With that filename in majority of cases you're violating HIPAA even within your internal network. The thought processes usually goes, does every person that potentially sees that file name require to know the patients first and last name? Also, even those that do require it should only be accessing it on an as-needed basis (eg. at the time of claim submission, etc) which means it shouldn't be floating around on your filesystem.