[UPDATE] AITA for blocking my friend of 10 years after she committed a HIPAA violation against me?
A decade-long friendship is shattered when a clinic employee secretly accesses a friend’s personal health insurance records, takes photos, and sends them via text—causing a HIPAA violation that leads to a phone block and a breakdown in trust. The poster, struggling with worsening health issues with no answers, never gave permission for the search, and the friend claims she was just “curious” despite her good intentions to “help.” Complicating matters further is the boyfriend’s access to shared devices, raising concerns about wider exposure.
Fissures in the group of friends arise as one person dismisses the breach as a “joke,” another is suddenly affected, and the poster files a formal complaint that leads to consequences at work. Reflection reveals relationships that had long frayed before the incident, forcing them to painfully reassess loyalties amid anxiety and isolation.

‘[UPDATE] AITA for blocking my friend of 10 years after she committed a HIPAA violation against me?’
The breach begins with a trusted friend overstepping professional boundaries at work.




Motives surface amid the poster’s ongoing health struggles and lack of consent.





The update reveals formal action, friend group reflections, and clinic resolution.

















The invasion of privacy in healthcare strikes at the core of patient trust and legal protections. The poster’s friend clearly violated HIPAA by accessing and sharing protected health information without permission, regardless of the poster’s good intentions. This action not only jeopardized the poster’s privacy, but also risked wider exposure through access to the boyfriend’s device. Opposing views may argue that curiosity or helpful motives might defuse the situation, but federal law requires strict consent, rendering such excuses meaningless.
The group’s mixed reactions show that personal prejudice clouds judgment in conflicts. Bella’s “playfulness” ignores professional consequences, while Cassie’s “disappearance” suggests avoidance rather than confrontation. The poster gains new perspective by clearing up pre-existing conflicts, turning betrayal into personal growth. Society at large is grappling with digital privacy breaches where an impulsive click can shatter relationships.
Healthcare professionals stress zero tolerance for such criticism to maintain the integrity of the system. “Any unauthorized access to patient records, even by well-intentioned personnel, undermines the security that HIPAA is designed to protect,” notes the U.S. Department of Health and Human Services (HHS.gov). Clinics must implement training and audits to prevent recurrence. Ultimately, the incident exposed the fragile loyalties of long-standing friendships, pushing the poster to explore healthier boundaries and new connections.
See what others had to share with OP:
Many users rally behind the poster, commending her report and newfound clarity on fading friendships.





A few commenters offer nuanced takes, acknowledging the violation while noting the clinic’s lenient outcome and personal reflections.





Light-hearted voices chime in to diffuse the heaviness, poking fun at the absurdity without malice.





The poster navigates a devastating privacy breach and friend group implosion by blocking the offender, filing a HIPAA complaint, and gaining closure through the clinic’s investigation and her own reflections. While Alice faces training and leave but keeps her job, the incident severs a decade-old bond and exposes underlying resentments, leaving the poster isolated yet empowered for growth.
How have privacy violations strained your own friendships, and when is reporting a loved one the right call despite the personal cost? What signs of drifting apart have you ignored in long-term relationships before a big blowup forced clarity?

Not sure if it was your original post or a similar one I replied to, but if you’ve deleted it, here’s what I said.
My country has ‘personal information’ and ‘health information’ protections, which have changed over the years – but ~48 years ago I was verbally ‘torn to shreds’ by my Vicar’s wife after sending them a Christmas Card with their full names on.
I had a Summer vacation job (December to mid-February, here) between university years and was with the IRD (tax department). Sorting through thousands, literally, of paper returns and looking for someone with the same surname, I merely checked the COVER and confirmed she wasn’t the person. From the address, as their four kids were under 10 and wouldn’t have any return to file, it was clear she was ‘the Missus’ and I already knew his middle name.
Nothing else.
And even back then I would have, at the least, lost my job for using information from it ‘outside’ work.
Your ‘friend’ went WAY beyond that.