HIPAA Violation Examples: What Counts and What Does Not
Real examples of HIPAA violations, the current penalty tiers, and the question most guides skip: whether HIPAA applies to your business at all.
Almost every article on this subject is a list of twenty violations written for a hospital compliance officer. The lists are accurate, but they skip the two questions employers actually have, and this guide answers both: whether the Health Insurance Portability and Accountability Act (HIPAA) applies to your business at all, and whether what just happened at your workplace was really a HIPAA problem.
The federal health department answers the first one itself: employment records fall outside HIPAA's Privacy Rule even when the information in them is health related, and in most cases the rule does not apply to what an employer does. If your business is like the overwhelming majority of employers, the sick notes, accommodation paperwork, and workers compensation files you hold sit outside HIPAA entirely.
That does not mean the information is unprotected. It means a different set of laws governs it, and confusing the two produces both false alarms and real exposure in the places nobody is looking. Beyond those answers, you get the examples, the penalty tiers with the caps federal enforcement actually applies rather than the published ones, and real cases with amounts.
You also get the part the healthcare-focused pages leave out: a three-question coverage test, a list of things that are not HIPAA violations and what law governs them instead, and the specific HR scenarios worth watching. I build employee records tooling at FirstHR, so the access and records half of this is the part I work on daily.
What Counts as a Violation
A HIPAA violation is any failure by a covered entity or one of its business associates to comply with the Privacy, Security, or Breach Notification Rules. Intent plays no part in whether a violation occurred, which is why accidental disclosures appear throughout federal enforcement history.
The federal health department's Office for Civil Rights enforcement highlights (October 2024) rank the compliance issues most often alleged in complaints. In order of frequency, they are impermissible uses and disclosures of protected health information, lack of safeguards for that information, lack of patient access to their own records, lack of administrative safeguards for electronic information, and use or disclosure of more than the minimum necessary.
Two things follow from that ordering. The largest category is not hacking but people telling other people things they should not have. And the third category surprises most readers: refusing or delaying someone's access to their own records is itself a violation, and a dedicated enforcement initiative on it has reached small practices as well as hospital systems.
Does It Apply to You
Before reading any list of violations, settle whether the rule reaches your business. For most employers it does not, and assuming otherwise is the single most consequential misunderstanding in the entire subject.
The federal health department addresses this directly in guidance on employers and health information in the workplace, stating that the Privacy Rule does not protect employment records even where the information in them is health related, and that in most cases the rule does not apply to the actions of an employer.
In practice, you can ask an employee for a note from a doctor covering sick leave, workers compensation, a wellness program, or health insurance without HIPAA being involved at all.
What the rule does control is the other direction: whether a health plan or a covered provider may share information about an employee with you. If you ask the provider directly, it generally cannot answer without the employee's authorization. The obligation sits on the provider, not on the question.
Three situations bring an ordinary business inside the rules.
Nick Anisimov, FirstHR founderWhat Is Not a Violation
Most workplace situations that get called HIPAA violations are not. Each row below but the last is one of them, with the law that actually governs it: usually the Americans with Disabilities Act (ADA), the Family and Medical Leave Act (FMLA), the Genetic Information Nondiscrimination Act (GINA), or state law. This table resolves more real disputes than the examples list does.
| The situation | A HIPAA violation? | What actually governs it |
|---|---|---|
| Your employer asks for a doctor's note | No | Employment record. State law and company policy apply |
| A manager tells the team why you were absent | No | Confidentiality obligations, including the ADA rule for medical details an employee disclosed or was asked for |
| HR keeps your accommodation paperwork | No | The Americans with Disabilities Act requires it be kept confidential and separate |
| Your employer asks about a family medical history | No | The Genetic Information Nondiscrimination Act, which restricts this sharply |
| A coworker asks why you were in the hospital | No | Nothing legal. It is a workplace conduct matter |
| A business requires proof of vaccination to enter | No | The rule restricts providers and plans, not businesses asking questions |
| Your employer sees your leave certification | No | FMLA confidentiality rules require separate, restricted storage |
| A workers compensation insurer receives your records | Usually no | State workers compensation law, which often authorizes the disclosure |
| Your clinic tells your employer your diagnosis without consent | Yes | This is the direction HIPAA actually restricts |
The last row shows what a real one looks like. HIPAA restricts what a plan or a provider may disclose, not what an employer may ask or hold. Once that is clear, most workplace disputes about health information reveal themselves as questions about the Americans with Disabilities Act or about FMLA confidentiality, both of which impose real requirements that get missed precisely because everyone is arguing about the wrong statute.
