Can HR/Boss Require Your Username and Password?

Question

We recently received this email at our work from the HR Department. We work in the healthcare industry and our username and password is linked to everything that we do. We have to follow strict HIPAA guidelines.

Would providing our username and password not be a breach of our privacy? And how do we know that our information will be kept in private and used correctly? Our information could be used to make it look like we did things that we never did.

"I need everyone to email me your username and your password for your Windows log in. These passwords will be kept in a locked file cabinet and not be shared with anyone other than the CEO or COO. Thanks for your prompt response. Have a super Monday afternoon!"

Answer 1

The request is ridiculous on every level.

First how will the manager/HR lock your email in a cabinet? You don't ever ever ever send a sensitive username/password over email. There is a small chance that this could be part of a phishing attack. At best now your boss/HR's computer/laptop is a single point of failure for security at the whole office.

Second how will this manager/HR ensure that no one else would ever have access to this or potentially login as you?

Third, there are many ways with Windows administration that I can override a user's domain account and login to their profile using proper procedures.

To me there are only two reasons why managment would ask for this:

• They are so improperly trained and completely inept at technology and security procedures that they feel that this is the "only way" it can be done. This says a lot about your company. Either you have upper management that is literally clueless on how to run an organization that handles sensitive data or they have literally no belief in your IT/tech staff.

• It could also be that the IT/tech staff has prevented them to do certain things and having your login allows them to bypass these security measures. Some really well designed applications would not allow for an auto-login if I logged into your profile using domain authentication. So we would need to either have the user's login/pass or reset the user. Either way I cannot feasibly see why upper management would need to login as you to do something without your knowledge.

• (Adding this based on a lost author comment) - I wouldn't normally go this far but the author added that she believes their outsourced IT/security department knows about the email and is OK with it. This is a sure sign that either they are very very unfit at their jobs (needing it for a real backup) and if they are that bad there is no way they are adhering to HIPAA standards. Or then most obviously, they are in cahoots with management - using the logins to do "nefarious" practices.

How would I handle this?

I would ask my manager why they need your details. Express your concerns about the privacy (and the HIPAA regulations).

If your manager presses you on this I would then contact HR - they sent the email but start with your manager. Good chance it might not be authorized (or once they see the security issue they will say it wasn't authorized). This is where it gets rough. Because the only group that is usually less technical than managers, is HR (speaking broadly here).

You will need to express your concerns to HR. I would make sure that HR is working with someone in your IT/tech department to make sure this meets security practices at the company. If HR refuses to work with IT/Tech departments you may need to contact someone directly in those departments. If you have a security section I would start with them. If not start with the head of IT.

The last resort is to contact Health and Human Services. You can read that this is probably a direct violation of their technical safeguards here. If no one at your company wants to do anything about the security issue than ask if it is a violation, report your company, and allow them to be educated.

(And I do feel that this is different from asking for your user/pass when you leave the company. I feel that can be justified because if they did anything there would be "timestamp" information that would allow you to be vindicated of wrongdoings. But while you are employed there, this becomes a game of he said/she said or where were you at 10:32 AM on January 5th? And note that with your login I can remotely login to a PC easily at the office you are at for a given day as you.)

Answer 2

The sound you hear is ten thousand network administrators screaming "NO!" at this post.

At best, this is attempt to see just how gullible you are. I would actually suspect this is the case, as security auditing tests mainly for social exploits, these days.

At worst, this is the sign of completely inept management (I mean thoroughly, as in their parents should have to pay fines for polluting the environment with this stupidity).

In any case, I would NEVER send anyone ANY password that was tied to my identity.

I would forward this email to your IT department with a header, "Obviously no one would ever have a legitimate need to do this, but I thought this should be brought to your attention as an attempted security exploit."

Answer 3

That is a ludicrous request on so many levels in a HIPAA environment.

• Should not ask in the first place
• Should not email
• Should not keep it in a file cabinet
• It is a Windows logon
  If you have Local logon rather than a Domain then I don't see how you would even be HIPAA compliant in the first place.
  In a Domain a Domain Admin can lock an account or change your password.
  If a Domain Admin changes your password that is what is logged - there is evidence the password change was not performed by you.
  If they don't control your password today then I don't see how they are HIPAA compliant.
  Really if you are not on a Domain then devices are not authenticated and that is not HIPAA compliant.

