Your facility's computer system most likely has an audit trail that the facility security officer or privacy officer can access to verify that Dr. A accessed Dr. B's patient files. The violation should be reported to the facility privacy officer for investigation. A copy of the Notice of Privacy Practices should be posted near the entrance to the facility and will include a phone number to show where privacy violations should be reported. This is a HIPAA violation if Dr. A was not caring for the patient. HIPAA allows access for treatment, payment and operations (TPO). Other than that, unless a disclosure is required by law, a signed authorization from the patient is needed.