HIPAA guide: rules, violations, penalties and a compliance checklist

If you run a clinic, a dental practice, a billing company or a software product that handles patient data for US healthcare organisations, HIPAA applies to you. This guide explains what HIPAA is, who it covers, what the Privacy, Security and Breach Notification Rules require, what violations look like in practice, current penalty amounts, and how to run the HIPAA risk analysis as a living risk register.

By Alex Martyushin, founder & risk consultant · Updated 30 October 2026 · 18 min read

What is HIPAA, and what does it stand for?

HIPAA stands for the Health Insurance Portability and Accountability Act, signed into law in August 1996. (It is frequently misspelt “HIPPA”.) The original law dealt with keeping health insurance when changing jobs and with fraud. Its Administrative Simplification provisions required standard electronic healthcare transactions and directed HHS to adopt privacy and security protections for health data. Those became the rules most people mean when they say “HIPAA”:

The HITECH Act of 2009 strengthened HIPAA: it created the breach notification requirement, made business associates directly liable, raised penalties and allowed state attorneys general to enforce. The 2013 Omnibus Rule implemented most of these changes.

HIPAA timeline: when it was enacted and how it grew

People often ask when HIPAA started. The law itself is from 1996, but most of the obligations arrived years later, as HHS issued the rules under it:

Who HIPAA applies to

Covered entities

• Health plans — health insurers, HMOs, company health plans, and government programmes such as Medicare and Medicaid.
• Health care clearinghouses — entities that convert non-standard health information into standard formats, such as billing services that process claims data.
• Health care providers — doctors, clinics, hospitals, dentists, pharmacies, therapists, nursing homes and others — but only if they transmit health information electronically in connection with a standard transaction, such as billing insurance. In practice most providers who accept insurance qualify.

Business associates

A business associate is a person or organisation that creates, receives, maintains or transmits PHI on behalf of a covered entity, or provides certain services involving PHI. Examples: cloud hosting and EHR vendors, billing and coding companies, IT managed service providers, transcription services, shredding companies, law firms and accountants with access to PHI, and SaaS products used by clinics. Subcontractors of business associates that handle PHI are business associates too.

Business associates are directly liable for complying with the Security Rule, for impermissible uses and disclosures, and for breach notification to the covered entity. A business associate agreement (BAA) must be in place before PHI is shared.

Who HIPAA does not cover

HIPAA protects health information held by covered entities and business associates — not all health data. A fitness app selling directly to consumers, an employer’s HR records (such as sick notes held as an employer) and most wearables are generally outside HIPAA, although other laws may apply, including the FTC Act, the FTC Health Breach Notification Rule and state health privacy laws. Organisations outside the US are only caught if they act as a business associate for a US covered entity, usually by contract.

What does HIPAA protect? PHI and the 18 identifiers

HIPAA protects protected health information (PHI): information about a person’s past, present or future physical or mental health, the care they received, or payment for that care, which identifies them or could reasonably be used to identify them — and which is created or held by a covered entity or business associate. Diagnoses, test results, prescriptions, appointment histories, insurance claims and billing records are all PHI once they are linked to a person. Electronic PHI (ePHI) is the subset the Security Rule covers.

The identifiers that make health information “individually identifiable” are listed in the Safe Harbor de-identification method. Removing all 18 (and having no actual knowledge that the rest could identify someone) is one way to take data outside HIPAA:

• Names; geographic units smaller than a state, including street address and most of the ZIP code; all elements of dates (except year) relating to the person, and ages over 89.
• Telephone and fax numbers; email addresses; web URLs; IP addresses.
• Social Security numbers; medical record numbers; health plan beneficiary numbers; account numbers; certificate or licence numbers.
• Vehicle identifiers, including licence plates; device identifiers and serial numbers.
• Biometric identifiers such as finger and voice prints; full-face photographs and comparable images.
• Any other unique identifying number, characteristic or code.

