HIPAA violations: what counts, the most common examples, and what they cost

HIPAA is three sets of rules, and breaking any one of them is a violation:

• The Privacy Rule decides who may see or receive protected health information (PHI), and gives patients rights over their own records.
• The Security Rule requires administrative, physical and technical safeguards for electronic PHI, starting with a written risk analysis.
• The Breach Notification Rule sets who you tell, and how fast, when unsecured PHI is compromised.

Intent is not required. The lowest civil penalty tier applies when an organization did not know about the violation and could not reasonably have known. A violation by a staff member is a violation by the practice, because the practice is responsible for its workforce. If you are not sure the rules reach you at all, start with who counts as a covered entity.

OCR publishes the compliance issues it investigates most often. In order of frequency, they are:

1. Impermissible uses and disclosures of PHI. Information shared with someone who had no right to it.
2. Lack of safeguards of PHI. Paper and electronic records left where the wrong person can reach them.
3. Lack of patient access to their PHI. Records not provided, provided late, or overcharged for.
4. Lack of administrative safeguards of electronic PHI. No risk analysis, no risk management, no training, no policies.
5. Use or disclosure of more than the minimum necessary PHI. Sending the whole chart when one test result would do.

Two of these have their own enforcement programs. OCR's Right of Access Initiative targets providers that are slow to give patients their records, and its Risk Analysis Initiative targets organizations that never did a proper risk analysis. Both have produced settlements with small practices, not only hospitals.

These are the everyday versions of the list above. None of them needs a hacker.

Civil penalties come from OCR and are set in four tiers in 45 CFR 160.404, by how culpable the organization was:

1. It did not know, and with reasonable diligence would not have known.
2. Reasonable cause, but not willful neglect.
3. Willful neglect, corrected within 30 days.
4. Willful neglect, not corrected within 30 days.

Each tier has a range per violation and a cap per calendar year for identical violations. HHS adjusts the dollar amounts for inflation every year, so check the current table in 45 CFR 102.3 rather than a number quoted in an old article.

Criminal penalties are a Department of Justice matter, for knowingly obtaining or disclosing PHI without authorization. Under 42 U.S.C. 1320d-6 they go up to $50,000 and one year in prison, up to $100,000 and five years when done under false pretenses, and up to $250,000 and ten years when done to sell the information or cause harm. State attorneys general can also bring civil HIPAA actions on behalf of their residents.

In practice, most OCR cases close with technical assistance or a corrective action plan, not a fine. What decides the outcome is what you can show OCR when it asks, which is covered step by step in what an OCR investigation looks like.

No. A breach is an impermissible use or disclosure of PHI that compromises its security or privacy. Under 45 CFR 164.402 it is presumed to be a breach unless a documented risk assessment shows a low probability that the PHI was compromised, using four factors: what the information was, who received it, whether it was actually viewed or acquired, and how far the risk was mitigated.

Many violations are not breaches at all. Having no risk analysis, shared passwords, or a missing BAA is a violation even if no record ever leaves the building. And some incidents are neither: a lost laptop that was encrypted to the HHS standard is not a reportable breach, which is why encryption is the one control that changes the ending.

Anyone can file a complaint with OCR, through its online portal or in writing. The complaint should be filed within 180 days of when the person knew about the problem, and OCR can extend that for good cause. HIPAA forbids retaliating against anyone who files a complaint.

Inside a practice, staff should report to the privacy or security official, who then has three jobs: limit the harm (the Privacy Rule requires mitigation), decide whether it is a breach that needs notification, and apply the sanction policy consistently. Write each step down. A violation you found, fixed and documented reads very differently to OCR than one a patient found first.

1. Do the risk analysis and keep it current. The free HIPAA risk assessment tool is a start.
2. Give every person their own login, only to what their job needs, and review access logs.
3. Encrypt every laptop, phone and server that holds PHI.
4. Sign a BAA before a vendor gets PHI. The Do I need a BAA? checker sorts the vendors that need one.
5. Answer records requests within 30 days, with a reasonable, cost-based fee.
6. Train staff on the real mistakes: wrong recipient, curious lookups, social media and review replies.
7. Write the incident plan before you need it, with the 60-day notification clock in it.

The full list is in the HIPAA compliance checklist. To keep each item tracked between reviews, see HIPAA compliance software that flags gaps before OCR does.