Employee Says a Patient Broke Into Her Car at Work — Then Her Boss Said She Couldn’t Give Police the Name

A Massachusetts worker says she had video showing who broke into her car while she was at work. She knew the person had been inside her workplace right before it happened. She knew what they were wearing, where they came from, and why the timing lined up.

The problem was that her boss and compliance team told her she could not give police the person’s name.

She explained in a Reddit post that she works at a medical and recreational marijuana facility. Her car was broken into the previous week, and she believed the person responsible was a medical patient at the business.

She said she knew it was that specific person because she had video from a nearby business showing them breaking into her car. The person had an electric scooter, a green puffy jacket, and a gray sweatshirt hood. They came from the direction of her store and had been inside the store right before the break-in.

To the employee, the evidence was clear enough to identify them.

But when she tried to move forward, she said her boss and compliance team warned her not to give police the name because the person was a medical patient. They told her the name was protected by HIPAA and other compliance rules, and that they would need a warrant or subpoena before releasing information.

The employee did not think that sounded right.

In her view, HIPAA should not prevent someone from reporting the name of a person who committed a crime against them. She was not trying to disclose a diagnosis, treatment notes, medical history, or anything private about why the person was a medical cannabis patient. She wanted to tell police the name of the person she believed broke into her car.

Still, her workplace had made the risk feel serious.

If she gave the name and got fired for violating policy, she wondered if she would have any wrongful termination case. She felt trapped between reporting a crime properly and keeping her job.

The police did not seem to be helping much either.

She said she had already told police the situation and begged them to get a warrant or subpoena if that was what was needed. But more than a week had passed, and she still had not heard from the detective. When she called again, she said she was told the detective would not be in until Thursday — which sounded like the same kind of delay she had heard before.

That left her feeling abandoned on both sides.

Her company would not help because of compliance concerns. Police had the video but did not seem to be moving quickly. She even contacted a lawyer, but the firm said they could not help because they were a small firm. Out of frustration, she contacted state representatives asking them to consider a law that would clarify what workers can do when they are victims of crimes committed by medical marijuana patients.

That shows how stuck she felt.

This was not simply “my car was broken into.” It became a legal and employment maze. She believed she knew who did it, but the workplace relationship to that person complicated everything. She feared that if she stayed quiet, nothing would happen. If she spoke up, she might lose her job.

In an edit, she clarified that police already had the video of the break-in, though she did not think they had reviewed it carefully. She said the video was not clear enough to identify the person on its own, but it showed the act. The crime had already been reported as soon as it happened.

The comments became a debate over HIPAA, cannabis privacy laws, employer policy, and what she could safely say. Some commenters argued that a dispensary is not necessarily a HIPAA-covered healthcare provider. Others said state medical marijuana privacy rules could still matter, even if HIPAA itself did not.

But the emotional core was simpler than the legal debate.

Her car was broken into while she was at work. She believed a person from the store did it. And the systems around her made her feel like protecting the alleged thief’s privacy mattered more than helping her report the crime.

That is a brutal place to be as an employee.

She was not asking to publish the person’s medical information. She was asking whether being a victim of a crime meant she had to stay silent about the suspect’s name because of where she worked.

Commenters were split on the legal details, but many told her she was right that HIPAA itself likely was not the simple barrier her workplace claimed it was. Several pointed out that marijuana facilities may be governed by state privacy regulations rather than HIPAA in the same way a hospital or doctor’s office would be.

A lot of commenters said she should not casually disclose that the person was a medical patient. Instead, they suggested telling police that management knows the identity of the person seen breaking into her car and asking police to make a formal request.

Several people told her to get her boss or compliance team’s instruction in writing. Commenters said if the company was really telling her not to cooperate with law enforcement after she was victimized, they should be willing to put that position in an email.

Others said she should speak with an employment lawyer or a lawyer familiar with Massachusetts cannabis regulations before giving the name herself, because the risk to her job might be separate from whether police could legally receive the information.

The strongest practical advice was to document everything: the break-in report, the video, the company’s instructions, police delays, and any written communication from compliance. In a case where privacy rules and crime reporting collide, a paper trail matters.