The same confusion reaches wellness programs and employee assistance programs, both of which sit under different rules than most people assume.
For an employer, the practical consequence is a filing rule. Medical information you hold about employees belongs in a separate, access-restricted file rather than in the general personnel file, and several of those separations are legally required even though none of them come from HIPAA.
Common Examples
Six categories sit behind the issues federal enforcement cites most often. Read them as failure modes rather than as a list of prohibited acts.
| Example | Category | Why it is a violation | Usually preventable by |
|---|---|---|---|
| Looking up a celebrity's chart out of curiosity | Snooping | No treatment, payment, or operations purpose | Access logs plus a sanctions policy people believe in |
| Discussing a patient by name in an elevator | Disclosure | Overheard by people with no right to the information | Training, and a rule about where clinical conversations happen |
| Posting a photo with a chart visible in the background | Disclosure | Identifying information published to the world | A social media policy that says this specifically |
| A laptop stolen from a car, not encrypted | Safeguards | Failure to implement reasonable protection | Full disk encryption on everything, without exception |
| An email to the wrong client with an attached list | Disclosure | Impermissible disclosure regardless of intent | External send warnings and a pause before attaching |
| Records dumped in a dumpster during an office move | Disposal | No reasonable safeguard at end of life | Naming a person responsible for disposal |
| A former employee's login still active | Access control | Access retained without authorization | Offboarding that removes access the same day |
| Refusing a patient a copy of their own record | Right of access | A distinct and heavily enforced obligation | A written request process with a clock on it |
| Website analytics transmitting patient data to a third party | Disclosure | Information shared without authorization | Auditing what your site sends and to whom |
Unintentional Violations
Intent is not required, which surprises people and explains a large share of enforcement. The question is never whether someone meant it; it is what safeguards existed and whether the incident was handled properly afterward.
| Accidental incident | Does it still count? | What determines the outcome |
|---|---|---|
| Misdirected email or fax | Yes | How quickly it was caught, contained, and notified |
| Lost unencrypted device | Yes, and heavily | Encryption would usually have made it a non-event |
| Overheard conversation | Yes, technically | Whether reasonable safeguards were in place, not whether anyone listened |
| Wrong record opened and closed immediately | Possibly not | Unintentional access by staff in good faith, within their authority, that goes no further is excluded from the breach definition |
| A colleague seeing a screen in passing | Usually not | Incidental disclosure is tolerated where reasonable safeguards exist |
| Sending records to a former employee's address | Yes | An address list nobody maintained is a safeguards failure |
Two rows carry the useful nuance: the overheard conversation and the screen seen in passing. The rules allow for incidental disclosures that happen despite reasonable safeguards and do not treat them as violations. That is why a conversation partially overheard in a properly designed space is different from one conducted loudly in a public lobby. The distinction is the safeguards, not the outcome.
Violation vs Breach
The two words are used interchangeably in ordinary speech and mean different things in the rules. Every breach is a violation; most violations are not breaches.
| Violation | Breach | |
|---|---|---|
| What it is | Any failure to comply with the rules | Impermissible acquisition, access, use, or disclosure that compromises security or privacy |
| Requires information to be exposed | No | Yes |
| Notification required | Not inherently | Yes, to individuals and to the federal regulator |
| Timing | No notification clock | Individuals without unreasonable delay and within 60 days; large breaches reported concurrently |
| Presumption | Established by investigation | An impermissible disclosure is presumed a breach unless a risk assessment shows low probability of compromise |
| Example | No risk analysis on file | A stolen unencrypted laptop with records on it |
The presumption in the fifth row is the operationally important one. When something impermissible happens, the default assumption is that it is a breach, and the way out is the documented four-factor risk assessment the breach definition spells out rather than a judgment call nobody wrote down. Organizations that skip the documentation lose the argument later even when the underlying assessment was reasonable.
