Which scenario constitutes a potential HIPAA violation?

• A. Encrypting a patient’s information before sending electronically.
• B. Accessing only records you are authorized to view for patient care.
• C. Sharing login credentials with a coworker.
• D. Sending PHI only to approved recipients through secure channels.

Answer: (C)

Sharing login credentials with a coworker is a potential HIPAA violation because it breaks authentication and accountability. Each person must use their own unique credentials, so we can verify who accessed patient information and hold them responsible. When credentials are shared, there’s no reliable audit trail, making it impossible to determine who viewed or disclosed data, and it raises the risk of unauthorized access.

By contrast, encrypting data before sending it protects confidentiality, accessing only records you’re authorized to view aligns with role-based access, and sending PHI only to approved recipients through secure channels follows proper disclosure and security practices.