Return to Answer

I would not interact with your company at all, let alone do as your company asks, without getting some advice, preferably from a lawyer, preferably one who specializes in HIPAA violations.

A company that handles medical records and doesn't have company email accounts, leaving individuals to open accounts into HIPAA-protected databases in their own way, is just screaming HIPAA violations.

It is, for example, a HIPAA violation to email electronic protected health information, or ePHI, to personal email accounts. This can result in a fine for each occurrence.

I suggest you have a look at this and ask yourself whether any of the violations they list have occurred. If so, then you might want to talk to that lawyer. Not mentioning violations that you know have occurred can itself be a violation, so I wouldn't just let it go. What's more, they could try to blame you if they get audited, say they never told you to use your personal accounts and you did that all on your own.

I would not interact with your company at all, let alone do as your company asks, without getting some advice, preferably from a lawyer, preferably one who specializes in HIPAA violations.

A company that handles medical records and doesn't have company email accounts, leaving individuals to open accounts into HIPAA-protected databases in their own way, is just screaming HIPAA violations.

It is, for example, a HIPAA violation to email electronic protected health information, or PHI, to personal email accounts. This can result in a fine for each occurrence.

I suggest you have a look at this and ask yourself whether any of the violations they list have occurred. If so, then you might want to talk to that lawyer. Not mentioning violations that you know have occurred can itself be a violation, so I wouldn't just let it go. What's more, they could try to blame you if they get audited, say they never told you to use your personal accounts and you did that all on your own.

I would not do as your company asks without getting some advice, preferably from a lawyer, preferably one who specializes in HIPAA violations.

A company that handles medical records and doesn't have company email accounts, leaving individuals to open accounts into HIPAA-protected databases in their own way, is just screaming HIPAA violations.

It is, for example, a HIPAA violation to email electronic protected health information, or ePHI, to personal email accounts. This can result in a fine for each occurrence.

I suggest you have a look at this and ask yourself whether any of the violations they list have occurred. If so, then you might want to talk to that lawyer. Not mentioning violations that you know have occurred can itself be a violation, so I wouldn't just let it go. What's more, they could try to blame you if they get audited, say they never told you to use your personal accounts and you did that all on your own.

I would not interact with your company at all, let alone do as your company asks, without getting some advice, preferably from a lawyer, preferably one who specializes in HIPAA violations.

A company that handles medical records and doesn't have company email accounts, leaving individuals to open accounts into HIPAA-protected databases in their own way, is just screaming HIPAA violations.

It is, for example, a HIPAA violation to email electronic protected health information, or ePHI, to personal email accounts. This can result in a fine for each occurrence.

I suggest you have a look at this and ask yourself whether any of the violations they list have occurred. If so, then you might want to talk to that lawyer. Not mentioning violations that you know have occurred can itself be a violation, so I wouldn't just let it go. What's more, they could try to blame you if they get audited, say they never told you to use your personal accounts and you did that all on your own.

A company that handles medical records and doesn't have company email accounts, leaving individuals to open accounts into HIPAA-protected databases in their own way, is just screaming HIPAA violations.

It is, for example, a HIPAA violation to email electronic protected health information, or ePHI, to personal email accounts. This can result in a fine for each occurrence.

I suggest you have a look at this and ask yourself whether any of the violations they list have occurred. If so, perhaps your next step is to talk to a lawyer who specializes in HIPAA violations. Not mentioning violations that you know have occurred can itself be a violation, so I wouldn't just let it go.

I would not do as your company asks without getting some advice, preferably from a lawyer, preferably one who specializes in HIPAA violations.

A company that handles medical records and doesn't have company email accounts, leaving individuals to open accounts into HIPAA-protected databases in their own way, is just screaming HIPAA violations.

It is, for example, a HIPAA violation to email electronic protected health information, or ePHI, to personal email accounts. This can result in a fine for each occurrence.

I suggest you have a look at this and ask yourself whether any of the violations they list have occurred. If so, then you might want to talk to that lawyer. Not mentioning violations that you know have occurred can itself be a violation, so I wouldn't just let it go. What's more, they could try to blame you if they get audited, say they never told you to use your personal accounts and you did that all on your own.