31

I recently resigned from my job and gave 2 weeks notice in NY. After the first week I was told to not bother coming in for the second week. Now I am being asked to tell them all my usernames and passwords for websites I used for my job as a medical biller ie, insurance websites, Medicare, eligibility websites and so forth. I setup up all of the access to these sites, I guess you could call me the admin. Do I have to give them this information? We don't have company email accounts. So I had to use my personal email to set them up. I may need to access these sites for my new employer but I am sure they'll sign me up for them.

5
  • 4
    This question needs a lot of clarification (why can't we change the email/login then give them over, what is the specific nature of the request (just the password? why was it not given before?), did the previous employer give the OP a waiver regarding termination/liability/etc, what exactly are they asking for, what types of email addresses were used, etc.). Most answers just say hire a lawyer for hundreds of dollars but this is not actually answering the question: does the OP need to give the login info to the previous employer? We need more info.
    – David
    Commented Mar 16, 2021 at 22:15
  • 1
    @David We rigorously clean up comments that are not being used for the intended purpose. Sometimes valid comments asking for clarification get swept up in that. Usually that's only the case when a post has been up for some time and the OP chose not to provide the requested clarification at which point undeleting the valid comments is also largely moot.
    – Lilienthal
    Commented Mar 19, 2021 at 20:36
  • 2
    @Lilienthal Well, FYI that haphazard enforcement of moderation and censorship creates confusion and distrust. (e.g. this conversation now is an example of the starting point being gone/creating confusion for future readers). Just saying but maybe more careful and correct enforcement of moderation authority might solve those issues.
    – David
    Commented Mar 20, 2021 at 22:29
  • 1
    @David Calling it haphazard is rather a stretch but feel free to raise another discussion about it on meta if you feel so strongly about this as I don't see anything requiring correction. Comments are ephemeral and we treat them as such.
    – Lilienthal
    Commented Mar 21, 2021 at 14:14
  • FYI, Trinia, I posted this on the legal stackexchange here. In one response, there is the opinion that this "this strongly looks like a security-rule violation by the company managing the coding, and tried to shift the burden on the employee." Again, despite the people downvoting my post, I suggest that you get legal advice.
    – BobRodes
    Commented Mar 25, 2021 at 18:14

13 Answers 13

87

Bit confused as to whether these are personal accounts or company ones.

If they are personal accounts in your name, then I would recommend contacting the website owners and asking them what they advise, and if the accounts or records can be transferred to a new account in the companies name.

You don't want to hand over access and be responsible for anything the company does in your account, and you also don't want to be in possession of records belonging to a company you no longer work for.

If the accounts are in the company name, and the only personal thing is your email address and password (which I hope is the situation), then ask the company for an email address. Log into the websites and update the email and password, then tell them to request a new password from the website.

(Following comments. Updating the password may as well be done at the same time as updating the email as an added security precaution. The reason for asking the company to request a new password is to keep everything secure and prevent the OP from sharing a plain-text password back to the company)

3
  • I'm not sure I would contact the website owners and tell them what's going on. If the website found that they had been emailing protected health records to a personal email account, they could be liable for HIPAA sanctions, and if so would probably do what they could to pin that on the OP.
    – BobRodes
    Commented Mar 19, 2021 at 22:16
  • That makes no sense to me, but I'm not a lawyer. The OP setup accounts with their personal email, surely that is the responsibility of the company and the OP, no one else. Next, who said the websites were emailing health records to anyone?
    – flexi
    Commented Mar 20, 2021 at 11:12
  • The point is that the OP may have unwittingly violated HIPAA regulations by using their email to set up accounts that access medical records. By doing so the OP can potentially access those accounts outside of the work context, which might very well be a security violation. And if you're doing medical billing, you are accessing PHI (protected health information) over the internet. My point is that this has a bad smell to it and the company could be in for some serious legal problems. If so, the OP could get caught up in them. Best way to avoid/minimize that is to talk to a lawyer.
    – BobRodes
    Commented Mar 21, 2021 at 18:15
22

They need to keep their business going, and depending on how good their record keeping is, they may not even have a full list of the sites you need access to do your job.

