The company I work has a large database of medical records that don't belong to them meaning they do not have permission from the patient or the facility to maintain these records. Is this a HIPAA violation? When I asked them about it they told me that because the records were sent to them in error they needed to hang on to the records. I would think they need to destroy the records not keep them in a database accessible to employees.

How exactly did they acquire the records?

Is this company in anyway part of a health care organization or a company that would require this sort of information?

If not, they are not violating HIPAA, but unfortunately the sender of the information is... either inadvertently or with intent. Do you know if your company has contacted the sender of this information? That would certainly be an ethical determination.

I can't think of any reason why they would need to hold onto them simply because they received them in error. That doesn't make any sense. Is it possible to go higher up and ask questions?

If they got them by error, they would return them, if someone sent them to them in error, the person who sent them did the vioation.

Please describe what is happening