Daily privacy habits, social media rules, EHR discipline, mobile device policy, cloud storage, and telehealth — translating HIPAA obligations into concrete daily behavior.
The last mile: where compliance happens or fails
45 CFR § 164.310(d) (device and media controls) | 45 CFR § 164.530(c) (safeguards)
Before accessing a patient record, ask: Is this necessary for my current job function? Looking up records out of curiosity — even for family, neighbors, or celebrities — is an impermissible access.
Your EHR login creates an audit trail. Every access is logged with timestamp, user ID, and record accessed.
In 2020, a UCLA Health employee was terminated and faced federal charges after accessing 3,236 patient records of celebrities and VIPs over 4 years — despite having no legitimate job need.
Personal accounts are not a shield. HIPAA violations on personal social media by healthcare workers result in termination and can trigger OCR investigations of the employing organization.
A nurse posts: "Had a patient today whose test results really moved me. So grateful to be in this field." No names, no details.
Likely not a violation — no PHI disclosed. But advise caution: posts can become problematic if someone identifies themselves or asks follow-up questions.
A medical assistant posts a selfie at the nurses' station. In the background, a patient whiteboard shows room numbers, diagnoses, and medication schedules.
Clear HIPAA violation — PHI visible in background constitutes an impermissible disclosure. Fireable offense in most organizations.
A physician posts: "The family that came in today — mom had three kids with the same rare genetic condition. Heartbreaking." No names, city not mentioned.
Likely a violation — highly specific details (family unit + rare condition) may make the individuals identifiable in context. When in doubt, don't post.
An ER technician connects with a patient on LinkedIn after their visit, then messages them follow-up health information.
Violation — using PHI (knowledge of the patient relationship) to contact a patient through an unapproved channel. Violates minimum necessary and proper communication channels.
Workforce members frequently underestimate how thoroughly access is logged. Assume everything you do in an EHR is recorded and reviewable.
45 CFR § 164.312(b) (Audit Controls) | 45 CFR § 164.308(a)(5) (Security Awareness Training)
Mobile Device Management (MDM) software must be installed on any device used to access ePHI. MDM enables remote management, policy enforcement, and remote wipe capability.
Full-device encryption is required (AES-256 standard). Remote wipe capability must be enabled and tested. Encryption activates the breach safe harbor if a device is lost or stolen.
Personal mobile devices are generally prohibited for accessing, transmitting, or storing PHI. Texting PHI from a personal phone is a violation — even if deleted immediately.
45 CFR § 164.310(d) | HHS Mobile Device Guidance (July 2013)
PHI must never be stored in personal cloud accounts (personal Dropbox, Google Drive, iCloud, OneDrive personal). These providers are not HIPAA-compliant without a BAA, which is not available on personal plans.
Emailing PHI to a personal Gmail or iCloud account is also prohibited — for the same reason.
Any cloud service (including business tiers of Dropbox, Google Workspace, Box, OneDrive for Business, AWS, Azure) used to store or process ePHI requires a signed Business Associate Agreement with the provider.
A billing coordinator emails themselves a spreadsheet with patient balances "to work on at home." The spreadsheet contains names, DOBs, and account data. Sending to a personal account = impermissible disclosure. The personal email provider has no BAA.
45 CFR § 164.308(b) (Business Associate Contracts) | HHS Cloud Guidance (2016)
Use only telehealth platforms that have signed BAAs with your organization. Most major platforms (Zoom for Healthcare, Doxy.me, Microsoft Teams for Healthcare, Epic Telehealth) offer HIPAA-compliant tiers with BAAs.
Consumer Zoom, FaceTime, Skype, and Google Meet (standard versions) are not approved for PHI without BAAs. Do not use without explicit IT/compliance sign-off.
45 CFR § 164.502 | OCR Telehealth Guidance (March 2020, extended) | 45 CFR § 164.504(e) (BAA requirements)
Foundations: Kennedy-Kassebaum Act, Privacy & Security Rules, HITECH, Omnibus, covered entities, business associates, OCR enforcement
Privacy Rule: PHI definition, 18 identifiers, de-identification, TPO, 12 exceptions, 6 patient rights, minimum necessary
Security Rule: CIA Triad, Required vs. Addressable, 5-step risk analysis, administrative / physical / technical safeguards, encryption safe harbor
Breaches: definition, 3 exceptions, 4-factor assessment, 60-day clock, 3 notification types, 4-tier civil penalties, criminal penalties up to 10 years
Workplace: daily habits, minimum necessary in practice, social media rules, EHR discipline, mobile policy, cloud BAAs, telehealth platforms
As a workforce member with access to PHI, you are personally responsible for maintaining compliance every day. When in doubt — ask your Privacy Officer.
You now understand the legal framework, your daily responsibilities, and the real consequences of HIPAA violations. This knowledge protects patients, protects your organization, and protects you.