So I would be willing to provide them a list of the websites along with the usernames so that they can work with those sites to transfer the necessary access to their new employee(s).

But under no conditions would I give them my passwords. I would just tell them that according to the security practices necessary for confidential information, passwords are not shared. There is no possible benefit for you to share your passwords, and many ways it could harm you.

I probably would go as far as reaching out to each website directly to close your account or block access, as well as letting them know to expect your company to be in touch to re-establish access as needed.

Create a paper trail showing how you are no longer able or responsible for any access to these sites.

10
  • 17
    Just to elaborate, the issue is that the accounts are in your name so giving them access is essentially giving them the ability to use your identity. Most likely, they won’t try and do anything nefarious but you never know. I would give the names of the sites where you created accounts and what each one is for. They shouldn’t need anything beyond that. Commented Mar 12, 2021 at 20:04
  • 4
    @AffableAmbler - if they are petty enough to say "Dont bother to come in the second week", they are petty enough to do something nefarious.
    – StingyJack
    Commented Mar 13, 2021 at 4:18
  • 2
    OP didn't say the accounts were in their name. They said the accounts were set up using their email account. If I create an account for XYZ Corp but in the email address field put my own email, it is reasonable for XYZ Corp to consider that their account. Especially if I did so while on the clock and used the account to transact the company's claims business.
    – tbrookside
    Commented Mar 15, 2021 at 11:50
  • 5
    If this is really about medical billing, there may be HIPAA issues involved. It's important to ensure that OP will not receive an email six months from now about Mrs. Trumwell's ovarian cancer claim. I would recommend that the OP ensure to relinquish to the company any means of accessing data concerning patients, and get proof that OP no longer has access. Collaborate as needed to get it done without giving your passwords to the company directly, as they might just keep using them indefinitely.
    – Nimloth
    Commented Mar 15, 2021 at 13:15
  • 1
    @stingyjack that's perfectly common when someone gives notice. That time is supposed to be for wrap-up, transitions, handoffs, exit interviews, etc. etc. It's perfectly common for that to take less than a week... then what? This ain't McDonalds... For a dev or project manager, forget it - there's nothing they could do in 1 week lol. Can't use em, why waste their time and yours? Also there's a security issue. Commented Mar 15, 2021 at 23:20
20

Do I have to give them this information? We don't have company email accounts. So I had to use my personal email to set them up.

Offer to set the accounts up for them using whatever email they choose that isn't yours.

You should not have used your personal email for this originally, and you should not do it with your new employer either. When necessary, create a burner account for work instead.

5
  • 8
    Since this involves HIPPA, he should absolutely not turn over any accounts or passwords without speaking to a lawyer first Commented Mar 12, 2021 at 23:16
  • 9
    "Offer to set the accounts up" <-- only if you're still being paid. Commented Mar 13, 2021 at 4:16
  • @R..GitHubSTOPHELPINGICE Providing some gracious assumptions and general US regulations: The OP would be obligated to return any and all company property, information, details, logins, etc. without any form of compensation. It belongs to the company and is their exclusive property. Upon termination, the employee must return all company property otherwise it can be considered theft under the law. There's no longer a compensation relationship there.
    – David
    Commented Mar 16, 2021 at 22:20
  • @David: There is no property involved here. The OP likely did something wrong already in setting up these accounts with their personal email address, but the company failed to make a proper knowledge transfer happen before telling OP not to come back. Commented Mar 17, 2021 at 0:28
  • @R..GitHubSTOPHELPINGICE If it used for the company, used on behalf of the company, used from the company, used/created/distributed/etc. via company resources (in any shape or form) then the company owns it. It is their legal property. Employees have no rights to anything involving their work, company, or any resources involved therein. They certainly cannot extort the company to return stolen property. Basically, good luck convincing a court that the OP did not (or attempt to) commit theft (allegedly) and then extort their former employer (allegedly).
    – David
    Commented Mar 17, 2021 at 21:38
15

After the first week I was told to not bother coming in for the second week.