I guess they can ask for it but I suspect the request alone is evidence they are not HIPAA compliant. If you comply with the request then that is likely a HIPAA violation. But if you are complying with verified request from management then I would say the violation is not a something that can be pinned on you. If someone else uses your account you can say hey you made me disclose my password. Prove that email or file cabinet was not compromised. That is such a ludicrous request. Even someone from HR should know better.

Tread carefully. You have done nothing wrong. Even if you you reply you have probably done nothing wrong. If you whistle blow you might lose your job or shut down the company. If they are no damages then you may not even get any money whistle blower. This is not your problem. Don't take the arrows.

Melissa you keep asking why like there is a valid reason. My answer is that from both a HIPAA and technical perspective I see no valid reason. How HR put got in the middle of this is something that only HR, CEO, and COO know. An IT person responsible for compliance would never do this. Again this is not your problem. Let IT take this up with HR. I don't see the risk versus reward in being a whistle blower.

Answer 4

This is bad enough at any company but for one that is under HIPAA, it is totally unacceptable (and very possibly illegal). I would suggest you get a copy of the HIPAA regulations, finding the appropriate clauses about data access and send that back instead.

http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/securityrulepdf.pdf

Note there is a provision that they are allowed to make special provisions for handling emergencies, but it does appear to contradict the section where it states that it must be verifiable that the person logged in is the person it is supposed to be. By sending the information through email, you are likely in violation as there are other people who can access the emails (System administrators) besides the person it is sent to.

If you are under HIPAA, you may have a security officer who is responsible for ensuring HIPAA regulations are followed, if so bring this up to him or her before responding to the boss. This may be the better person to bring up how bad an idea this is.

Answer 5

I would check your company's IT policy document. I would think it's very likely that it is a specific policy requiring you to not either e-mail or write down your username/password combination.

I would then reply to all citing the regulation and refusing to comply.

Answer 6

Just send in your username and password and then change your password. You should be required to change it every few months or so anyway. If in the future anyone asks why you changed your password, you can say "Oh, I've been told several times that it is a good idea to change my password from time to time, I didn't even think about that piece of paper locked in a cabinet somewhere".

Answer 7

I am currently an IT professional in the healthcare industry. I enforce policy that is designed and created by security professionals. These policies are structured on HIPAA. I can retrieve local policy concerning everything in this summary: http://www.hhs.gov/ocr/privacy/hipaa/understanding/srsummary.html

Some excerpts:

Administrative Safeguards -> Security Personnel. A covered entity must designate a security official who is responsible for developing and implementing its security policies and procedures.15

Technical Safeguards -> Access Control. A covered entity must implement technical policies and procedures that allow only authorized persons to access electronic protected health information (e-PHI).24

---

Password considerations

Passwords must change periodically. This means physically stored passwords would become obsolete.

Your IT professionals have the ability to manage and audit your password. Individually retrieving passwords is far harder than automating the process via administrative controls.

---

Policy considerations

Based on HIPAA, you should have an appointed security officer and be trained on basic security controls. This would be the correct person to contact concerning this.

Your IT group and security group should have policies detailing controls placed on passwords. These policies are legal documents.

---

Privacy / HIPAA considerations

Being able to access a Doctor or nurses account is a huge problem by itself. Controls must be in place for "Minimum Necessary Requirements" Your CEO or COO should never have access to patient information that they do not require to perform their job duties. Many arguments and excuses could be made for individual situations, but no argument can be made for an all-inclusive access to all patients and employees.

Having an employee's password would also allow you to alter a chart inappropriately, this is a HIPAA violation.

Asking for all employee's password is not a HIPAA violation due to security auditing concerns. However, storing this information could easily be a violation.

Finally, if a CEO/COO used your account to perform a HIPAA violation, you would be responsible. If you participated in the e-mail, that could be used to mitigate some responsibility. However, you have a responsibility to protect your password, knowingly allowing someone access to your account is just as bad as impersonating someone.

---

What you should do

Do not provide your password. Review IT policy concerning passwords and access controls. Report the e-mail to your supervisor, appointed security officer, and IT administrator. If management does not respond favorably, your facility might have "anonymous" security hotlines you can complain to. Also, you have the option of complaining via the U.S. Department of Health and Human Services

Unfortunately, when taking the complaint past your management, you might get you suspiciously terminated.

Answer 8

You should not provide your username and password and reply back explaining that the security policy prevents you from providing that information and this sounds like a phishing email; CC an internal security team or IT team to make them aware of the email going around.

