HIPAA Basics for Everyday Employees

Overview

HIPAA is a U.S. law that protects patient health information. If your company handles medical records, billing data, or anything that identifies a person and their care, HIPAA shapes how you store, share, and talk about that data. This article covers the basics you should know as an employee.

Before You Begin

• Confirm with your manager or compliance officer whether HIPAA applies to your role.
• Review your company's specific HIPAA policy. It always takes precedence over general guidance.
• Know who your privacy officer is. That person owns HIPAA questions for your company.

Steps

1. Learn what counts as protected health information (PHI). PHI is any health detail tied to an identifier such as a name, date of birth, address, email, or medical record number. A patient's first name on a sticky note next to a diagnosis is PHI.
2. Share PHI only with people who need it for their job. This is the "minimum necessary" rule. Forwarding patient records to a coworker who is curious is a violation.
3. Use approved tools. Send PHI through your company's email, secure file share, or healthcare platform, never personal email or consumer messaging apps.
4. Lock your screen any time you step away. An unattended monitor showing patient data is one of the most common HIPAA findings.
5. Avoid talking about patients in public areas. Elevators, lobbies, and coffee shops are not private, even if names are not used.
6. If you receive PHI by mistake, do not forward it. Tell your privacy officer and follow their instructions.
7. Report any lost device, stolen phone, or suspected breach to your privacy officer the same day. Speed matters under HIPAA reporting rules.

Troubleshooting

• If you are unsure whether a file contains PHI: assume it does until your privacy officer confirms otherwise.
• If a patient asks for their own records: route the request to your privacy officer. They will handle it through the official channel.
• If a vendor asks for patient data: confirm with your privacy officer that a Business Associate Agreement is in place first.
• If a coworker is mishandling PHI: report it. Your company is required to investigate, and good-faith reports are protected.

Related Articles

• CMMC Basics: What You Need to Know
• SOC 2 Awareness: How Your Day-to-Day Supports the Audit
• Handle Sensitive Information at Work
• Report a Lost or Stolen Laptop or Phone

Need More Help?

Submit a ticket at support.bostonmit.com or email support@bostonmit.com.