Before any of this, I worked nights at a clinical lab.
I was a senior at the University of Houston, working the overnight shift at BioReference Laboratories here in Houston as a lab and IT assistant. It was the kind of job where you wear two hats at once. Part of the night I was handling specimens and requisitions. The other part I was the person who got the workstation logged back in, cleared the printer, and kept the equipment talking to the system. I did not think of it as a compliance job. Looking back, it taught me more about HIPAA than any class did.
Patient information is everywhere
Here is the first thing a lab teaches you. Protected health information is everywhere. It is on the requisition stapled to the specimen. It is on the label wrapped around the tube. It is on the report coming off the printer. It is on the screen of the lab information system you are signed into all night. Names, dates of birth, the test that was ordered, sometimes the reason behind the order. That is PHI, all of it, and on the night shift you are the one holding it.
Once you see that, you cannot unsee it. You start noticing every place that information sits and every place it could leak.
The night shift makes it personal
During the day there are a lot of people around. At night there are not. Fewer hands, fewer eyes, and you are often the one who locks up. That changes how you think about the rules. You cannot pass a question down the hall. If a result needs to print, you are the one who walks to the printer and makes sure it is the right report going to the right place. If someone who is not staff is standing somewhere they should not be, you are the one who notices.
That is where I learned what HIPAA actually asks of you. The module teaches you the words. The shift teaches you the moment. A fax dialed one digit wrong. A result left face up on a shared screen. A login someone never signed out of.
The boring controls are the whole game
Most of what protects patient data is unglamorous, and that is the point.
You sign in as yourself, not as someone else, and you do not share a password. You lock the screen when you step away, even at 3am, even when you are the only one there. You look at the information you need to do the task in front of you and nothing more, which is the minimum necessary idea before anyone calls it that. You treat paper like data, so requisitions and printouts get secured or shredded, not left in a tray. And you remember that the system is keeping a log of who opened what, so the lab can answer the question when someone has to.
None of it is complicated. It just takes doing the same thing every shift. The labs and the people who did it well were rarely the ones with the thickest policy manual. They did the small things the same way, every time.
Why it stuck with me
I left the lab, finished my degree, and spent seven years in regulated IT. I have worked in very different environments since. That lesson held. Compliance is not a document you produce once. It shows up in the daily habits, long after the paperwork is filed.
That is the discipline I build into IT now. For healthcare practices it is HIPAA. For small financial offices, it is the FTC Safeguards Rule, which is the same discipline under a different name: know where the sensitive data lives, control who can reach it, write down what you do, and keep doing it. That is what the free 14-Point Safeguards Gap Report checks.
Hammad Arain is the founder of Arain Systems, a Houston security and compliance practice for small financial and medical offices.