Hi, not sure if this is the place to post this but here goes.
I work in retail and had a long conversation the other day with a hospital employee in an admin role. I told her a story about when I was younger and witnessed a massive HIPPA violation.
10+ years ago my dad rented a storage unit. I liked to explore around the building as it had a lot of rooms and old stuff laying around. There was an unlocked door and when I went inside that room there were dozens of shelves and hundreds of boxes all were labeled as medical records. At the time I thought this was a massive blunder from that healthcare facility, leaving an unlocked room filled with medical records, but I never cared to say anything to anyone until the casual conversation with this hospital employee.
That employee called me today and said she had to report the violation, and when she reported it, the person she reported it to asked if they could talk to me. She called first to ask me permission to give my name and phone number to this person looking into this violation. I said ok, but I'm unsure if that was wise. Is there any legal risk to myself? Being unaffiliated with the hospital I don't think I had any obligation to say anything to anyone but I want to be sure before I talk to this person that I'm not in any risk of repercussions.
I appreciate any advice!