Based on your initial question, I want to clarify that my answer is based on the assumption that you were not paid in your final week of employment. If you were paid, I don't think it would hurt to come in a couple of hours and show your previous employer how to set up accounts and/or transfer your account "admin" ability to someone else in the office. However, it sounds to me like you were simply told not to come in any longer and then they suddenly realize you had all these accounts and they want you to turn them over and/or show them. I do not think you should be doing this for free, especially if it takes longer than 15 minutes to an hour, you should and ought to be compensated for your time at work.

Personally I wouldn't hand it over unless I'm working on the clock. Once they tell you to leave, then all your responsibilities to the employer is done. Since you're an at-will worker, you never had any obligation to provide anything even while being employed. If they told you not to come in the following week and didn't pay you, I would not hand over the usernames and passwords. Instead I would write back as follow:

Dear Boss,

I was told not to come in the second week of my two weeks notice period. My plan was to create a transition document that provides detail into my daily activities that include usernames and passwords. Since I was told not to come in, and that I would not being paid any further, I will not be providing any further information as I am not needed.

If you wish for me to provide this information, I would like to do this as a contract basis that will be billed per hour at the same base rate as my last day of employment.

Sincerely, Your name.

I also want to stress that you should NOT access these systems ever again. If you access the system after you leave, they could have legal basis. Otherwise, you're good to go. Just ignore anything they say. Your best bet is to write the above as a certified letter and/or email so you have a copy that you were willing to supply the information but since you no longer work there, you have no obligation to hand it over.

I also want to say that once you're employed at your NEW job, you may need permission from your new job to hand over or work in any degree with your old job. The reason being a lot of places have non-compete, ethical concerns of going to a direct competition. So if you are at your new job, you need to make sure you are not in conflict with anything. That is why you should hurry up and write the above and send it right now as in today or tomorrow.

5
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Lilienthal
    Commented Mar 14, 2021 at 21:04
  • 9
    contract rates are substantially better than salary rates. they created this problem, they can fix it at the going market rate.
    – Phil
    Commented Mar 15, 2021 at 2:47
  • 2
    I'm sorry, but I don't think this is a good idea at all. From what I'm reading here, this company is probably in violation of all kinds of HIPAA regulations. If the OP antagonizes them, they may try to find ways to blame them on her. No sense waving a red flag at a bull.
    – BobRodes
    Commented Mar 16, 2021 at 1:55
  • @BobRodes And worse, the OP has made it easy for them by using personal accounts and committing HIPAA violations themselves (based on other comments). Commented Mar 16, 2021 at 11:47
  • 1
    @BrianDrake Yeah, that's my concern. We never told her to user her personal accounts, we have a rigorous risk assessment protocol in place and she violated it in every which way, blah blah blah.
    – BobRodes
    Commented Mar 16, 2021 at 19:26
14

GIVE THEM NOTHING:

While it was unwise to use your own emails and to create your own accounts, they are yours, not the companies.

Let those accounts just sit there unused. Since these are linked to your private email, YOU could be held PERSONALLY LIABLE for any data breeches if those accounts are accessed by your former company. Go find a lawyer, and get a free consult.

Do not do a single thing until you speak to a lawyer. Do not log in and do NOT delete them Deleting the accounts, particularly if it runs any risk of deleting or preventing access to important data, is the sort of thing that, at best, ruins your reputation in the entire industry, and at worst, gets you sued or criminally charged.

I worked for a medical company once and HIPAA is SERIOUS BUSINESS The federal government has limitless resources, and an axe to grind against anyone who plays around with HIPAA regulations with basically an "Eff around and find out" stance towards it.

From the HIPAA journal The four categories used for the penalty structure are as follows:

  • Tier 1: A violation that the covered entity was unaware of and could not have realistically avoided, had a reasonable amount of care had been taken to abide by HIPAA Rules
  • Tier 2: A violation that the covered entity should have been aware of but could not have avoided even with a reasonable amount of care. (but falling short of willful neglect of HIPAA Rules)
  • Tier 3: A violation suffered as a direct result of “willful neglect” of HIPAA Rules, in cases where an attempt has been made to correct the violation
  • Tier 4: A violation of HIPAA Rules constituting willful neglect, where no attempt has been made to correct the violation

You giving away your accounts and passwords might be a violation. IANAL, so you need to....

