+1 for finding the proper agency to report this to.

Thank you so much Wesley & Blankip!

3rd reason: The person sending the email wants to do something they shouldn't and wants to have someone else take the fall for them if the action(s) is/are dicovered. Of course if folks comply, this email pretty much hands the owner of the account a defense, but that might not have been thought through.

@GreenMatt - We didn't actually use the words "Medicare Fraud," yet, did we? We were just thinking it very loudly.

You mean Medicare and Medicaid....

@GreenMatt -... yikes. I didn't want to get into that much detail but yea... But also not having any authentication beyond your windows login is suspect too. It takes me a boot disk and about 10 minutes to grab all the cached user/pass from a windows PC... I didn't want to get too much into the technical details but can add if you think it is worth it.

Even asking for user/pass when leaving the company is unacceptable. If there is need to access the system, have the IT person modify the password table to replace the hash with a known one (it is a hash, right). If using an outside system you don't control the log in to, you are very likely to be violating the ToS of the system which could cause a host of other issues. In such a case, management should work with the service provider if access to the account is needed.

@Lawtonfogle - I agree. But this is certainly at a different level of being unacceptable. Also some small companies don't have the means or intelligence that you or I might have. Certainly not condoning it but "I could see it" after the employee is gone.

@SteveJessop - there were edits to question... I have edited to help reflect those.

Sorry guys, I should have added that it came from HR to begin with!

@Melissa - I would assume your management put HR up to it and certainly knows about it... However how poorly your security is, who know? The intracompany communication could be just as bad. Maybe it is an HR person that just did something dumb and didn't understand what they were doing.... hopefully but not probably.

@Lawtonfogle Password is is not a hash and it is not in a table . No way HIPPA data is with an outside system here.

Our IT is through Windstream/EDTS. Everyone in the company, including the owners know about the email that HR sent out because they received it as well. They just think we are all too stupid and will comply with anything that they tell us too do, right or wrong.

@Melissa Really you have HIPPA data on a third party server?

I guess we do? How do I find out? I just know for a fact that they have remote access to our computers.

And WIndstream/EDTS understands the email? Like I mentioned in my answer the HR email could very well stem from Windstream not letting your management do something... that it shouldn't be doing.

Well if you know that Windstream knows and obviously your management knows... You might get to go straight to GO - contact a state HHS HIPAA rep. Wow that sounds like fun.

Indeed, "sounds like fun". Brace yourself very strongly before becoming a whistle-blower. The probability is that you'll lose your job. I'm not saying don't do it, I'm saying (a) it's an act of personal sacrifice in the face of wrongdoing, (b) get legal advice.

If I'm remembering the HIPAA training I received at my last job correctly, it would actually be a violation of HIPAA to share credentials that grant access to protected data to someone without a need to know. Like, say, HR people.

@MonicaCellio - You are correct. I had to make a HIPAA compliant app a few years ago. There where safeguards everywhere. I remember what you are saying because I had to put a stupid pop-up on the beginning of the front-end that the user had to click OK to (like anyone ever read it) that stated that they don't share login info, client info, company info blah blah blah

@SteveJessop - in most cases whistleblowers are on their way out - I just answered a whistlblower question - workplace.stackexchange.com/questions/46513/…. However being in something this heavily regulated and with such a strong anti-whistleblower policy/laws I think she would be OK to contact HHS. If management finds out she won't be employee of the year but she can probably enjoy a hostile work environment for a while. Lawyer might be next... this company might just be stupid though.