HIPAA Violations: Examples and Penalties

A HIPAA violation is any failure to comply with the Privacy, Security, or Breach Notification Rules. Violations come to light three main ways: a patient complaint, a self-reported breach, or a media story that prompts OCR to open a compliance review. Understanding the common categories helps small clinics focus their compliance program on the risks that actually produce enforcement.

Common categories of violations

OCR case summaries tend to cluster around the same handful of patterns.

• Snooping. Workforce members accessing records of coworkers, family members, celebrities, or neighbors without a job reason. This is a Privacy Rule violation even if the record is never shared.
• Unsecured email and messaging. PHI sent from a personal Gmail account, to the wrong recipient, or through a chat tool that is not covered by a BAA.
• Lost or stolen devices. Unencrypted laptops, phones, or USB drives containing PHI that leave the building and do not come back.
• Improper disposal. Paper charts in a public dumpster, or old hard drives donated without a wipe.
• Impermissible disclosures to family or employers. Sharing PHI without authorization and without a Privacy Rule exception.
• Lack of a risk analysis. Not having a current, documented risk analysis is a Security Rule violation on its own, regardless of whether a breach occurred.
• Right-of-access failures. Not responding to a patient’s request for their records within the required timeframe.

The four-tier penalty structure

HITECH restructured civil money penalties into four tiers based on culpability. HHS adjusts the dollar amounts for inflation and publishes the current figures; the tier structure is stable.

Tier	Culpability level
1	The covered entity did not know and, exercising reasonable diligence, would not have known of the violation
2	The violation was due to reasonable cause and not willful neglect
3	Willful neglect, but corrected within 30 days
4	Willful neglect, not timely corrected

Each tier has a per-violation minimum and a calendar-year cap. Current dollar amounts are published in the Federal Register; always check the current HHS enforcement page rather than relying on an older figure.

How OCR enforcement actually works

A typical enforcement path for a small clinic looks like this:

1. OCR receives a complaint or a breach notification.
2. OCR requests documentation: the risk analysis, policies, training records, BAAs, and the incident timeline.
3. The clinic responds. The documentation quality at this step shapes the rest of the case.
4. OCR resolves technical assistance cases informally, pursues a resolution agreement, or, more rarely, moves to a civil money penalty.

Most cases end with voluntary compliance or a resolution agreement with a corrective action plan. Outright civil money penalties are less common but they happen.

The piece that costs more than the fine

Corrective action plans (CAPs) require years of monitoring, policy rewrites, training audits, and reporting. For a small clinic the administrative cost can exceed the dollar penalty. A working compliance program, with a current risk analysis, training logs, and incident-response documentation, is the cheapest form of defense.

For the incident side, see HIPAA Security Rule Explained and the practical minimum necessary guide.

Where operational tools become a liability

Many cases trace back to tools outside the EHR: a personal email account used to send records, a general-purpose task board that listed patient names, or a file-sharing link to a vendor with no BAA. Keeping PHI inside systems that have BAAs, access controls, and audit trails removes entire categories of risk. That is why PHIGuard ships a BAA at every pricing tier and charges a flat per-clinic rate. See /hipaa or /pricing for specifics.

A short self-check

• Is there a current, documented risk analysis?
• Does every vendor with ePHI access have a signed BAA?
• Are all workforce laptops and phones encrypted?
• Are access rights removed the day an employee leaves?
• Is there a written breach-response process, tested at least annually?

A “no” to any of these is a common pattern in enforcement cases.