Large breaches are published on the federal breach reporting portal, which is worth looking at once to see what fills it. According to the Office for Civil Rights breach report to Congress (2024), hacking incidents made up 81% of breaches affecting 500 or more people. Among the smaller breaches that never reach that list, unauthorized access or disclosure was the most common type.
HIPAA breach examples
Outside the hacking incidents, reported breaches are far more ordinary than the word suggests. The rows below are everyday shapes that recur in breach reports, listed with the fact that decides whether notification is owed rather than with the story of how each one happened.
| Incident | Notification owed? | What decides it |
|---|---|---|
| A statement mailed to the wrong household | Yes | Identifiable information reached someone with no right to it, and mail cannot be recalled |
| A mail merge that shifted by one row across a whole mailing | Yes, for everyone affected | The count is the number of records misdirected, not the number of people who complain |
| A shared mailbox left readable by the whole team for months | Yes | Access far wider than any role required, and the duration is what makes it indefensible |
| Paper charts left in a bin during an office move | Yes | Disposal with no safeguard exposes every file in the box |
| A vendor under a signed agreement loses a data export | Yes | The business associate reports it to you, and you report onward on the same clock |
| A departed employee still downloading after the last day | Yes | Access without authorization, and the log is what establishes the window |
Every one of the six is preventable by somebody owning a step rather than by a security product: the address list, a test run before the mailing, the mailbox permissions, the disposal, the vendor agreement, the deprovisioning. That pattern is why preventing breaches like these in a small organization is an administrative exercise more than a technical one.
Penalties and Tiers
Civil penalties run in four tiers determined by culpability, meaning how much the organization knew and how it responded, and the amounts are adjusted for inflation annually. The figures below are the ones the federal health department's penalty table at 45 CFR 102.3 carries after the adjustment effective January 28, 2026.
| Tier | Culpability | Minimum per violation | Maximum per violation | Published annual cap |
|---|---|---|---|---|
| 1 | Did not know and could not reasonably have known | $145 | $73,011 | $2,190,294 |
| 2 | Reasonable cause, not willful neglect | $1,461 | $73,011 | $2,190,294 |
| 3 | Willful neglect, corrected within 30 days | $14,602 | $73,011 | $2,190,294 |
| 4 | Willful neglect, not corrected | $73,011 | $2,190,294 | $2,190,294 |
Now the part most penalty tables get wrong. The published annual cap in the Federal Register adjustment is the same figure for all four tiers, but that is not what enforcement actually applies.
In April 2019 the regulator issued a notification of enforcement discretion, a formal notice of how it will apply these penalties. Since then, it has read the underlying statute as setting a separate and much lower annual cap on each of the first three tiers.
The notice puts those limits at $25,000, $100,000, $250,000, and $1,500,000 across the four tiers, before the annual inflation adjustment that turns the top figure into the published $2,190,294. The gap between the printed cap and the applied one is wide. No adjusted amounts have been published for the lower three tiers, so no official figure pins those caps down.
Criminal penalties sit on a separate track and apply to individuals as well as organizations. The criminal provision sets up to $50,000 and one year for knowingly obtaining or disclosing information, and up to $100,000 and five years where the offense involves false pretenses.
The top criminal tier, up to $250,000 and ten years, applies where the offense is committed with intent to sell, transfer, or use the information for commercial advantage, personal gain, or malicious harm.
