Do I have to relinquish my sign on and passwords for websites pertaining to work (ie: access to insurance companies and medicare)? [closed]

Question

I recently resigned from my job and gave 2 weeks notice in NY. After the first week I was told to not bother coming in for the second week. Now I am being asked to tell them all my usernames and passwords for websites I used for my job as a medical biller ie, insurance websites, Medicare, eligibility websites and so forth. I setup up all of the access to these sites, I guess you could call me the admin. Do I have to give them this information? We don't have company email accounts. So I had to use my personal email to set them up. I may need to access these sites for my new employer but I am sure they'll sign me up for them.

Answer 1

Bit confused as to whether these are personal accounts or company ones.

If they are personal accounts in your name, then I would recommend contacting the website owners and asking them what they advise, and if the accounts or records can be transferred to a new account in the companies name.

You don't want to hand over access and be responsible for anything the company does in your account, and you also don't want to be in possession of records belonging to a company you no longer work for.

If the accounts are in the company name, and the only personal thing is your email address and password (which I hope is the situation), then ask the company for an email address. Log into the websites and update the email and password, then tell them to request a new password from the website.

(Following comments. Updating the password may as well be done at the same time as updating the email as an added security precaution. The reason for asking the company to request a new password is to keep everything secure and prevent the OP from sharing a plain-text password back to the company)

Answer 2

They need to keep their business going, and depending on how good their record keeping is, they may not even have a full list of the sites you need access to do your job.

So I would be willing to provide them a list of the websites along with the usernames so that they can work with those sites to transfer the necessary access to their new employee(s).

But under no conditions would I give them my passwords. I would just tell them that according to the security practices necessary for confidential information, passwords are not shared. There is no possible benefit for you to share your passwords, and many ways it could harm you.

I probably would go as far as reaching out to each website directly to close your account or block access, as well as letting them know to expect your company to be in touch to re-establish access as needed.

Create a paper trail showing how you are no longer able or responsible for any access to these sites.

Answer 3

Do I have to give them this information? We don't have company email accounts. So I had to use my personal email to set them up.

Offer to set the accounts up for them using whatever email they choose that isn't yours.

You should not have used your personal email for this originally, and you should not do it with your new employer either. When necessary, create a burner account for work instead.

Answer 4

After the first week I was told to not bother coming in for the second week.

Based on your initial question, I want to clarify that my answer is based on the assumption that you were not paid in your final week of employment. If you were paid, I don't think it would hurt to come in a couple of hours and show your previous employer how to set up accounts and/or transfer your account "admin" ability to someone else in the office. However, it sounds to me like you were simply told not to come in any longer and then they suddenly realize you had all these accounts and they want you to turn them over and/or show them. I do not think you should be doing this for free, especially if it takes longer than 15 minutes to an hour, you should and ought to be compensated for your time at work.

Personally I wouldn't hand it over unless I'm working on the clock. Once they tell you to leave, then all your responsibilities to the employer is done. Since you're an at-will worker, you never had any obligation to provide anything even while being employed. If they told you not to come in the following week and didn't pay you, I would not hand over the usernames and passwords. Instead I would write back as follow:

Dear Boss,

I was told not to come in the second week of my two weeks notice period. My plan was to create a transition document that provides detail into my daily activities that include usernames and passwords. Since I was told not to come in, and that I would not being paid any further, I will not be providing any further information as I am not needed.

If you wish for me to provide this information, I would like to do this as a contract basis that will be billed per hour at the same base rate as my last day of employment.

Sincerely, Your name.

I also want to stress that you should NOT access these systems ever again. If you access the system after you leave, they could have legal basis. Otherwise, you're good to go. Just ignore anything they say. Your best bet is to write the above as a certified letter and/or email so you have a copy that you were willing to supply the information but since you no longer work there, you have no obligation to hand it over.

I also want to say that once you're employed at your NEW job, you may need permission from your new job to hand over or work in any degree with your old job. The reason being a lot of places have non-compete, ethical concerns of going to a direct competition. So if you are at your new job, you need to make sure you are not in conflict with anything. That is why you should hurry up and write the above and send it right now as in today or tomorrow.

Answer 5

GIVE THEM NOTHING:

While it was unwise to use your own emails and to create your own accounts, they are yours, not the companies.

Let those accounts just sit there unused. Since these are linked to your private email, YOU could be held PERSONALLY LIABLE for any data breeches if those accounts are accessed by your former company. Go find a lawyer, and get a free consult.

Do not do a single thing until you speak to a lawyer. Do not log in and do NOT delete them Deleting the accounts, particularly if it runs any risk of deleting or preventing access to important data, is the sort of thing that, at best, ruins your reputation in the entire industry, and at worst, gets you sued or criminally charged.

I worked for a medical company once and HIPAA is SERIOUS BUSINESS The federal government has limitless resources, and an axe to grind against anyone who plays around with HIPAA regulations with basically an "Eff around and find out" stance towards it.

