While it is a violation of HIPAA to share login credentials to systems containing ePHI (because of the requirement “to verify a person or entity seeking access to ePHI is the one claimed”), there are circumstances in which marketing, legal, finance, or IT teams may share passwords in order to access shared password-protected accounts (i.e., social media marketing accounts).