GET A LAWYER ASAP
You may need to have your lawyer write a letter to your former employer telling them to pound sand, and it will cost money, but you do not want to give even the APPEARANCE of impropriety. The mere fact that these accounts are not through your company may be a violation. You need to protect yourself.

You are no longer an employee, you are no longer paid by them, they are not your concern.

16
  • 3
    Might be worth looking into how to delete the accounts....after talking to a lawyer
    – Donald
    Commented Mar 13, 2021 at 3:27
  • 3
    And without logging into those accounts. Definitely do not access those accounts for any reason, including deleting them.
    – Tom
    Commented Mar 13, 2021 at 14:23
  • 3
    Speaking to a lawyer in this situation would be overkill.
    – Richard
    Commented Mar 14, 2021 at 0:31
  • 6
    Deleting the accounts, particularly if it runs any risk of deleting or preventing access to important data, is a horrendous idea. "So-and-so quit and deleted the company's vital accounts on their way out the door" is the sort of thing that, at best, ruins your reputation in the entire industry, and at worst, gets you sued or criminally charged. Commented Mar 14, 2021 at 2:09
  • 3
    @StephanBranczyk Did you follow the link above? We are talking about 1.5 million dollars per year max liability here. How is a lawyer overkill?
    – Yakk
    Commented Mar 15, 2021 at 16:09
5

There are a lot of ethical and legal questions around this, but let's be practical.

They may determine that while you have access to HIPAA sensitive material, they should do everything in their legal power to revoke your access to this material.

So you may first get a letter of demand in the mail, where they detail steps you will have to take, otherwise they will take you to court.

Soon after you may receive a interim injunction, followed by a summons to go to court.

You have to figure out if this is all worth it.

You should send an email to the 3rd party asking them how to transfer the account across. You should also ask the company to nominate an email address to replace it with. The 3rd party will let you know how to proceed. I'm tipping this is not an amazingly unusual situation.

If you decide to drag this on, you may find the 3rd parties, yourself, and your previous employer in a tangled legal mess. And these 3rd parties may not want to deal with you if you are seen to be obstructive. And you may wonder what your new employer will think if you seem to be trying to hold a gun to your previous employers head.

4

Do i have to relinquish my sign on and passwords for websites pertaining to work (ie: access to insurance companies and medicare)?

You should not have to.

Assuming you signed up to these sites using your company provided email, your company should have full access to this email account and can use it to reset the passwords for any of these sites. You can reply to them with something like:

I signed up for all of these sites using the company provided email. As you have full control of this email, you can request a password reset for any of the accounts that you need access to. Thank you.

If, however, you signed up with a personal email account for these sites, then you will have to work with the individual sites to have this access transferred to an email account controlled by your company. Regardless, do not give out any usernames or passwords under any circumstances. In the future, do not use your personal accounts for anything work related.

9
  • 1
    @DJClayworth The point is that it is that the employer asked the OP not to come in anymore. Presumably they will no longer be paid so why should they continue to do work for the company?
    – sf02
    Commented Mar 12, 2021 at 19:24
  • 2
    The company chose not to honor the OP's two weeks notice, so petty or not why should the OP honor the former company's request?
    – sf02
    Commented Mar 12, 2021 at 19:41
  • 7
    The OP doesn't say they weren't paid for the two weeks, just that they didn't have to come in for the two weeks. That is absolutely normal, and beneficial for the OP. (If they weren't paid then that's illegal, and an entirely different question.) Commented Mar 12, 2021 at 21:51
  • 3
    It’s normal for a company in the US to ask an employee to NOT finish their 2 week notice. NY is an “work at will” state
    – Donald
    Commented Mar 13, 2021 at 3:33
  • 1
    Not only it's normal not to work during your notice period, but they always pay you as well. If they don't pay you within your normal pay cycle (and assuming that you're a W2 worker), you complain to the Department of Labor for your State, and the company has to pay you immediately + has to pay a large fine on top of it (unfortunately, you don't get the large fine, the government gets that part, but you do get the original amount they owed you). The Department of Labor can even preempt bankruptcy proceedings, assuming you filed your official complaint before the company files for bankruptcy. Commented Mar 15, 2021 at 6:04
4