From the HIPAA journal The four categories used for the penalty structure are as follows:

• Tier 1: A violation that the covered entity was unaware of and could not have realistically avoided, had a reasonable amount of care had been taken to abide by HIPAA Rules
• Tier 2: A violation that the covered entity should have been aware of but could not have avoided even with a reasonable amount of care. (but falling short of willful neglect of HIPAA Rules)
• Tier 3: A violation suffered as a direct result of “willful neglect” of HIPAA Rules, in cases where an attempt has been made to correct the violation
• Tier 4: A violation of HIPAA Rules constituting willful neglect, where no attempt has been made to correct the violation

You giving away your accounts and passwords might be a violation. IANAL, so you need to....

GET A LAWYER ASAP
You may need to have your lawyer write a letter to your former employer telling them to pound sand, and it will cost money, but you do not want to give even the APPEARANCE of impropriety. The mere fact that these accounts are not through your company may be a violation. You need to protect yourself.

You are no longer an employee, you are no longer paid by them, they are not your concern.

Answer 6

There are a lot of ethical and legal questions around this, but let's be practical.

They may determine that while you have access to HIPAA sensitive material, they should do everything in their legal power to revoke your access to this material.

So you may first get a letter of demand in the mail, where they detail steps you will have to take, otherwise they will take you to court.

Soon after you may receive a interim injunction, followed by a summons to go to court.

You have to figure out if this is all worth it.

You should send an email to the 3rd party asking them how to transfer the account across. You should also ask the company to nominate an email address to replace it with. The 3rd party will let you know how to proceed. I'm tipping this is not an amazingly unusual situation.

If you decide to drag this on, you may find the 3rd parties, yourself, and your previous employer in a tangled legal mess. And these 3rd parties may not want to deal with you if you are seen to be obstructive. And you may wonder what your new employer will think if you seem to be trying to hold a gun to your previous employers head.

Answer 7

Do i have to relinquish my sign on and passwords for websites pertaining to work (ie: access to insurance companies and medicare)?

You should not have to.

Assuming you signed up to these sites using your company provided email, your company should have full access to this email account and can use it to reset the passwords for any of these sites. You can reply to them with something like:

I signed up for all of these sites using the company provided email. As you have full control of this email, you can request a password reset for any of the accounts that you need access to. Thank you.

If, however, you signed up with a personal email account for these sites, then you will have to work with the individual sites to have this access transferred to an email account controlled by your company. Regardless, do not give out any usernames or passwords under any circumstances. In the future, do not use your personal accounts for anything work related.

Answer 8

When you leave a company you are expected to do several things:

• Return your badges.
• Return the company laptop/phone or other company equipment.
• Return keys, parking garage pass...
• Return the company credit card, and resolve any outstanding charges.

Once all these things are done, and you submit your final time card, they will pay you your final check, which may also include outstanding balances for PTO. If you don't do these things they can delay the final check or hold back funds.

You know that if they control the account, they will terminate your ability to login. In some cases they can't terminate it, but they will limit your access. This can be related to health insurance and the payroll site because there can still be tax forms you need access to.

But if they can't turn off access to a third party site, they will expect you to cooperate with their efforts to terminate the access if the reason why the account exists is to do your job for them.

Answer 9

There are several good answers already about if you should do this or not with or without being paid.

My answer comes from more of a security perspective and assuming that you'd rather spend some time to get them off your back and move on with your life. There is no way I'd let a former employer know any of my credentials particularly if there was bad blood.

What I propose would take some time. If you have been paid for the final week, consider it as your final task to be completed at home. If you are not being paid, then you need to consider if it's worth the hassle.

Step 1

Set up a free email account with credentials you are willing to share, and importantly a password that is no relation to anything you use personally. You are potentially going to hand this account over to your former employer.

Step 2

Transfer the accounts to this email address. (This is the long tedious part)

Step 3

You have 2 options

Option 1

Reset the password on those accounts, to something not what you use personally, that you with your former employer

Option 2

Pass the details for your new email, purpose-built account over to your former employer, telling them to change the password for their protection. Then get them to use this account to go through the password reset procedure for each account.

Side note

Your former employers have created this mess themselves on several levels.

1. Not having company email addresses which they gain ownership on your departure.
2. Not having a company email address for this purpose (though this is pretty common)
3. Telling you not to come in while there was still work to be done.

Answer 10

Here's a rule of thumb. If your replacement will need the accounts to do the job, then you need to hand them over.

That said, you also do not need to allow them to do business under accounts in your name. So your name should be removed from any accounts, and that should be that.

Generally the model of security is "one person, one password". Shared passwords are very weak security. Most business-business providers, and absolutely anybody handling HIPAA data, understands this. But every site will have a different way to set this up: you'll just have to learn it! You are being paid for this last week, right? This is the job.

