Updated 2026 with 42 CFR Part 2/SUD: Looking for a Business Associate Agreement? Download our FREE template

Register for our webinar October 7, 2026, 2 PM ET: Master Open Enrollment: Navigating HIPAA, Employee Data, and Compliance Risks

TotalHIPAA Logo

Does AOL have a HIPAA violation on its hands?

Summary:

AOL Chief Executive Tim Armstrong announced plans to restructure its 401(k) program. Why you ask? Well in a conference call with employees, Mr. Armstrong explained to his employees: “Two things that happened in 2012,” he said, according to a transcript provided by an AOL employee to Capital Magazine and reported by Joe Pompeo. “We had […]

AOL Chief Executive Tim Armstrong announced plans to restructure its 401(k) program. Why you ask? Well in a conference call with employees, Mr. Armstrong explained to his employees:

“Two things that happened in 2012,” he said, according to a transcript provided by an AOL employee to Capital Magazine and reported by Joe Pompeo. “We had two AOL-ers that had distressed babies that were born that we paid a million dollars each to make sure those babies were OK in general. And those are the things that add up into our benefits cost. So when we had the final decision about what benefits to cut because of the increased healthcare costs, we made the decision, and I made the decision, to basically change the 401(k) plan.”

The question is, “Is this a HIPAA violation?” Potentially, yes. Though the employees weren’t named, this is Protected Health Information, and it wouldn’t take much for a fellow employee to determine who the employees are. If the employees that were mentioned in this call were to file a complaint against AOL, the company could be in some serious hot water (fines) with Health and Human Services (HHS).

David Smith, Total HIPAA Compliance’s resident HIPAA expert had this to say, “This irresponsible action by the CEO of a major company represents exactly why Privacy is a growing concern among our citizens. I just hope that someone in HR at AOL learned a lesson about what to say and not say around corporate leaders, and AOL’s communications consultant has very good E&O insurance.”

Update: AOL has reversed the 401(k) cuts after the backlash from employees. Armstrong has also apologized for mentioning specific healthcare examples when trying to explain their shift in the decision-making process.

AOL reverses 401(k) cuts

Update 2: Over the weekend one of the mother’s of the distressed babies stepped forward to explain the ordeal her family had to suffer through. Luckily, her child is thriving!

“In other words, we experienced exactly the kind of unforeseeable, unpreventable medical crisis that any health plan is supposed to cover. Isn’t that the whole point of health insurance?” said Deanna Fei, mother of the child. She went on to say, “Our daughter has already overcome more setbacks than most of us have endured in the span of our lives. Having her very existence used as a scapegoat for cutting corporate benefits was one indignity too many.”

My Baby and AOL’s Bottom Line

The moral of the story – HIPAA is in place to protect employees’ privacy. Learn the law and think before you speak.

By Jason Karn
Google+

Sharing is caring!

Looking for a Business Associate Agreement?

Download our free template to get started on your path toward HIPAA compliance.

Download Now

Want to stay informed?

Join our community, stay ahead of the curve on HIPAA compliance and receive free expert guidance.

Related Posts

Is Outlook HIPAA Compliant? How to Follow Best Practices for Email Security

Is Outlook HIPAA Compliant? How to Follow Best Practices for Email Security

Microsoft Outlook is not HIPAA compliant by default, but it can support HIPAA compliance when properly configured. To use Outlook safely for transmitting ePHI, your organization must use a paid Microsoft 365 business or enterprise plan, sign a BAA with Microsoft, enable end-to-end encryption, enforce MFA, and establish strict administrative policies. Free consumer accounts (@outlook.com or @hotmail.com) cannot support HIPAA compliance.

Who Does HIPAA Apply To? Types of Organizations That Must Follow HIPAA

Who Does HIPAA Apply To? Types of Organizations That Must Follow HIPAA

Not every organization that handles health information is required to follow HIPAA. HIPAA applies specifically to two major groups: Covered Entities (like healthcare providers and health plans) and Business Associates (vendors that handle health data on their behalf). However, many individuals are surprised to learn that standard employers, fitness apps, and life insurance companies are usually exempt. Read on to find out exactly who must comply with HIPAA and who is off the hook.

HIPAA Compliance Packages Explained: What You Actually Need

HIPAA Compliance Packages Explained: What You Actually Need

A comprehensive HIPAA compliance package is a bundled suite of documentation, training programs, and security software designed to bring an organization into alignment with federal privacy laws. However, many vendor packages include bloated features you don’t need, while completely omitting core regulatory requirements. To safeguard individual data and ensure audit readiness, an effective compliance framework must cover the five main components of HIPAA, provide structured training, execute dynamic risk assessment, and manage Business Associate Agreements (BAAs). This guide cuts through the marketing fluff to explain exactly what your organization needs to stay compliant without overpaying.

Save & Share Cart
Your Shopping Cart will be saved and you'll be given a link. You, or anyone with the link, can use it to retrieve your Cart at any time.
Back Save & Share Cart
Your Shopping Cart will be saved with Product pictures and information, and Cart Totals. Then send it to yourself, or a friend, with a link to retrieve it at any time.
Your cart email sent successfully :)