When you leave a company you are expected to do several things:

  • Return your badges.
  • Return the company laptop/phone or other company equipment.
  • Return keys, parking garage pass...
  • Return the company credit card, and resolve any outstanding charges.

Once all these things are done, and you submit your final time card, they will pay you your final check, which may also include outstanding balances for PTO. If you don't do these things they can delay the final check or hold back funds.

You know that if they control the account, they will terminate your ability to login. In some cases they can't terminate it, but they will limit your access. This can be related to health insurance and the payroll site because there can still be tax forms you need access to.

But if they can't turn off access to a third party site, they will expect you to cooperate with their efforts to terminate the access if the reason why the account exists is to do your job for them.

3
  • The OP actually has access to the admin account for the organisation. It's not a mere user account. Which makes your point even more clear I think. Commented Mar 15, 2021 at 2:01
  • "If you don't do these things they can delay the final check or hold back funds" — This is certainly not the case everywhere, and an employer in some US states who withheld a final paycheck under these circumstances could be looking at substantial penalties. Commented Mar 15, 2021 at 18:20
  • @ZachLipton If there is evidence that the employee stole company property (either intentionally or by accident) they may be able to withhold the final check but this is not the question asked, at any rate.
    – David
    Commented Mar 16, 2021 at 22:29
3

There are several good answers already about if you should do this or not with or without being paid.

My answer comes from more of a security perspective and assuming that you'd rather spend some time to get them off your back and move on with your life. There is no way I'd let a former employer know any of my credentials particularly if there was bad blood.

What I propose would take some time. If you have been paid for the final week, consider it as your final task to be completed at home. If you are not being paid, then you need to consider if it's worth the hassle.

Step 1

Set up a free email account with credentials you are willing to share, and importantly a password that is no relation to anything you use personally. You are potentially going to hand this account over to your former employer.

Step 2

Transfer the accounts to this email address. (This is the long tedious part)

Step 3

You have 2 options

Option 1

Reset the password on those accounts, to something not what you use personally, that you with your former employer

Option 2

Pass the details for your new email, purpose-built account over to your former employer, telling them to change the password for their protection. Then get them to use this account to go through the password reset procedure for each account.

Side note

Your former employers have created this mess themselves on several levels.

  1. Not having company email addresses which they gain ownership on your departure.
  2. Not having a company email address for this purpose (though this is pretty common)
  3. Telling you not to come in while there was still work to be done.
2
  • -1 This post does not answer the actual question “Do I have to …” There are other issues, which have been dealt with in other comments: (1) The new e-mail account could create its own security issues; you should seek advice from the company (although you probably already know they tolerate certain e-mail providers). (2) You should reset the password before handing over the account, in case the account provider stores the password. (3) You should hand over the new e-mail account in any case. It is not an “option”. Retaining any of these accounts just makes the problem worse. Commented Mar 15, 2021 at 12:19
  • 1
    +1 Post gives legitimate action steps to solve the problem without going on tangents regarding lawyers, demanding payment for returning what would be stolen property AKA running a little extortion racket, and addressed some of the ambiguous nature in the question.
    – David
    Commented Mar 16, 2021 at 22:26
2

Here's a rule of thumb. If your replacement will need the accounts to do the job, then you need to hand them over.

That said, you also do not need to allow them to do business under accounts in your name. So your name should be removed from any accounts, and that should be that.

Generally the model of security is "one person, one password". Shared passwords are very weak security. Most business-business providers, and absolutely anybody handling HIPAA data, understands this. But every site will have a different way to set this up: you'll just have to learn it! You are being paid for this last week, right? This is the job.

It really depends how the web provider set things up.