Kelly KapoorCustomer ServiceUp to Date
Darryl PhilbinWarehouseNeeds Attention
Ryan HowardSalesUp to DateReal Enforcement Cases
The cases are more instructive than the categories, because they show what actually attracts a penalty and how ordinary the underlying failures usually are.
| Case | Amount | What happened | The lesson |
|---|---|---|---|
| A large health system | $865,500 | Employees repeatedly viewed celebrity records with no work reason | Snooping is an access control failure, not just a personnel matter |
| A medical center | $4.75 million | An employee took patient data over several months undetected | The detection gap mattered more than the theft |
| A university medical center | $3 million | A lost unencrypted flash drive and a stolen unencrypted laptop | Encryption would likely have prevented both entirely |
| A medical supplies company | $3 million | A phishing attack exposed data on more than 114,000 people | Phishing counts as hacking, the largest category of large breaches |
| A health insurer | $16 million | Cyberattacks exposed the records of almost 79 million people | The largest settlement of its kind |
| A small primary care practice | $20,000 | A family member waited nearly five months for a deceased patient's records | Right of access enforcement reaches practices of any size |
The last row of the table is the one small organizations should read twice. A dedicated initiative has pursued small providers for failing to give patients copies of their own records, and the settlement record does not support the assumption that regulators only chase large institutions.
Individuals face consequences too. A former hospital researcher who kept reading patient records after he was terminated was sentenced to four months in federal prison, in what the Justice Department called the first conviction and incarceration in the country for a misdemeanor offense under these rules. Access that was never removed can be a personal failure as well as an organizational one.
HR Scenarios to Watch
If your business does sit inside the rules through a plan, a clinic, or business associate work, these are the situations where the line gets crossed without anyone intending to.
| Scenario | The risk | What to do |
|---|---|---|
| Self-insured plan administration | Plan information reaching people who make employment decisions | A documented firewall, and access limited to named plan administrators |
| Wellness program data | Health data flowing back to managers in identifiable form | Aggregate reporting only, and confirm what the vendor sends you |
| Employee assistance program | The program may itself be a covered provider | Confirm status with the provider and check the agreement |
| Onsite clinic records | Clinic records treated as employment records | Keep them separate in both storage and access |
| Vendors handling plan data | Business associate obligations nobody has read | Know which agreements you have signed and what they commit you to |
| Departures | Access to plan or clinic systems surviving the last day | Deprovision on the day, from a single checklist |
The first row separates a compliant sponsor from a non-compliant one, and the problem is structural rather than technical. In a small company with a covered plan, the person administering it often also makes hiring and firing decisions, so the required separation is genuinely hard. Where it cannot be achieved internally, moving administration to a third party is a legitimate answer.
The last row is the cheapest to fix and the most commonly missed. Access that outlives employment appears in enforcement actions repeatedly, and it is eliminated entirely by treating deprovisioning (shutting off every account the person used) as a step on the offboarding checklist rather than as something to remember.
Examples of HIPAA violations by employers
When an employer does violate the rules, it is almost always through the plan, the clinic, or business associate work rather than through ordinary management. Each example below starts with a business that genuinely is covered for part of what it does, and ends with the covered part leaking into the uncovered part.
| What the employer did | Which hat they were wearing | Why it crosses the line |
|---|---|---|
| Used claims data from the self-insured plan to question someone about a diagnosis | Plan sponsor | Plan information crossed into the employment side, which is the one separation the rules demand |
| Let the onsite clinic tell a supervisor the reason for restricted duty | Health care provider | The clinic is a covered provider, and a supervisor is not part of treatment, payment, or operations |
| Accepted identifiable wellness results from a vendor and filed them with performance notes | Plan sponsor | Identifiable results should never have left the vendor, and the filing compounds it |
| Ran plan enrollment through a vendor with no business associate agreement in place | Plan sponsor | The agreement is the mechanism the rules work through, and its absence is itself the failure |
| Kept a departed benefits administrator active in the plan portal for months | Plan sponsor | Access without authorization, on the system where the plan data actually sits |
| Held health data for another company under contract and stored it unencrypted | Business associate | Liability attaches directly to the associate, not only to the covered entity that hired it |
None of the six involves a manager repeating something in a meeting, which is the scenario most people picture when they use the phrase. That behavior is a real problem and a different one, governed by the confidentiality rules in the table further up this page rather than by anything that would lead a federal investigator to open a HIPAA file.