If it's a legit request and they press the issue further, approach them in-person to discuss and explain why you shouldn't. If they still insist, provide it in-person and not over email.

Answer 9

Just Say No

HIPAA requires access be limited to those with a need to know. The only way an approved Electronic Health Records system assesses need to know is by who is logged in. HIPAA also requires they log who has accessed electronic records, and who has changed them.

Due to HIPAA and the electronic health records rules, each provider should have a unique identifier, which only that provider can access. This is usually implemented by a combination of object in hand (ID card or RFID) and item you know (password), and for verification, item many people know (account ID). The IT department can easily look up the account ID. The IT department can probably change the password with minimum hassle, (but it gets logged in the system,) and if they do so to access things improperly, it's much easier to point out that your password was changed by someone else. (When you go to log in, you'll discover your password fails, and have to have IT reset it for you. If that happens, it's a warning sign.)

Per the Department of Heath and Human Services' (DHHS) Summary of the HIPAA Security Rule, violations of the security rules are federal crimes. Per the Enforcement Rule page, each unauthorized or illegal access is finable at up to $100, to a maximum of $25,000 per year. If you let someone have your login credentials, and they use them, and it can be tracked back to you, each of you can get hit with the fines. Every record accessed can be fined for each time it's accessed.

No Valid Reason

As noted above, the IT guys, or at least the Electronic Health Records Security Officer, can access your account by use of several methods, but those methods are likely to be logged.

Any legitimate reason to look at records has access already under their own account. Management has no legitimate reason, unless they get approval from the Electronic Health Records Security Officer (EHRSO), and that means they're supposed to have their own log-in.

Physical record of your password for "I forgot" purposes is likewise invalid - the EHRSO can have your password reset. Possibly even IT can reset your password. If you go that route, as soon as possible, you should change your password.

A competent EHRSO can even create a statistical sampling account that shows record numbers but no identification of the patient, so even statistical sampling isn't a valid reason.

Since all your records can be reviewed by the EHRSO, or a person appointed by them, and credentialed with their own login and password, and thus properly logged, reviewing your work is not a valid reason.

Password via email

Sending a password via email is always a bad idea. Especially when it allows access which you can be fined for using inappropriately. Never email your password to anything to anyone, including yourself.

Report this to the ERHSO

Your ERH Security Officer may not be in the loop. If they are, then you've got a big problem with the employer. If not, they may be able to gently educate the higher ups about the situation.

Report to DHHS

If they don't take "no" for an answer, as soon as you're able, contact the Department of Health and Human Services' Office of Civil Rights (DHSS-OCR). Let them know that you have concerns about your log-in credentials being used by your employer to gain unlawful access by management to electronic health records.

This is to do 3 things:

1. Protect you from both the employer and the DHSS-OCR
2. Protect your patients' civil rights
3. Get your employer educated about what they can and cannot do legitimately.

Even if nothing comes of it fine-wise, it gets logged by DHSS-OCR, and future complaints by others will have more ammo. It can take a while.

If you are threatened by your employer, contact your professional licensing division and find out what your state rights and liabilities are. Note also that reporting violations of US Federal regulations is protected under whistle blower laws on the federal level.

Polite but Firm

Remain polite when dealing with the administration. Even if they are asking something illegal, a hostile or vitriolic response may be grounds for termination.

Answer 10

A boss "can" do pretty much anything, even if it's illegal. As I see it, the only things a boss can't do are the things his or her employees refuse to comply with.

You can also refuse to do anything your boss asks you to do, independently of whether that request is legal, illegal, reasonable or unreasonable. Your boss's request doesn't have to be illegal or whatever for you to decline to comply.

I get the impression you don't think what your boss is asking you for is okay. If you think it's a bad idea, my advice would be not to do it. Or do it and then immediately start looking for another job.

Answer 11

The company can require full access to anything you do for them or on their equipment. Asking for your personal password is absolutely the wrong way to handle that, though; they should be able to set up an administrative override on any system if that's really what they want.

If they do so, you should cooperate.

If they don't, but there's a legitimate business emergency that requires access when you can't be there, you should find out what company policy is -- who would have to approve it -- and then change your password as soon as you return and/or the crisis is past.

If there isn't a crisis, it can wait until you can get there.

If it's in a gray area between these, get explicit direction from higher management and/or you company's computer security team. Preferably in writing over a signature.