HIPAA & Whistleblowing

For whistleblowers in healthcare, few topics cause more confusion or concern than HIPAA — the Health Insurance Portability and Accountability Act. While HIPAA protects patient privacy, it also includes specific exceptions that allow whistleblowers to report fraud and abuse lawfully.

Under HIPAA, healthcare workers are generally prohibited from disclosing protected health information (PHI). However, 45 CFR § 164.502(j) permits disclosures to government authorities or attorneys when a whistleblower believes a violation of law has occurred. This exception ensures that fraud can still be reported without violating patient confidentiality.

Understanding these boundaries is critical: whistleblowers must share information only with authorized entities and should work closely with legal counsel to ensure compliance.

HIPAA doesn’t just protect patients — it also ensures that whistleblowers can report wrongdoing safely and responsibly.