....Ummmm. That's fairly arse backwards. But okay lets go ahead and trace this out then. If they want you to share your credentials, they are probably aggrega

....Ummmm. That's fairly arse backwards. But okay lets go ahead and trace this out then. If they want you to share your credentials, they are probably aggregating all data on a machine by machine basis, and access controlling only through the customer. If that is the case, that suggests, not guarantees, but suggests, that they aren't providing auditing in terms of who accessed what data, and why, which is generally part and parcel of what someone is on the hook for. Technically speaking, the spirit of the law is that access of information should be discernable down to a unique individual. One person, one user. Credential sharing nukes that. In fact, it IS in a sense illegal, or at least non-compliant, because they cannot discern whether or not your information has been leaked without authorization. Which is half the onus put on a covered entity. So I'm going to guess they are not integrated with HCP's, nor are they implementing an access control mechanism whereby users can grant HCP's access to their data tracked in their systems and ACK'd to an HCP and possibly the insurer. I'd have to emit a WTF are they doing? Tbqh. However, I'd need access to proprietary docs to make any really authoritative statements, because they could be arranging their affairs in a way I haven't been exposed to before. T. done the HIPAA jig more than once