HIPAA violations: examples and how to report one
Common HIPAA violation examples by category, from impermissible PHI disclosure to missing risk analysis and lost devices, the civil penalty tiers in plain terms, and how to report a HIPAA violation through the HHS OCR complaint process.
The short version
What counts as a HIPAA violation?
A HIPAA violation is any failure by a covered entity or business associate to comply with the HIPAA Privacy, Security, or Breach Notification Rules. In practice, violations cluster into a few recurring categories: protected health information (PHI) going to the wrong place, a missing risk analysis, a vendor with no business associate agreement, an unencrypted device walking out the door, an employee viewing records they have no reason to see, a patient denied access to their own chart, and records thrown out without secure disposal. The examples below are described as categories, not as claims about any specific organization.
New to the law itself? Start with our overview of what HIPAA is, then come back here for what goes wrong and how the regulator handles it.
Updated . General educational guidance, not legal advice.
Common HIPAA violation examples, by category
Most enforcement activity and most real-world incidents fall into the categories below. Each names the situation in plain terms and the rule it touches.
Impermissible use or disclosure of PHI
Sharing protected health information with someone who is not authorized to see it, or for a purpose HIPAA does not permit. This is the most common category and ranges from sending records to the wrong patient to discussing a case where it can be overheard.
Missing or inadequate risk analysis
Failing to conduct, or to document, an accurate and thorough Security Rule risk analysis of threats to electronic PHI. This is the single artifact OCR asks for most often, and its absence is a recurring finding in enforcement actions.
No business associate agreement
Letting a vendor create, receive, maintain, or transmit PHI without a signed business associate agreement (BAA) in place. The BAA is the contract that flows HIPAA obligations down to the vendor, and the chain must extend to subcontractors.
Unencrypted lost or stolen devices
A laptop, phone, USB drive, or backup that holds unencrypted ePHI is lost or stolen. Encryption is an addressable Security Rule safeguard, and an unencrypted loss commonly becomes a reportable breach of unsecured PHI.
Employee snooping
Workforce members accessing patient records they have no work reason to view, such as records of a family member, a coworker, or a public figure. This is an access-control and minimum-necessary failure, and audit logs usually make it visible after the fact.
Failure to provide patient access
Not giving individuals timely access to their own records, charging more than a reasonable cost-based fee, or refusing a valid request. Patient right-of-access has been a stated OCR enforcement priority, so this category draws particular scrutiny.
Improper disposal of PHI
Throwing paper records in a regular trash bin, or discarding old drives and devices without securely wiping the ePHI on them. PHI must be rendered unreadable before disposal, in any medium, paper or electronic.
How HIPAA penalties are tiered
The HHS Office for Civil Rights enforces HIPAA, and civil penalties are tiered by culpability, how much the organization knew and whether it corrected the problem. Each tier carries its own per-violation amount and annual cap, which OCR adjusts for inflation each year.
The entity did not know, and by exercising reasonable diligence would not have known, that it violated the rule.
The violation was due to reasonable cause and not willful neglect.
The violation was due to willful neglect but was corrected within the required time period.
The violation was due to willful neglect and was not corrected within the required time period. This is the most serious tier.
Check the live numbers before quoting them. OCR republishes its inflation-adjusted penalty amounts annually, so any specific dollar figure is a snapshot. The most serious knowing misuse of PHI can also be prosecuted criminally by the Department of Justice. Always confirm current HHS guidance.
How to report a HIPAA violation
Anyone can report a suspected HIPAA violation to the federal regulator. The process is free and runs through the HHS Office for Civil Rights.
- 1
Try the internal channel first, if appropriate
If you are a patient or an employee, the organization's Privacy Officer or compliance hotline is often the fastest path to a fix. The Notice of Privacy Practices lists how to raise a concern. This step is optional, not required, before going to the regulator.
- 2
File a complaint with the HHS Office for Civil Rights (OCR)
OCR is the federal agency that enforces HIPAA. Anyone can file a complaint about a covered entity or business associate they believe violated the Privacy, Security, or Breach Notification Rules. Complaints are submitted through the OCR Complaint Portal.
- ·
File within 180 days
A complaint must generally be filed within 180 days of when you knew, or should have known, that the act occurred. OCR may extend this window for good cause. File promptly to avoid a timeliness issue.
- 3
Include the who, what, and when
Name the organization, describe what happened and when, and explain how you believe the rules were broken. You may file by name or anonymously, though OCR cannot follow up with you on an anonymous complaint.
- 4
OCR reviews, investigates, and resolves
OCR screens the complaint, and where it opens an investigation it may seek voluntary compliance, a corrective action plan, or, for serious findings, a civil money penalty. Knowing criminal misuse of PHI can be referred to the Department of Justice.
File HIPAA complaints through the official HHS Office for Civil Rights complaint process. If you run the organization on the receiving end, the surest way to avoid being the subject of one is a documented, current program, see HIPAA compliance assessment software.
HIPAA Security Checklist
The administrative, physical, and technical safeguards that close the most common HIPAA gaps, in a single working checklist you can run against your own program.
- Administrative, physical, and technical safeguard checks
- Risk-analysis and documentation prompts OCR looks for
- Business associate agreement and vendor coverage
- Device encryption, access control, and disposal items
- A gap list you can hand to owners for remediation
Facing an audit, not just a complaint?
If your concern is an OCR audit rather than a single incident, our free preparation guide walks the policies, evidence, and risk analysis OCR asks for, and the findings teams most often need to pre-empt.
Get the OCR audit preparation guideFrequently asked questions
Turn HIPAA from a risk into audit-ready evidence.
RiskWatch runs the Security Rule risk analysis, tracks business associate agreements, and keeps the timestamped evidence trail OCR asks for. Start a free trial, no credit card.
No credit card required · 30-day free trial · Cancel anytime