How to Prevent Them
Six actions cover most of the realistic exposure for a small organization. They are unglamorous and they are what the enforcement record actually rewards.
The first, fifth, and sixth of those steps produce documents rather than habits, and the workbook below is where they go.
| A | B | C | D | E | |
|---|---|---|---|---|---|
| 1 | Question | Yes or no | If yes, what is covered | Who confirmed | Date |
| 2 | Do we sponsor a self-insured group health plan | The plan, not the employer function (except a plan with fewer than 50 participants that you administer yourself) | |||
| 3 | Do we sponsor a fully insured plan only | Lighter obligations, mostly on the insurer | |||
| 4 | Do we operate an onsite clinic or occupational health service | The clinic if it bills electronically | |||
| 5 | Do we run an employee assistance program that bills electronically | That program | |||
| 6 | Do we handle health information on behalf of another company | Us, as a business associate | |||
| 7 | Have we signed any business associate agreement | Whatever the agreement covers | |||
| 8 | If all answers are no | HIPAA likely does not govern our employee health data |
The first sheet answers the coverage question and dates the answer. The second maps every category of employee health information you hold against which law governs it and whether it must be stored separately. That map is the artifact that resolves nearly every workplace argument on this topic before it starts.
The third sheet is the incident log, which matters mainly because the version written afterward from memory is worth much less than the one written on the day.
Access and records discipline is the through-line across all six steps, and it is also ordinary document management practice rather than anything HIPAA-specific. If you already keep employee records with role-based access, dated acknowledgments, and a clean offboarding routine, you have most of this whether or not you are covered.
How to Report One
You can raise a suspected violation with the organization's privacy officer, file a written complaint with the federal regulator, or do both. The formal route runs on a defined process with a clock attached, and one feature of the law surprises nearly everyone.
| Step | What happens | Timing |
|---|---|---|
| Raise it internally with the privacy officer | Many issues resolve here, and covered entities must have a complaint process | As soon as practical |
| File a complaint with the federal regulator | Submitted through the complaint portal, in writing | Generally within 180 days of when you knew or should have known |
| Investigation or technical assistance | Where a problem is found, corrective action is the usual outcome and penalties are rare | Varies widely |
| Retaliation protection | Retaliation against someone who files is prohibited | Applies throughout |
| No private lawsuit under the statute | An individual cannot sue under HIPAA itself | Other claims under state law may still exist |
The last row is the surprise. HIPAA creates no private right of action, so an individual who believes their information was mishandled cannot sue under it. Claims still arise, but under state privacy law, negligence, or contract rather than the federal statute. This is worth knowing before anyone in a workplace dispute reaches for the word HIPAA.
For an employer on the receiving end of an internal complaint, the useful sequence is the same regardless of whether HIPAA applies: establish what information was involved, establish who saw it, document both, fix the control that failed, and tell the person what you did. That sequence resolves the legitimate grievance in most cases and creates the record you would want if it ever became formal.
Frequently Asked Questions
What is considered a HIPAA violation?
A HIPAA violation happens whenever a covered entity, or a business associate working on its behalf, falls short of what the Privacy, Security, or Breach Notification Rules require. Complaints to the federal regulator most often allege that protected health information was used or disclosed in ways the rules do not permit, that safeguards for it were lacking, that individuals were refused access to their own records, that administrative safeguards for electronic records fell short, or that more than the minimum necessary was used or shared. No intent is required: an accidental disclosure is a violation just as much as a deliberate one.
Does HIPAA apply to employers?
