Yes it was a hipaa violation. The email may not have had the name of the patient on it, but it was enough information that the secretary could identify who she was talking about. Once the secretary shared the information with someone who did not need...