Many password managers have a health check capability that enable Covered Entities to test for weak, reused, and compromised passwords. If a password has been shared with an unauthorized third party, it should be reported by the individual who shared the password as sharing login credentials to systems containing ePHI is a violation of HIPAA.