The Shared Login and the Curious Scheduler
A 14-physician family medicine practice uses a single shared front-desk login for its EHR because the office manager says individual accounts slow check-in. The login is written on a sticky note under the counter. A scheduling coordinator, Dana, has used that login for two years. Last week she looked up the record of her neighbor, who had been seen for a psychiatric evaluation, and read the visit notes. She told another coworker. The practice's privacy officer learns of this from the coworker and must decide what to do. The practice has 38 staff, does not employ a dedicated IT person, and its Notice of Privacy Practices says the practice uses 'role-based access controls.'
1. Identify the privacy and security failures in this scenario and explain, for each, which safeguard or standard it implicates.
Read the worked answer
There are at least three distinct failures, and they compound:
Shared credentials. A single login used by multiple staff means the audit log cannot attribute an action to a person. HIPAA's Security Rule requires unique user identification (§164.312(a)(2)(i)) and audit controls (§164.312(b)). A shared login defeats both. The sticky note is also a poor physical safeguard (§164.310(a)).
No access limitation. Dana, a scheduler, could open clinical notes. The minimum necessary standard and the access-control standard (§164.312(a)(1)) call for role-based permissions. The Notice of Privacy Practices promises role-based controls the practice does not actually have - a statement that is now misleading.
Unauthorized access and disclosure. Dana accessed a record without a treatment, payment, or operations purpose and shared the content. That is an impermissible use/disclosure under the Privacy Rule and a reportable event to evaluate under the Breach Notification Rule.
Note that the cause matters less than the pattern: the practice's design made the violation easy and hard to detect.
2. The privacy officer wants to simply 'counsel Dana and move on.' Evaluate that response against the practice's obligations, and describe what a defensible response would include.
Read the worked answer
Counseling alone is not defensible. The practice must address both the individual act and the systemic cause.
Individual level:
- Document the investigation: what was accessed, when, by whom, and who received the information.
- Apply the practice's own sanctions policy consistently (workforce sanctions are a required administrative safeguard, §164.308(a)(1)(ii)(C)).
- Consider whether the disclosure to the coworker triggers a breach notification analysis (see next task).
Systemic level (the part 'counsel and move on' misses):
- Retire the shared login; issue unique credentials and enforce role-based access.
- Correct the Notice of Privacy Practices if the practice cannot actually deliver role-based controls.
- Implement audit-log review, since the practice currently has no way to know how often this has happened.
- Retrain staff on access rules and the duty to report.
A regulator or plaintiff will ask: did the practice fix the condition that allowed this? If the answer is no, the individual sanction looks like scapegoating rather than remediation.
3. The coworker who heard the information tells Dana's supervisor. Does the practice have a breach notification obligation? Walk through the analysis.
Read the worked answer
Work through the Breach Notification Rule elements:
- Was there an impermissible use or disclosure? Yes - Dana accessed without a permitted purpose and disclosed to a coworker.
- Was it unsecured PHI? Yes, unless encrypted to the standard; nothing here suggests encryption.
- Is there an exception? The most relevant candidate is the workforce exception - but that applies only when a workforce member accesses PHI in the course of proper job duties. Dana was not. The coworker also had no need to know. So the exception does not apply.
- Presumption of breach: A breach is presumed unless the practice demonstrates a low probability of compromise using the four-factor risk assessment (nature and extent of PHI, the unauthorized person, whether it was actually acquired or viewed, and the extent of mitigation).
Here the PHI was actually viewed and further disclosed, which weighs heavily against a low-probability finding. The practice should document a risk assessment, but the honest conclusion is that notification is likely required. 'Counsel and move on' would leave the practice unable to defend a no-notification decision.