It is a violation of HIPAA if an employee of a Covered Entity or a Business Associate shares login credentials to systems containing ePHI because of the requirement “to verify a person or entity seeking access to ePHI is the one claimed”. However, there are circumstances in which passwords can be shared - provided they are not login credentials to systems containing ePHI. For example, marketing teams might share the passwords to corporate social media accounts, IT teams might share the passwords of cloud computing accounts, and finance teams share online banking logins.