Generally not, as long as the employer is acting as an employer. The law reaches health plans, health care clearinghouses, and those health care providers that conduct standard transactions electronically. Federal health department guidance says employment records fall outside the Privacy Rule even when they hold health information, and that the rule usually does not reach an employer's own actions. Three situations change the answer: sponsoring a self-insured group health plan, other than a plan with fewer than 50 participants that the employer administers itself; running an onsite clinic or similar program that bills electronically; or working as a business associate that handles protected health information for a covered entity.
Is it a HIPAA violation for my employer to share my medical information?
Usually not a HIPAA violation, though it may violate a different law. Health information your employer holds in your employment record sits outside HIPAA. Sharing it inappropriately can still breach confidentiality obligations under the Americans with Disabilities Act, the Family and Medical Leave Act, the Genetic Information Nondiscrimination Act, state privacy statutes, or your employment contract. The correct question is rarely whether HIPAA was violated. It is which law actually governs the information in question.
What are the most common HIPAA violations?
The same six failure modes come up again and again in federal enforcement. Accessing records without a work-related reason, often called snooping. Disclosing information to someone who has no right to it, including in conversation or on social media. Losing an unencrypted laptop, phone, or drive. Sending information to the wrong recipient by email, fax, or mail. Improper disposal of paper records or devices. And access that was never removed when someone left. None of the six needs a hacker, even though hacking drives most large breaches; they are ordinary operational failures.
What is an example of an unintentional HIPAA violation?
Typical examples are an email with patient details sent to the wrong address, a fax to a number that is no longer current, a conversation about a patient that others overhear in a waiting room, or a laptop stolen from a car. None of them needs intent to count as a violation, and several substantial penalties have followed purely accidental incidents. One was a $3 million settlement after an unencrypted flash drive went missing and an unencrypted laptop was stolen. In cases like that, the missing encryption, not the loss itself, is usually what makes the incident an enforceable failure.
What are the penalties for a HIPAA violation?
Civil penalties come in four tiers, and the tier depends on how culpable the organization was. For amounts assessed on or after the latest inflation adjustment, the minimum per violation is $145 where the organization neither knew nor reasonably could have known, $1,461 for reasonable cause, $14,602 for willful neglect corrected within 30 days, and $73,011 for willful neglect left uncorrected. A single violation can cost up to $73,011 in each of the first three tiers and up to $2,190,294 in the fourth. The criminal ceiling is $250,000 and ten years in prison, reserved for obtaining or disclosing the information with intent to sell it, transfer it, or use it for commercial advantage, personal gain, or malicious harm.
What is the difference between a HIPAA violation and a breach?
A violation is any failure to follow the rules, and a breach is one particular kind of violation. In a breach, protected health information is acquired, accessed, used, or disclosed in a way the rules do not allow, compromising its security or privacy, and that triggers mandatory notification. So every breach is a violation, but not the reverse: a missing risk analysis is a violation that exposes nothing, so it is not a breach. Once an impermissible disclosure happens, the law treats it as a breach by default unless a documented risk assessment shows only a low probability that the information was compromised.
Can you be fired for a HIPAA violation?
Yes, and termination can follow even a single incident, particularly for accessing records without a work reason. Employers subject to the rules are required to apply sanctions for violations, and access logs make individual accountability straightforward to establish. Individuals can also face criminal liability in serious cases; the first person incarcerated for a misdemeanor HIPAA offense was a former hospital researcher who accessed patient records after his employment ended.
How do you report a HIPAA violation?
Begin with the organization's privacy officer if you feel comfortable raising it there, because a lot of problems get fixed internally. The formal route is a written complaint to the federal Office for Civil Rights through its complaint portal. The deadline is generally 180 days from the point you knew, or should have known, about the act, and it can be extended for good cause. The law forbids retaliating against anyone who files. One limit surprises people: HIPAA gives individuals no right to sue under it, so any lawsuit has to rest on some other law.
Make HR the easy part of running your business
Onboarding, e-signatures, training and core HR in one place. Up and running in 5 minutes.
- 7-day free trial
- No credit card required
- Cancel anytime