I work as a receptionist in a Community Guidance Center. We had a guy come in and ask for an intake. The therapist who was to do his intake came into the receptionist area and sad the client had shot up on heroin earlier that morning. She was done with him at that point. She brought up a Mt Dew bottle that belonged to his girlfriend and said if he came back It was hers. I turned to other receptionist and asked if she head that the bottle belonged to the guys girlfriend. You know the one she said did heroin. She said okay. I believe the young kid that cleans the office overheard me say that. I did not know he was in the room , when I turned back around he was beside me an said oh someone shooting up again. I said I guess, I don't know but guess you should watch out for needles when your taking garbage out. I used to work for a DR who treated Hep C, so it was an automatic response to be careful. I was called into HR and asked if I carried on a conversation with someone about this guy. They are investigating me and wouldn't say whether I would be fired. Did I violate Hipaa? I did not know his name Think I will be fird.

This is a close call, you apparently violated by discussing a client's medical diagnosis. On the other hand, the therapist is even more guilty by discussing it in front of you. You did not access records you were not entitled to.

I would be honest with HR and tell them exactly what you told us.

From: Uses and Disclosures for Treatment, Payment, and Health Care Operations (http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/usesanddisclosuresfortpo.html)
"A covered entity also is required to develop role-based access policies and procedures that limit which members of its workforce may have access to protected health information for treatment, payment, and health care operations, based on those who need access to the information to do their jobs. "

What is the policy and procedure where you work (to comply with the above regulation) and what are the possible penalties for violation- possibly outlined in employee handbook?