HIPAA violation examples: what counts, penalties and how to report

Most HIPAA violations do not start with hackers. They start with a receptionist reading a neighbour’s chart, a laptop left in a car, a reply to a one-star review or a records request that sat in an inbox for three months. This guide explains what counts as a HIPAA violation, walks through common examples by category, sets out the penalties and the reporting route, and shows which controls prevent each one.

By Alex Martyushin, founder & risk consultant · Updated 30 October 2026 · 13 min read

For the overall framework — who HIPAA applies to, the three rules and a full compliance checklist — start with our HIPAA compliance guide. This page goes deeper on one question: what goes wrong in practice, and what to do about it.

What counts as a HIPAA violation?

HIPAA applies to covered entities (health plans, clearinghouses and health care providers that bill electronically) and to their business associates. A violation is a failure to meet any requirement of the rules that apply to them. In practice they fall into four groups:

• Privacy Rule violations — impermissible uses or disclosures of PHI, disclosing more than the minimum necessary, ignoring patient rights such as access, or missing administrative requirements like training and a Notice of Privacy Practices. Our HIPAA Privacy Rule guide explains what is permitted.
• Security Rule violations — no accurate and thorough risk analysis, no risk management plan, missing access controls, audit logs nobody reviews, or unencrypted devices with no documented alternative.
• Breach Notification Rule violations — failing to notify individuals, HHS or the media, or notifying after the 60-day limit.
• Business associate failures — sharing PHI with a vendor without a business associate agreement (BAA), or a business associate using PHI beyond what the agreement allows.

Violation, breach or incident?

The terms are often used interchangeably, but they mean different things — and the difference decides what you have to report.

Every breach involves a violation; most violations are not breaches. Some disclosures are also excluded from the breach definition — for example, an unintentional access by a workforce member acting in good faith and within their authority, with no further use or disclosure.

Common HIPAA violation examples by category

The categories below reflect the recurring themes in OCR’s enforcement and complaint data. Where real cases are mentioned, they are resolution agreements OCR has published.

1. Snooping: accessing records without a work reason

A staff member looks up a celebrity, an ex-partner, a colleague or a family member out of curiosity. Even if nothing is shared, viewing PHI without a treatment, payment or operations reason is an impermissible use. These cases are usually found when the patient asks for an access log or when an audit flags a pattern. In 2023 Yakima Valley Memorial Hospital agreed to pay $240,000 after OCR found that 23 security guards in its emergency department had accessed patient records without a job-related purpose.

Prevent it: role-based access, “break the glass” prompts for sensitive records, regular review of access logs and a sanctions policy that is actually applied.

2. Lost or stolen devices and unencrypted data

A laptop stolen from a car, a USB stick lost on a train, a phone with patient photos left in a taxi. The loss itself is a security incident; the violation is usually the absence of encryption and of a risk analysis that considered the device. In 2020 Lifespan Health System Affiliated Covered Entity agreed to pay $1,040,000 after the theft of an unencrypted laptop, with OCR citing a lack of encryption and device inventory. Encrypted devices, by contrast, generally fall outside breach notification because the PHI is not “unsecured”.

Prevent it: full-disk encryption enforced by device management, a device inventory, remote wipe and a rule against PHI on personal storage.

3. Right-of-access delays and refusals

A patient asks for a copy of their records and waits months, is charged an unreasonable fee or is told to come in person. HIPAA generally requires access within 30 days, with one 30-day extension. OCR’s Right of Access Initiative began in 2019 with a settlement with Bayfront Health St. Petersburg for $85,000 and has since produced dozens of actions, many against small practices — making this one of the most frequently penalised, and most avoidable, violations.

Prevent it: a request log with the 30-day deadline, a single owner, a cost-based fee policy and electronic delivery where the patient asks for it.

4. Social media and online review replies

A nurse posts a photo from the ward with a patient visible in the background; a dentist replies to a negative review by explaining the patient’s treatment. Confirming that someone is a patient is itself a disclosure of PHI. OCR settled with New Vision Dental for $23,000 after the practice repeatedly disclosed patient information — names, treatment and insurance details — in replies to online reviews, and earlier fined another dental practice $10,000 for a single review reply.

Prevent it: a social media policy, a standard non-specific reply for reviews (“we take feedback seriously; please contact the practice manager”) and training with real examples.

5. Misdirected records and communications

Discharge papers handed to the wrong patient, a fax to an old number, an email autocompleted to the wrong address, a bulk mailing where names and addresses were misaligned. Each is an impermissible disclosure and, unless the four-factor assessment shows a low probability of compromise, a reportable breach.

Prevent it: two-identifier checks at hand-over, verified fax and email directories, delayed send or external-recipient warnings, and data loss prevention rules for PHI.

