I am trying to help a friend’s daughter who got herself in trouble at work, and I hope someone with knowledge can answer a few questions because although I’m an attorney this is not in my wheelhouse.

14 Comments

1. Erin VegaFebruary 1,2026 at 11:20PM UTC

   If she was trained as a medical biller she would have had to have training on HIPAA. You don't mess around with anything that involves HIPAA. As well you don't just throw checks away because you don't know where to deposit them to.

   My advice is that she owns up to her errors with HR and accepts responsibility. More than likely she will be terminated as I've said before you don't mess with HIPAA. She could be held liable as she has signed documentation about this. I would advise against just up and quitting. And if she does the organization can still come after her and hold her liable.

   It also looks to be the organization is on to her errors and are getting their ducks in a row for her termination with the added security now.

   As far as filing for SSI/SSDI as long as she qualifies under medical qualifications she can still get those benefits.

2. Dr. Patty GrossFebruary 2,2026 at 11:37PM UTC

   Since you are an attorney and this is not your wheelhouse, I suggest you check your network and find her an attorney who handles medical and employment litigation to refer her to, as this scenario is beginning to look like she might need one. As Erin said, HIPAA is not something to mess with, and it can cost a medical provider/facility significantly. Basically, the ducks are lining up, ...

3. AnonymousFebruary 3,2026 at 3:35PM UTC

   Criminal prosecution for HIPAA violations are still fairly rare, and when they happen it’s usually for much more egregious actions (e.g., intentionally accessing and disclosing a former lover’s medical history; selling patient records for financial gain; stealing PHI to commit identity theft). However, her failure to provide the medical records within statutorily bound timeframes puts her employer, as a covered entity, at risk for civil penalties. And if the OCR - the regulatory agency that enforces the HIPAA Privacy Rule - determines that the failure was the result of willful neglect, it could refer the case to the DOJ for criminal prosecution. Her employer would be charged and any sanctions would be levied against the company, but they would most definitely make her the sacrificial lamb. She’d be fired before the ink dried on the charging document. And the company could then take action against her to recoup all or some of their losses and/or enforce any applicable provisions in the attestation she signed.

   I don’t see any scenario where your friend’s daughter walks away from this unscathed. She will surely lose that job (and, quite frankly, she SHOULD be fired for a number of reasons, not the least of which is disposing of valid checks), so her best bet is to talk to HR in hopes that coming clean works to her advantage. I don’t know if her work history will impact her ability to obtain SSI (that’s outside of my bailiwick).

4. maria roseFebruary 4,2026 at 12:47AM UTC

   There’s several things being discussed in this post and all the information is from a secondary perspective based on what the OP was told.

   First issue—taking on a task that they weren’t qualified to handle properly by assuming that prior experience in medical billing was enough to do HIPAA paperwork, which would not be an issue, if questions were raised about any situations like where and how to handle checks that arrived at the office and it seems that these checks are claimed to have been thrown away. These checks were/a source of funding for the office so naturally when they are not noted as received and claimed lost—security concerns will be taken as in noted that security now requires logging in procedures which should have been in place already anyway. So feeling unsure about continuity of keeping this job, especially after acknowledging that they threw checks out is a real result consequence of that mistake plus not asking the manager for directions is suspicious, even if doing it is the excuse used to not bother the manager and not wanting to admit their lack of knowledge of the job skill needed. The last point mentioned was the attempt to now announce that the individual has a disability that caused them to make this mistake to avoid responsibility and also attempt to get SSI&DSI

5. AnonymousFebruary 4,2026 at 2:36PM UTC

   I am a physician. I don't think the employee is liable for something she was never trained on, but I do think the company is in big trouble for hiring her. Throwing out the checks? I'd say that her mental health issues are probably quite significant.

   HIPAA is a big basket of BS, to be perfectly honest, and records have to be released all the time. However, nobody should expect an employee to do difficult work for which she was never trained.

   I don't think that she is going to be in a lot of trouble - in the corporate world $hit flows uphill - but I do hope you can help her to get disability and appropriate treatment and get out of there.

6. WandaFebruary 6,2026 at 3:39PM UTC

   I agree with everything you've said here.

7. misskelleypFebruary 4,2026 at 5:56PM UTC

   she threw out checks? OMG. There's a lot to unpack here, but it never occurred to her to ASK someone what to do with INCOME?? Honestly, she should be fired for that. As for the records requests, I think she could plausibly argue that she wasn't adequately trained , but I just don't see how she can keep this job. If she qualifies for SSI/D she SHOULD apply for it. And she needs to work on her problem solving skills for life in general....

8. AnonymousFebruary 7,2026 at 1:24PM UTC

   Agree.

9. Nancy CincottaFebruary 5,2026 at 1:33PM UTC

   If she hadn’t already, any HIPAA violations should be reported to the compliance dept. Then a corrective action plan can be implemented. She signed understanding of the training, which is litigation mitigation for the company. She will likely lose her job, but notifying proper compliance personnel ASAP is key to mitigating risk. She’s not likely to face criminal penalties. Though, since a security officer is now involved, it seems maybe they’re already aware and have this new system in place as their action plan?

10. AnonymousFebruary 6,2026 at 4:56PM UTC

    Thanks for this thought out response. I told her not to say anything as this could be criminally prosecuted yet she wants to go in and confess. Is this really the best solution?

11. Nancy CincottaFebruary 7,2026 at 5:49PM UTC

    I’m not an attorney. I am just going under the concept that a cover up is worse than an offense. Maybe LinkedIn is a better source of qualified professionals to guide you/her based on the unique nature of her situation

12. Jackie DanielsFebruary 6,2026 at 1:48PM UTC

    Out of curiosity, to whom was she releasing records? To the patient or an insurance company?

13. AnonymousFebruary 6,2026 at 4:49PM UTC

    She wasn’t releasing the records. She wasn’t doing her job. However, it was for the patient. She would receive a request and then never sent out the work to get done.

14. AnonymousFebruary 7,2026 at 3:41PM UTC

    She is not qualified for the position and should seek employment counsel on her rights and her obligation.