Some health-related information is not PHI: employment records held by a covered entity in its role as an employer, education records covered by FERPA, and data that has been properly de-identified. Health data held by companies outside HIPAA altogether, such as many consumer apps, may still be protected by FTC rules and state privacy laws.

The HIPAA Privacy Rule

The HIPAA Privacy Rule governs protected health information: individually identifiable health information held or transmitted in any form — electronic, paper or oral — by a covered entity or business associate. It covers demographic data too: a name, address or appointment date linked to care is PHI.

Uses and disclosures

• Permitted without authorisation — for treatment, payment and health care operations, and for specific public-interest purposes such as certain public health reporting, law enforcement requests that meet conditions, and situations required by law.
• Requires written authorisation — most other uses, including most marketing and any sale of PHI.
• Minimum necessary — use, disclose or request only the minimum PHI needed for the purpose (with exceptions such as disclosures for treatment).
• De-identified data is not PHI. HIPAA allows two methods: removing 18 specified identifiers (Safe Harbor) or a qualified expert’s determination that re-identification risk is very small.

Individuals’ rights

• Receive a Notice of Privacy Practices.
• Access and obtain copies of their records, generally within 30 days (one 30-day extension allowed), for a reasonable cost-based fee. OCR’s Right of Access Initiative has produced a long series of enforcement actions against providers who were slow or refused.
• Request amendments, an accounting of disclosures, restrictions and confidential communications.
• Complain to the covered entity and to OCR.

Administrative requirements

A covered entity must designate a privacy official, train its workforce, apply sanctions for violations, put safeguards in place, handle complaints, mitigate harm and keep documentation for six years.

A note on recent changes: HHS added protections for reproductive health care information in 2024, but a federal court in Texas vacated most of that rule in June 2025. Separately, rules aligning 42 CFR Part 2 (substance use disorder records) more closely with HIPAA took effect in 2024, with compliance required from February 2026. Check current OCR guidance if either applies to you.

The HIPAA Security Rule

The Security Rule applies only to electronic PHI and requires covered entities and business associates to ensure its confidentiality, integrity and availability, protect against reasonably anticipated threats and impermissible uses, and ensure workforce compliance. It is flexible and scalable: a solo practice and a hospital system meet the same standards in different ways.

Implementation specifications are either required or addressable. “Addressable” does not mean optional: you must implement it if reasonable and appropriate, or document why not and what equivalent measure you use. Encryption is the classic example — and unencrypted laptops have been behind many enforcement actions.

The proposed Security Rule update

In January 2025 HHS published a notice of proposed rulemaking to overhaul the Security Rule. Among other things it proposed removing the distinction between required and addressable specifications, and making specific controls mandatory, including a technology asset inventory and network map, encryption of ePHI at rest and in transit, multi-factor authentication, regular vulnerability scanning and penetration testing, annual compliance audits, and restoration of certain systems within 72 hours.

Status as at 30 October 2026: the rule has not been finalised. Trade press reports that the federal regulatory agenda moved the expected final rule from May 2026 to July 2027 and reclassified it as a longer-term action. Agency timetables are not binding, and the final text may differ from the proposal or not appear at all. The current Security Rule remains in force. Even so, the proposed controls are a sensible benchmark — most of them are what a cybersecurity risk assessment would recommend anyway.

The Breach Notification Rule

A breach is an impermissible acquisition, access, use or disclosure of PHI that compromises its security or privacy. It is presumed to be a breach unless a documented risk assessment shows a low probability that the PHI has been compromised, considering the nature of the data, who received it, whether it was actually acquired or viewed, and how far the risk has been mitigated. Notification applies to unsecured PHI — data encrypted to HHS guidance is generally exempt.

State breach laws may impose shorter deadlines or extra content. Ransomware is a frequent cause: OCR’s position is that encryption of PHI by ransomware is presumed to be a breach unless the low-probability assessment shows otherwise. See our data breach response plan and ransomware risk guides for the operational side.