6. No accurate and thorough risk analysis

This is the most frequently cited Security Rule failure. After a ransomware attack, OCR typically asks for the risk analysis first, and finds it missing, years out of date or limited to one system. OCR launched a Risk Analysis Initiative in late 2024, and the settlements announced under it — many following ransomware attacks — centre on this single requirement.

Prevent it: an enterprise-wide risk analysis covering every system and vendor that holds ePHI, kept current as a risk register with owners and dates. Our cybersecurity risk assessment guide shows the method.

7. Other recurring violations

• No business associate agreement with a vendor that handles PHI — increasingly a SaaS, messaging or AI tool adopted without procurement review.
• Improper disposal — paper records in recycling bins, copiers and devices returned or resold without wiping.
• Talking about patients in public areas or with family members without giving the patient a chance to agree or object.
• Texting or emailing PHI through personal accounts or unapproved apps.
• Tracking technologies on patient portals and other authenticated pages that send PHI to advertising or analytics vendors without a BAA or authorisation. (A 2024 federal court ruling limited OCR’s guidance for unauthenticated public pages; portals and logged-in pages remain squarely in scope.)
• Late breach notification beyond the 60-day outer limit, or no notification at all.
• Leaver accounts left active — former staff or contractors still able to log in.

What is not a HIPAA violation

Not every awkward moment is a violation. The Privacy Rule allows:

• Incidental disclosures that happen despite reasonable safeguards, such as a patient overhearing part of a conversation at a nurses’ station.
• Sharing for treatment between providers, which does not need the patient’s authorisation and is not subject to the minimum necessary standard.
• Talking to family or friends involved in care where the patient has had the opportunity to agree or object, or professional judgement says it is in their interest.
• Disclosures required by law or for listed public-interest purposes, such as reporting certain diseases to public health authorities.
• Information held outside HIPAA — for example, an employer’s sick notes held as an employer, or a consumer health app with no covered entity behind it. Other laws may still apply.

HIPAA violation penalties

Civil money penalties are set by culpability. The figures below are the inflation-adjusted amounts published in the Federal Register on 28 January 2026; check the current notice before quoting them.

Caps apply per calendar year to violations of an identical provision, and one investigation often finds several. Most cases end in a resolution agreement: a payment plus a corrective action plan monitored by OCR, typically for two years or more. Many complaints are closed with technical assistance and no penalty when the organisation fixes the issue.

Criminal penalties apply to anyone who knowingly obtains or discloses PHI in violation of HIPAA: up to $50,000 and one year in prison; up to $100,000 and five years under false pretences; and up to $250,000 and ten years with intent to sell or use PHI for commercial advantage, personal gain or malicious harm. The Department of Justice prosecutes these cases. State attorneys general can also bring civil actions, and state privacy laws may add their own penalties.

Consequences for individual employees

Covered entities must have and apply sanctions against workforce members who violate their policies. Depending on severity and intent, that ranges from retraining and a written warning to dismissal, and licensed professionals may also face complaints to their licensing board. Deliberate misuse — selling records, identity theft, stalking — can lead to criminal prosecution of the individual.

How to report a HIPAA violation

After a complaint, OCR checks whether it has jurisdiction and whether the complaint was filed in time, then may close it, give technical assistance, or open an investigation and request documents — the risk analysis, policies, training records, BAAs and access logs. Investigations that find serious or systemic non-compliance lead to a resolution agreement or, less often, a civil money penalty. HIPAA gives individuals no private right to sue, although state laws may.

What to do when you discover a violation inside your organisation

1. Contain it. Retrieve misdirected documents, disable the account, wipe the device remotely, ask the recipient to delete and confirm.
2. Record it. Log the facts, dates, data involved and people affected while they are fresh.
3. Assess it. Decide whether it is a breach using the four factors: nature and extent of the PHI, who received it, whether it was actually acquired or viewed, and how far the risk has been mitigated. Document the reasoning either way.
4. Notify on time if it is a breach, and check state breach laws that may be stricter. Our data breach response plan guide covers the mechanics.
5. Apply sanctions consistently and record them.
6. Fix the cause and update the risk analysis — otherwise the same incident will recur.

How to prevent HIPAA violations: controls that matter

Each common violation has a small number of controls that prevent most of it. Treat them as risks in your HIPAA risk analysis, each with an owner and a review date.

Scores are illustrative on a 5×5 risk matrix. Track a few indicators — unencrypted devices, overdue access requests, accounts without MFA, vendors without a BAA, open sanctions cases — and review them monthly. Phishing and ransomware remain the main routes to large breaches, so pair this with the controls in our ransomware risk guide.