HIPAA violation from posting about work: how CNAs get caught

A CNA on r/cna posted this:

"

I am freaking out. Last night I posted an Instagram story about a really difficult resident I had — totally vented about how they grabbed me, yelled at me, spit at me, the whole shift from hell. I didn't name the resident. I didn't say what facility. I just said "I work in healthcare and some days I just can't" with a blurry selfie of me crying in my car after shift. One of my coworkers saw it, screenshotted it, and sent it to our DON. Now HR wants to meet with me tomorrow and I might lose my job. Did I actually break HIPAA? I didn't share any patient information. I'm so scared I'm going to lose my certification over a vent post.

This is one of the most common HIPAA fears CNAs have, and the answer is more complicated than most people think. Here's what's actually true, what's a myth, and what to do if you've already posted.

What HIPAA actually protects

HIPAA protects individually identifiable patient information. The legal standard is whether a reasonable person could use what you posted, combined with other available information, to figure out who the patient is.

That includes:

• Name, address, date of birth, Social Security number
• Photos, videos, or audio where the patient can be identified
• Any detail about a patient's condition, treatment, or care that could identify them
• Dates of admission, discharge, or death
• Specific room numbers, unit names, or facility locations when combined with other details

HIPAA does not protect information that has been properly de-identified — meaning no one could reasonably identify the patient from what was shared.

What counts as a violation in real life

Here's the part that gets people in trouble. You can violate HIPAA without naming the patient. The legal test is whether the patient could be identified, not whether you literally typed their name.

The classic example: "I had a 34-year-old patient yesterday who came in with a heart attack" — that's enough to violate HIPAA if the patient is the only 34-year-old admitted with a heart attack to your unit that day. Anyone with access to your facility's records could identify them.

Examples that do violate HIPAA even without names:

• Posting about a specific patient event with identifying details (the diagnosis, the procedure, what they said, what their family said)
• Posting a photo of a patient, a patient's room, a patient's belongings, or a chart where any detail is visible
• Posting about a specific case on a unit, even in general terms, when the unit and shift narrow it down to one person
• Discussing patient details in a hallway, elevator, cafeteria, or parking lot where someone could overhear
• Looking up a patient's information when you have no clinical reason to (including celebrities, coworkers' family members, neighbors, or your own family)

Examples that usually don't violate HIPAA:

• Complaining about your job in general terms ("I had a really hard shift") without any patient details
• Discussing a textbook case with no identifying information
• Sharing your own medical information, even if it's the same condition you saw in a patient

Back to the original post

The CNA in the scenario vented about a difficult resident without naming them, didn't say what facility, and didn't include any clinical details. By the strict letter of HIPAA, they probably did not violate it.

But here's the problem: HIPAA isn't the only thing that can get you fired.

Most healthcare employers have their own social media policies that are stricter than HIPAA. Common policy violations:

• Posting about work at all, even without patient details
• Posting while in uniform or in scrubs where the facility logo is visible
• Posting in a way that could damage the facility's reputation
• Discussing coworkers in any way that could be seen as bullying or harassment

Even if HR can't terminate you for a HIPAA violation, they often can for a social media policy violation. And once HR opens an investigation, they will look at everything. If the screenshot reveals other details — what unit you work on, what shift, anything that narrows down the patient — what looked safe suddenly isn't.

What to do if you've already posted

Don't delete and hope nobody saw. Screenshots are forever, and deleting the post looks like you know you did something wrong. It doesn't matter — HR already has the screenshot.

Do not post about the HR meeting. Talking publicly about an active HR investigation almost always violates your own facility's policy and can make things worse.

Talk to a labor or employment lawyer before the meeting. If you're in a union, talk to your union rep first. Many states have legal aid for healthcare workers. Some offer free 30-minute consultations. The lawyer will tell you what to say and what not to say.

Be honest with HR, but don't volunteer extra information. If they ask "did you post about a patient," answer truthfully. If they ask "tell me everything about the post," you can say "I'd like to answer your specific questions, but I'd like to review the post itself first and consult with my representative." That's not evasive — that's your right.

Do not sign anything without reading it. Especially anything that says "I violated policy X" or "I agree to this consequence." A lawyer or union rep can usually get you 24 hours to review.

Document everything. Save your own copy of the post, the screenshots, the messages from the coworker, the HR meeting invitation. If this goes further, you want a clean record.

What NOT to do

This is the part the r/cna thread got very wrong. The top comment said "you'll be fine, HIPAA is only for doctors" — that's a myth. HIPAA applies to every member of the workforce, including CNAs, housekeepers, dietary staff, and volunteers.

Other common bad advice:

• "Just delete it" — too late, the screenshot exists, and deleting makes you look guilty
• "Lie and say it wasn't you" — HR has a screenshot, lying is grounds for termination even if the original post wasn't
• "Post about it on r/cna for sympathy" — if your facility searches, this is another violation
• "Quit before they fire you so it doesn't go on your record" — termination for cause has different consequences than quitting, and the record follows you to your next certification review

The hard part nobody wants to say

The r/cna thread had a lot of comments blaming the coworker who reported it. That's understandable — being reported by a coworker feels like betrayal. But the coworker did what they're required to do under most facility policies. If they had seen the post and not reported it, they could have been disciplined too.

The bigger lesson is that healthcare is one of the few fields where venting about work, even in private, can have professional consequences. It's not fair. It's also not going to change. Learning to vent in a way that protects your job is part of staying in this work long-term.

That means: vent to your partner, your therapist, a journal, a private group chat with people who don't know your facility — never anywhere with a screenshot button.

---

If this kind of post is useful, the full ExamReady library has 1,500+ practice questions, clinical skills with critical-step tracking, and an AI tutor that explains every answer — the same scope-and-voice approach as these posts, with the actual exam tools attached. A 7-day free trial gets you the whole thing, no card required.