HIPAA violation examples

Most HIPAA violations are not dramatic hacks; they are ordinary failures that OCR finds when investigating a complaint or a breach report. Common patterns in OCR enforcement:

• No accurate and thorough risk analysis — the most frequently cited Security Rule failure. OCR launched a Risk Analysis Initiative in late 2024 and has since announced a series of settlements focused on it, many following ransomware attacks.
• Denying or delaying patient access to records — the focus of the Right of Access Initiative, which has produced dozens of penalties and settlements against providers, including small practices.
• Lost or stolen unencrypted devices — laptops, USB drives and phones holding ePHI.
• No business associate agreement with a vendor handling PHI.
• Impermissible disclosures — discussing a patient on social media or with the press, responding to an online review with treatment details, or sending records to the wrong recipient.
• Snooping — staff viewing records of celebrities, colleagues or family without a work reason, undetected because nobody reviews access logs.
• Improper disposal — paper records in ordinary bins, or devices resold without wiping.
• Tracking technologies — analytics or advertising pixels on patient portals and appointment pages that send PHI to third parties without authorisation.
• Late breach notification beyond the 60-day limit.

Large cases show the scale at the top end: Anthem paid $16 million in 2018 to settle potential violations after a cyber attack that exposed data on almost 79 million people, and the 2024 ransomware attack on Change Healthcare became the largest healthcare data breach reported to HHS, affecting well over 100 million people. But many enforcement actions involve single-site practices and five-figure amounts.

HIPAA penalties

Civil money penalties depend on the level of culpability. HHS adjusts the amounts for inflation; the figures below are those published in the Federal Register on 28 January 2026. Reports differ on whether a further adjustment will be made in 2026, so check the current notice before quoting them.

Caps apply per calendar year to violations of an identical provision; an investigation often finds several provisions breached. In practice most cases end in a resolution agreement: a settlement payment plus a corrective action plan, typically monitored by OCR for two or more years.

Criminal penalties, prosecuted by the Department of Justice, apply to knowingly obtaining or disclosing PHI in violation of HIPAA: up to $50,000 and one year in prison; up to $100,000 and five years if under false pretences; and up to $250,000 and ten years if done with intent to sell, transfer or use PHI for commercial advantage, personal gain or malicious harm. State attorneys general can also bring civil actions.

Who enforces HIPAA?

The HHS Office for Civil Rights (OCR) enforces the Privacy, Security and Breach Notification Rules: it investigates complaints and breach reports, carries out compliance reviews and audits, and agrees resolution agreements or imposes civil money penalties. The Department of Justice prosecutes criminal violations. Since HITECH, state attorneys general can bring civil actions on behalf of residents, and several have done so after large breaches. The Centers for Medicare & Medicaid Services handles the non-privacy Administrative Simplification standards, such as electronic transaction and code set rules. HIPAA itself gives patients no private right to sue, but they can complain to OCR, and state laws or contracts may give them other routes.

HIPAA-compliant software: what to check

Questions such as “is Zoom HIPAA compliant?” or “is ChatGPT HIPAA compliant?” are among the most searched HIPAA questions. The honest answer is that no product is HIPAA compliant on its own. What matters is whether you can use it with PHI lawfully, and that depends on three things:

• A business associate agreement. If the vendor will create, receive, store or transmit PHI for you, it is a business associate and must sign a BAA before any PHI goes in. Many vendors offer a BAA only on specific business, enterprise or healthcare plans; free and consumer versions of video, messaging, email and AI chat tools generally come without one.
• The right configuration. Even with a BAA, you are responsible for settings: encryption, access controls, MFA, audit logging, retention, recording and sharing options, and which features are covered by the agreement.
• Where the data actually flows. Staff pasting patient details into an AI assistant, texting photos of records, or using a web form or analytics tag that sends data to a third party can create a disclosure without anyone choosing a new vendor.

