HIPAA - Scared of Employer

[Really_Not_All_That_Bright]

@phouka

This is completely contrary to what is covered in my company’s annual HIPAA training. An individual can be prosecuted for violating HIPAA, and all individuals who handle private health information are responsible for protecting it. Our company even issued us little signs to put on our desk instructing other not to leave PHI if we weren’t there to accept it in person.

Individuals can only be prosecuted for HIPAA violations under corporate criminal liability principles. That means only officers, directors, or (without getting too technical) management-type employees. Not call center workers.

Your company’s HIPAA training is doubtless intended to protect your company and its management, so it is perfectly sensible for them to scare you into thinking you might be prosecuted too (assuming you’re not a manager.) That’s pretty much how compliance programs work.