Yes it was a hipaa violation. The email may not have had the name of the patient on it, but it was enough information that the secretary could identify who she was talking about. Once the secretary shared the information with someone who did not need to know the information to provide care for the patient, it was a hipaa violation. The lady upstairs may have been concerned about the pt, but it was no longer her business to know anything about that patient once they were transferred.