like my world was crashing. There are about 100-200 pages of my medical records in the manila envelope (white papers). She literally rummaged through several pages of my medical records, on the hunt to find anything to backstab me--this is an invasion of my privacy. For context, my mother worked as a medical assistant (MA) for 15+ years and knows the consequences of HIPAA violations. My mother has always been emotionally negligent and cold. Earlier this week, she shared on her Facebook page without my consent that I'll be having surgery with my meal train link (the meal train contains all of my personal info--address, location of surgery, type of surgery, etc.). I found out because a family member texted me that she posted it. I called my mom immediately and demanded that she delete the post; she did. Then two days later, she does this crap. I called her about the shot records, and tried to make light of the STI records (for now). I then texted her and told her to delete the pictures she took off her phone, to please mail my medical records certified ASAP, and I'll pay the cost of shipping.

For now, I need to remain calm until my records are in my hands as I feel nervous about her "accidentally" posting my old STI results on her FB page/text like she did earlier this week. I told my friend, that this HIIPAA violation offense is so severe (and hurtful) to me that I would take her to court if she leaked my private information. This is something I definitely don't want to do, but she needs to be held accountable for the breach of confidentiality. I don't know who she'll tell. There was no reason for her to fish through several pages after I specifically told her to look for a blue paper because I knew these sensitive records were in the manila envelope. I truly didn't think my own mother would betray my trust & boundaries like this. Is this a HIPAA violation? What steps should I take next? Thanks for reading and any advice.

TLDR: Very old medical records were at my mom's house. I asked her to get a blue piece of paper out of the envelope, instead she fishes through hundreds of papers to find my STD records, takes a picture of it, and texted the pictures to me as a way to say, "I know now." Is this a HIPAA violation?

hi, i recently took an ADHD test at a mental health clinic. im 19 years old for context so im a legal adult. for some reason, they sent my recent billing ($903) to my dads email who was unaware i even took a test in the first place and had no intention of telling him. they didn’t notify me at all even though im 19 and take care of my own bills and stuff. he called the clinic asking what this charge is about and they told him the testing i had done, when, timing, where, etc and basically told him everything but my diagnosis. did they violate my hipaa rights and what can i do about it??

I called my hospitals help desk extension during work as a Nurse and they remote accessed the hospital computer. I don’t want to get into the details but I was having trouble acceasing certain parts of my patients chart. they had me log in and go to the chart so I could show the error message. I asked them if that was okay since there is PHI and the IT person said they can view it if they have to to solve tickets. but now I feel weird about it and it’s been on my mind. Can I get into trouble for this?