My reaction was immediate and visceral: get away from my screen.

I didn't have language for what I was feeling. I hadn't heard the term "shoulder surfing" yet. I didn't know that HIPAA has an entire pillar dedicated to physical safeguards, or that an exposed scheduling system constitutes a potential unauthorized disclosure of protected health information. I just knew, instinctively, that something was wrong — that a stranger reading what was on my screen was a problem that I needed to stop.

That gut feeling turned out to be correct. It just took studying for a cybersecurity career to understand exactly why.

What HIPAA Actually Says About Physical Security

Most people, when they hear HIPAA, think about data breaches, encryption, and breach notification letters. The conversation almost always goes straight to technology. But the HIPAA Security Rule is built on three pillars, not one: administrative safeguards, technical safeguards, and physical safeguards.

Physical safeguards — codified under 45 CFR §164.310 — cover things like workstation use policies, device and media controls, and facility access controls. The regulation requires covered entities to implement policies that govern how workstations are used and positioned, who can physically access systems that store electronic PHI, and how unauthorized access is prevented.

Shoulder surfing is a direct threat to all of that.

A medical scheduling system doesn't just show appointment times. It shows patient names, dates of birth, provider names, appointment types — sometimes the reason for the visit. In a fertility clinic, an oncology practice, or a mental health office, that last field alone is deeply sensitive. A patient glancing at a screen in passing might see nothing they'd recognize as significant. Or they might see a neighbor's name next to a diagnosis code. Either way, the covered entity just had an unauthorized disclosure — and there's no technical control in the world that prevents someone from reading a screen you left open and unattended.

The Password on the Sticky Note

Here's the other thing I saw, regularly: staff writing their login credentials on paper.

Not maliciously. Not carelessly in any conscious sense. They were writing them down because they were working a 9-hour shift, managing phone calls and patient check-ins simultaneously, and the alternative — getting locked out and waiting for an IT reset — cost them time they didn't have. A written password on a notepad tucked under the keyboard was faster. So that's what they did.

This is also a physical safeguard failure. HIPAA's access control requirements under §164.312 mandate that covered entities implement technical policies to allow only authorized persons to access ePHI — but a credential written on a slip of paper that anyone walking behind the desk can read defeats every technical control upstream of it. The password complexity policy, the multi-factor authentication, the role-based permissions — all of it becomes irrelevant the moment the credential is physically exposed.

But here's what I didn't understand at the time, and what I think gets missed in most compliance conversations: the staff weren't the problem. The workflow was.

Security Failures Are Usually Systems Problems

If your staff are writing passwords on paper, the correct diagnosis is not "staff need more training." The correct diagnosis is "the authentication process creates enough friction that staff have found a workaround, and no one has addressed the workaround."

This is the part of GRC — governance, risk, and compliance — that I find genuinely interesting. Rules without usable processes don't get followed. They get bypassed, quietly and consistently, by people who are just trying to do their jobs. A good security program accounts for human behavior. It asks: what does this control actually look like on the floor, at 8:45 AM, when the waiting room is full?

The controls that would actually help in a clinical front-desk environment are not exotic. Privacy filters on monitors facing patient areas. Screen lock policies that trigger after 60–90 seconds of inactivity. A password manager that removes the memory burden without adding login friction. A clean desk policy that's actually enforced, not just mentioned in onboarding. Periodic physical walk-throughs as part of a risk assessment, not just a checkbox on an audit form.

None of those are technically complicated. All of them require someone to understand what the floor looks like — to have been inside the environment they're trying to secure.

Why I'm Telling This Story

I'm moving into cybersecurity. I have my CompTIA Security+, Pentest+, and a handful of other certifications. I'm building labs, doing CTFs, working toward a career in GRC or security analysis in the healthcare space.

But the reason I'm drawn to this work isn't the certs. It's that I spent years inside an environment where I could see the gap between what the policy said and what actually happened — and I cared about closing it even before I had a name for what I was trying to do.

Healthcare security is hard because the stakes on both sides are real. If you lock down access too aggressively, patient care suffers. If you don't lock it down enough, patient privacy does. Getting that balance right requires people who understand both sides of the desk.

I've been on one of those sides. I'm training for the other.

Angelina Anisimova is a cybersecurity professional in training, currently pursuing her first role in GRC and healthcare security after graduating from Western Governors University. She holds seven certifications and previously worked as a Medical Assistant.

Connect on LinkedIn | GitHub | TryHackMe