Just Say No
HIPAA requires access be limited to those with a need to know. The only way an approved Electronic Health Records system assesses need to know is by who is logged in. HIPAA also requires they log who has accessed electronic records, and who has changed them.
Due to HIPAA and the electronic health records rules, each provider should have a unique identifier, which only that provider can access. This is usually implemented by a combination of object in hand (ID card or RFID) and item you know (password), and for verification, item many people know (account ID). The IT department can easily look up the account ID. The IT department can probably change the password with minimum hassle, (but it gets logged in the system,) and if they do so to access things improperly, it's much easier to point out that your password was changed by someone else. (When you go to log in, you'll discover your password fails, and have to have IT reset it for you. If that happens, it's a warning sign.)
Per the Department of Heath and Human Services' (DHHS) Summary of the HIPAA Security Rule, violations of the security rules are federal crimes. Per the Enforcement Rule page, each unauthorized or illegal access is finable at up to $100, to a maximum of $25,000 per year. If you let someone have your login credentials, and they use them, and it can be tracked back to you, each of you can get hit with the fines. Every record accessed can be fined for each time it's accessed.
No Valid Reason
As noted above, the IT guys, or at least the Electronic Health Records Security Officer, can access your account by use of several methods, but those methods are likely to be logged.
Any legitimate reason to look at records has access already under their own account. Management has no legitimate reason, unless they get approval from the Electronic Health Records Security Officer (EHRSO), and that means they're supposed to have their own log-in.
Physical record of your password for "I forgot" purposes is likewise invalid - the EHRSO can have your password reset. Possibly even IT can reset your password. If you go that route, as soon as possible, you should change your password.
A competent EHRSO can even create a statistical sampling account that shows record numbers but no identification of the patient, so even statistical sampling isn't a valid reason.
Since all your records can be reviewed by the EHRSO, or a person appointed by them, and credentialed with their own login and password, and thus properly logged, reviewing your work is not a valid reason.
Password via email
Sending a password via email is always a bad idea. Especially when it allows access which you can be fined for using inappropriately. Never email your password to anything to anyone, including yourself.
Report this to the ERHSO
Your ERH Security Officer may not be in the loop. If they are, then you've got a big problem with the employer. If not, they may be able to gently educate the higher ups about the situation.
Report to DHHS
If they don't take "no" for an answer, as soon as you're able, contact the Department of Health and Human Services' Office of Civil Rights (DHSS-OCR). Let them know that you have concerns about your log-in credentials being used by your employer to gain unlawful access by management to electronic health records.
This is to do 3 things:
- Protect you from both the employer and the DHSS-OCR
- Protect your patients' civil rights
- Get your employer educated about what they can and cannot do legitimately.
Even if nothing comes of it fine-wise, it gets logged by DHSS-OCR, and future complaints by others will have more ammo. It can take a while.
If you are threatened by your employer, contact your professional licensing division and find out what your state rights and liabilities are. Note also that reporting violations of US Federal regulations is protected under whistle blower laws on the federal level.
Polite but Firm
Remain polite when dealing with the administration. Even if they are asking something illegal, a hostile or vitriolic response may be grounds for termination.