On two occasions , Terrell had accessed a co - worker ’s personal data through the internal records system . Her conduct not only constituted a breach of company policy , it also violated federal health care privacy laws , specifically the Health Information Portability and Accountability Act ( “ HIPAA ” ) ;