It depends on the reason why passwords are being shared. There are no circumstances in which passwords to systems containing ePHI should be shared because Covered Entities have to implement measures to identify users and track user activity. However, if a healthcare facility´s marketing team use the same social media accounts, there is a justifiable reason for passwords being shared.