Healthcare startup here: Yes, because first/last name are PHI identifiers, and it's possible that even using the product itself could be considered a breach because you don't have control over the data. If the filenames some non-phi unique identifier, you're fine.

What's the difference between sending data within in a file, and having the file named something that is an important data point? None. So naming the file with a PHI field (even MRN!) is a bad idea to begin with.

A good answer would be to not let true patient data leave the hardened production server and be opened in any kind of development environment, ever.

Having somewhat recently started a job developing frontends in health informatics, I'm noticing that programmers need to consider HIPAA far more than I think many realize. Even when working outside the healthcare industry, as may be the case here.

With that filename in majority of cases you're violating HIPAA even within your internal network. The thought processes usually goes, does every person that potentially sees that file name require to know the patients first and last name? Also, even those that do require it should only be accessing it on an as-needed basis (eg. at the time of claim submission, etc) which means it shouldn't be floating around on your filesystem.