Keep a register of tools that touch PHI, with BAA status and an owner, and treat any tool without a BAA as a risk in your analysis. The vendor review itself is a third-party risk assessment scaled to how much PHI the tool sees.

HIPAA compliance checklist

A practical checklist for a small covered entity or business associate. Each gap goes into your risk analysis with an owner and a date.

Roles and documentation

• ☐ Confirm whether you are a covered entity, a business associate, or both — and for which services.
• ☐ Designate a privacy official and a security official (one person can hold both in a small organisation).
• ☐ Write policies and procedures for the Privacy, Security and Breach Notification Rules; keep documentation for six years.
• ☐ Covered entities: publish and distribute a current Notice of Privacy Practices.

Risk analysis and management

• ☐ Inventory every system, device and vendor that creates, receives, maintains or transmits ePHI.
• ☐ Carry out an accurate and thorough risk analysis across all ePHI (see below).
• ☐ Implement a risk management plan that reduces risks to a reasonable and appropriate level, with owners and dates.
• ☐ Review the analysis at least annually and after significant changes — new EHR, office move, merger, major incident.

Safeguards

• ☐ Unique user IDs; no shared logins; multi-factor authentication for remote and email access.
• ☐ Encrypt laptops, mobile devices, removable media and ePHI in transit.
• ☐ Role-based access with the minimum necessary; prompt removal of leavers.
• ☐ Audit logging, and someone who actually reviews access to sensitive records.
• ☐ Patch systems and run vulnerability scans — see vulnerability management process.
• ☐ Backups, including an offline or immutable copy, and a tested restore.
• ☐ Contingency and disaster recovery plan with downtime procedures.
• ☐ Secure disposal of paper and media.
• ☐ Review tracking pixels and third-party scripts on patient-facing web pages.

People and vendors

• ☐ Train all workforce members on hire and periodically; record attendance.
• ☐ Apply and document sanctions for violations.
• ☐ Sign BAAs with every business associate before sharing PHI; keep a register of them.
• ☐ Assess high-risk vendors’ security in proportion to their access.

Patient rights and breaches

• ☐ Process for access requests that meets the 30-day limit, with a fee policy.
• ☐ Processes for amendments, accounting of disclosures and complaints.
• ☐ Breach response procedure: investigate, perform the four-factor risk assessment, document, notify within deadlines.
• ☐ Breach log for incidents affecting fewer than 500 people, submitted to HHS annually.

HIPAA risk analysis as a risk register

The Security Rule’s first required implementation specification is the risk analysis: an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of all ePHI you hold. The second is risk management: implementing measures to reduce those risks. HHS and the Office of the National Coordinator for Health IT publish a free Security Risk Assessment Tool aimed at small and medium-sized providers.

The most common failure is treating the analysis as a one-off document — a vendor questionnaire completed years ago, then filed. OCR expects it to be enterprise-wide, current and connected to action. The simplest way to achieve that is to keep it as a risk register: each threat–vulnerability pair to ePHI is a risk with likelihood, impact, existing controls, planned treatment, owner and review date.

Scores are illustrative on a 5×5 matrix. Kept this way, the analysis also gives you indicators to watch: devices without encryption, accounts without MFA, overdue access requests, vendors without a BAA, days since the last successful restore test. If you also handle card payments or EU patients, the same register can hold your GDPR and PCI DSS risks, so one review covers them all.

Common mistakes

• Thinking HIPAA compliance can be certified. There is no official HIPAA certification; third-party attestations can help, but OCR looks at what you actually do.
• Risk analysis done once. It must be kept current and drive a risk management plan.
• Assuming “addressable” means optional. Decide and document.
• Forgetting paper and conversations. The Privacy Rule covers all forms of PHI.
• Vendors without BAAs, especially new SaaS and AI tools.
• Slow patient access. It is one of the easiest violations to avoid and one of the most often penalised.