A folder containing PHI was left on a desk was discovered during an audit. Would this be considered a HIPAA violation?

Was the folder open or closed

Was someone working at the desk or was it left over night

Did the auditor read the file or just find a closed file jacket?

The folder was closed and left overnight

Was this at a medical facility?

I feel like we are playing 20 questions. Could you please give some more info.

No we are not a medicaid facility but an agency that maintain children's health insurance information. The information in the folder contained children SSN, addresses and their names. Some of the parent's information was also present. This information was left overnight in a folder on a desk.

SSN is not part of HIPAA protection, and from what you have told us so far, no actual medical information regarding the child's health was in the file either. Lapse in proper office procedure but not a HIPAA violation.