I've had to clean up an account mess in the past.

Start by creating a new "throwaway" email address e.g. Gmail. Most or all of your accounts will need to have an email address tied to them; in each account, change the email address to this one. Hand over this email address and its credentials also. Among other things, this will allow them to do a password reset of the accounts. Make sure not to use 2-factor authentication or anything else that would impede their ability to administer it. They can turn that on after you hand it over.

Single-password-for-account sites

On these sites, go into the personal information configuration and remove your personal information, name, etc. Change the email address to the one you just created. Change the password to one you feel comfortable giving out.

"Master account" and sub-account sites

Other services have a "master account". This account is then able to create "sub-accounts" for employees, and grant various privileges to them.

In this type of site, you should set up a sub-account for remaining employee(s) - at the least a responsible manager who would assign other sub-accounts to other users, who should be given admin rights.

On the master account, change its email address to the new email you just created. Change its password to one you are willing to give them.

Personal-account-only providers

A few providers recognize the corporate institution as an entity, but, assign ONLY personal accounts to be kept by the same human forever and taken from job to job. Individual accounts are linked to/associated with a business. In this case, you keep your account. Someone else at the organization will have to create an account for that service; then you can link them to be a representative of the business, and give them admin privileges. Then, you unlink yourself (or ask them to do it).

The classic example of a site that does this is Facebook. You can create a Group or a Page, and then make someone else admin, and then quit the page itself.

Use your admin status to set up other users, then have them remove you.

Anyway, you package all this up for each of the accounts, on paper, and then do a handover of the documents. I will handover the document electronically, but I do the passwords on a separate sheet of paper (paper only).

2
  • 1
    Before getting the ball rolling and doing things, probably reaching out to these third parties and ask for advice is the best way forward. They don't want to lose a customer that may take this opportunity of non-access to pivot to some other provider. Even logging into the site and potentially accessing private information of employees after you should no longer have legal access could put you in hot water. Commented Mar 16, 2021 at 10:56
  • I upvoted because this is a good answer that is significantly different from the existing answers, but I dislike the Gmail reference. This is not the place to recommend an e-mail provider; indeed, as I keep saying, the company should recommend one, or even better, provide an e-mail account for this purpose. Commented Mar 16, 2021 at 11:44
2

There is just not enough information about your particular case.

If passwords are your personal passwords, then you shouldn't hand them over. There may be reasons why you might have to change the password to one given to you by the company though.

But what are these passwords there for? For example, I have an admin account for my company on some major website. A colleague also has an admin account and I know they have used it. There is no need for my company to have my account password. They should just delete my account, the other admin can do this.

If I was the only admin, then I should create an admin account for someone else, make them check their account works, and we are back to the first case. If I refused to do either that or to give them my password, that might be damaging to the company and they might sue me. My laptop, I could and should change the password to "mycompanypassword" and write that on a sticker on the laptop, because the company owns all the information on my laptop. Or they decide to just wipe it.

How did I leave? If I left without giving notice then I could be in trouble if me leaving without notice causes damages. If I am fired without notice, that's their choice. (I read about some guy getting fired together with his manager as reward for a job well done, three months later he got a frantic phone call why the company was paying huge amounts every month for some service, and he just said "because I ordered that service for 14 days, and you fired me and walked me out of the door before I could cancel it").

Notice period is there for handling these things. For example, changing passwords to passwords provided by the company. If this doesn't happen and it's your fault, then you should fix it. If it's the company's fault, then you should fix it, but not for free. And if you personally subscribed to a service to be used by the company, you should hand that over during your notice period.

In your case, I suspect that it would have been part of your job to make that information available during your notice period. When you say "Now I'm being asked" - is "Now" still within your notice period? If it's still within your notice period, you need to do it. If it's not, just your company being stupid, you should do it, but not free of charge.