It really depends how the web provider set things up.

I've had to clean up an account mess in the past.

Start by creating a new "throwaway" email address e.g. Gmail. Most or all of your accounts will need to have an email address tied to them; in each account, change the email address to this one. Hand over this email address and its credentials also. Among other things, this will allow them to do a password reset of the accounts. Make sure not to use 2-factor authentication or anything else that would impede their ability to administer it. They can turn that on after you hand it over.

Single-password-for-account sites

On these sites, go into the personal information configuration and remove your personal information, name, etc. Change the email address to the one you just created. Change the password to one you feel comfortable giving out.

"Master account" and sub-account sites

Other services have a "master account". This account is then able to create "sub-accounts" for employees, and grant various privileges to them.

In this type of site, you should set up a sub-account for remaining employee(s) - at the least a responsible manager who would assign other sub-accounts to other users, who should be given admin rights.

On the master account, change its email address to the new email you just created. Change its password to one you are willing to give them.

Personal-account-only providers

A few providers recognize the corporate institution as an entity, but, assign ONLY personal accounts to be kept by the same human forever and taken from job to job. Individual accounts are linked to/associated with a business. In this case, you keep your account. Someone else at the organization will have to create an account for that service; then you can link them to be a representative of the business, and give them admin privileges. Then, you unlink yourself (or ask them to do it).

The classic example of a site that does this is Facebook. You can create a Group or a Page, and then make someone else admin, and then quit the page itself.

Use your admin status to set up other users, then have them remove you.

Anyway, you package all this up for each of the accounts, on paper, and then do a handover of the documents. I will handover the document electronically, but I do the passwords on a separate sheet of paper (paper only).

Answer 11

There is just not enough information about your particular case.

If passwords are your personal passwords, then you shouldn't hand them over. There may be reasons why you might have to change the password to one given to you by the company though.

But what are these passwords there for? For example, I have an admin account for my company on some major website. A colleague also has an admin account and I know they have used it. There is no need for my company to have my account password. They should just delete my account, the other admin can do this.

If I was the only admin, then I should create an admin account for someone else, make them check their account works, and we are back to the first case. If I refused to do either that or to give them my password, that might be damaging to the company and they might sue me. My laptop, I could and should change the password to "mycompanypassword" and write that on a sticker on the laptop, because the company owns all the information on my laptop. Or they decide to just wipe it.

How did I leave? If I left without giving notice then I could be in trouble if me leaving without notice causes damages. If I am fired without notice, that's their choice. (I read about some guy getting fired together with his manager as reward for a job well done, three months later he got a frantic phone call why the company was paying huge amounts every month for some service, and he just said "because I ordered that service for 14 days, and you fired me and walked me out of the door before I could cancel it").

Notice period is there for handling these things. For example, changing passwords to passwords provided by the company. If this doesn't happen and it's your fault, then you should fix it. If it's the company's fault, then you should fix it, but not for free. And if you personally subscribed to a service to be used by the company, you should hand that over during your notice period.

In your case, I suspect that it would have been part of your job to make that information available during your notice period. When you say "Now I'm being asked" - is "Now" still within your notice period? If it's still within your notice period, you need to do it. If it's not, just your company being stupid, you should do it, but not free of charge.

Answer 12

Give them a list of websites, and for each, the logon information used. For those you created using personal information and emails, say so, and don't give the personal information used.

Then, at the top or bottom, note that those websites and logins which are business not personal, and were created using personal credentials/email, will be modified to transfer control to another work email address and password, if one is provided. This should not carry any compliance risk, its routine, and will only apply to the accounts that the business has the right to see anyway (if not why are you including it on your list of accounts able to be transfered, you'd then have a different problem)

Also check if any of these need formal notification of any kind, such as notification of change of contact or change of controller, and do that anyway as you don't control them any more.

The rest of the issues such as legal compliance/HIPAA mentioned in some answers, are either your soon-to-be ex employers problem, or should have hopefully been handled properly while they were used and under your control. Either way again, its either not your problem, or its always been your problem and this doesn't change it.

Answer 13

I would not interact with your company at all, let alone do as your company asks, without getting some advice, preferably from a lawyer, preferably one who specializes in HIPAA violations.

A company that handles medical records and doesn't have company email accounts, leaving individuals to open accounts into HIPAA-protected databases in their own way, is just screaming HIPAA violations.

It is, for example, a HIPAA violation to email electronic protected health information, or PHI, to personal email accounts. This can result in a fine for each occurrence.

I suggest you have a look at this and ask yourself whether any of the violations they list have occurred. If so, then you might want to talk to that lawyer. Not mentioning violations that you know have occurred can itself be a violation, so I wouldn't just let it go. What's more, they could try to blame you if they get audited, say they never told you to use your personal accounts and you did that all on your own.