1
  • This is a very good answer, with respect to how to hand off stuff when leaving. However, I still feel that this company is probably violating HIPAA regulations, and the OP could get caught up in it. I wouldn't hand over passwords, either, nor would I change the password on an account that I had set up with my personal email and give them that. Nevertheless, there doesn't seem to be any harm in creating a new admin account and deleting the OP's, given a company email to set it up with. Sending PMI to a personal email is probably a HIPAA violation, and I wouldn't help the company do that .
    – BobRodes
    Commented Mar 21, 2021 at 18:59
0

Give them a list of websites, and for each, the logon information used. For those you created using personal information and emails, say so, and don't give the personal information used.

Then, at the top or bottom, note that those websites and logins which are business not personal, and were created using personal credentials/email, will be modified to transfer control to another work email address and password, if one is provided. This should not carry any compliance risk, its routine, and will only apply to the accounts that the business has the right to see anyway (if not why are you including it on your list of accounts able to be transfered, you'd then have a different problem)

Also check if any of these need formal notification of any kind, such as notification of change of contact or change of controller, and do that anyway as you don't control them any more.

The rest of the issues such as legal compliance/HIPAA mentioned in some answers, are either your soon-to-be ex employers problem, or should have hopefully been handled properly while they were used and under your control. Either way again, its either not your problem, or its always been your problem and this doesn't change it.

1
  • -1 Finally, an answer that acknowledges that legal compliance is out of the scope of this question! But, sadly, this does not actually answer the question (emphasis added): “Do I have to relinquish my sign on and passwords …?” Commented Mar 18, 2021 at 12:11
-3

I would not interact with your company at all, let alone do as your company asks, without getting some advice, preferably from a lawyer, preferably one who specializes in HIPAA violations.

A company that handles medical records and doesn't have company email accounts, leaving individuals to open accounts into HIPAA-protected databases in their own way, is just screaming HIPAA violations.

It is, for example, a HIPAA violation to email electronic protected health information, or PHI, to personal email accounts. This can result in a fine for each occurrence.

I suggest you have a look at this and ask yourself whether any of the violations they list have occurred. If so, then you might want to talk to that lawyer. Not mentioning violations that you know have occurred can itself be a violation, so I wouldn't just let it go. What's more, they could try to blame you if they get audited, say they never told you to use your personal accounts and you did that all on your own.

10
  • @BrianDrake I thought it did, with the advice to get some legal advice. Perhaps I didn't state strongly enough that she ought to get legal advice before any further interactions with the company, so I clarified that. Thanks for the heads up.
    – BobRodes
    Commented Mar 16, 2021 at 19:31
  • The question seems clear enough: “Do I have to relinquish my sign on and passwords …?” Statements about HIPAA violations and lawyers, while useful, do not seem to answer this question. The new text at the start of the post, “I would not do as your company asks without getting some advice …”, sort of answers the question, but this is not clear either. Commented Mar 18, 2021 at 11:58
  • @BrianDrake I see. Well, sometimes answering a somewhat different question to the one posed would seem to be the best course of action. For example, to the question "I got a call from the IRS, saying that I had to pay $900 or risk arrest. They say I can either use a Walmart gift card or an Amazon gift card. Which card should I use?" My answer would be that this is a scam, that the caller isn't really from the IRS but from someone who is trying to steal money from you, and to do neither. ...
    – BobRodes
    Commented Mar 19, 2021 at 22:07
  • ... in this case, you wouldn't be helping the user to answer the question posed, rather you'd be helping the scammers. Here, the OP is risking compounding legal troubles by interacting further with the company in any way. So it seems the best answer is to say not to interact with the company at all, and to do some research and get legal advice on HIPAA violations.
    – BobRodes
    Commented Mar 19, 2021 at 22:08
  • @BobRodes That's a fallacy. You're comparing different contexts. Getting lawyers involved is never going to end well for anyone (Fact: Lawyers are always evil and bad for society). I agree with the other commenter regarding that legal tangents and nonsense spouted by random internet people without legal credentials, facts of the case, and actual representation is not only unhelpful but detrimental to solving the problem: giving the company their property back and moving on with life. People who lawyer up end up digging their own grave.
    – David
    Commented Mar 20, 2021 at 22:20

Not the answer you're looking for? Browse other questions tagged .