5 HIPAA Violations That Get Healthcare Organizations Fined: Real Cases and How to Avoid Them [Video + Guide]

Posted: March 6, 2026 to Compliance.

Watch the video above for a quick overview of the most common HIPAA violations, then read the full guide below for detailed analysis of each violation type, real enforcement cases, and step-by-step prevention strategies.

HIPAA Enforcement Has Never Been Stricter

The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has dramatically increased HIPAA enforcement in recent years. Between 2003 and 2025, the OCR resolved over 300 cases resulting in settlements or civil money penalties totaling more than $142 million. In 2025 alone, enforcement actions exceeded $20 million in penalties.

HIPAA violations carry severe consequences beyond financial penalties. Organizations face mandatory corrective action plans that can last two to three years, reputational damage that erodes patient trust, potential exclusion from Medicare and Medicaid programs, and in egregious cases, criminal charges against individuals responsible for violations.

Understanding the most common violations and how to prevent them is essential for every healthcare organization, their business associates, and any entity that handles Protected Health Information (PHI).

Violation 1: Failure to Conduct a Risk Analysis

The single most cited HIPAA violation in OCR enforcement actions is failure to conduct a comprehensive, organization-wide risk analysis. The HIPAA Security Rule requires covered entities to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic PHI (ePHI).

Why organizations fail: Many organizations either skip the risk analysis entirely, conduct a superficial checklist-based assessment, or perform the analysis once and never update it. A risk analysis is not a one-time event. It must be updated annually and whenever significant changes occur in your environment, such as new systems, new locations, or new workflows.

Real enforcement case: In 2023, a medical center agreed to a $1.25 million settlement after OCR found that the organization had failed to conduct a comprehensive risk analysis despite having experienced a breach. The organization could not demonstrate that it had ever systematically identified the risks to its ePHI.

How to prevent this violation: Conduct a thorough risk analysis that covers all systems, networks, and processes that create, receive, maintain, or transmit ePHI. Document every identified risk along with your mitigation strategy. Update the analysis annually and after any significant change. Use the NIST Cybersecurity Framework or HHS guidance documents as your methodology. Retain all documentation for at least six years.

Violation 2: Lack of Encryption

While HIPAA treats encryption as an "addressable" specification rather than a strict requirement, the OCR has made it clear through enforcement actions that failing to encrypt ePHI without documenting an equivalent alternative protection is a violation. The vast majority of breach-related enforcement actions involve unencrypted data.

Why this matters: When encrypted devices or data are lost or stolen, the breach notification safe harbor applies. If the data was encrypted with NIST-approved algorithms and the encryption keys were not compromised, the incident does not constitute a reportable breach under HIPAA. When unencrypted data is lost, you have a reportable breach with all the associated consequences.

Common encryption gaps: Laptop hard drives and portable storage devices without full-disk encryption. Email messages containing PHI sent without encryption. Data at rest in databases and file servers. Mobile devices used to access or store PHI. Backup tapes and media transported offsite.

Real enforcement case: A health system paid $3.2 million to settle HIPAA charges after an unencrypted laptop containing PHI for over 500,000 individuals was stolen from a workforce member's vehicle. If the laptop had been encrypted, no breach notification would have been required.

How to prevent this violation: Implement full-disk encryption on all laptops and portable devices. Deploy email encryption for any messages containing PHI. Encrypt ePHI at rest in databases and file systems. Use encrypted messaging platforms for clinical communication. Encrypt all backup media. If you choose not to encrypt a specific system, document your alternative safeguards and the rationale in your risk analysis.

Violation 3: Unauthorized Access and Improper Access Controls

HIPAA requires that access to ePHI be limited to the minimum necessary to perform job functions. Violations occur when organizations fail to implement proper access controls, do not revoke access for terminated employees, or allow excessive access privileges that are not aligned with job responsibilities.

Common access control failures: Shared login credentials among staff members. Failure to revoke access when employees leave the organization. Generic admin accounts used by multiple IT staff. Lack of role-based access controls that align permissions with job functions. No regular review of access privileges to identify and remove excessive permissions.

Insider threat reality: According to the Verizon Data Breach Investigations Report, 34% of healthcare breaches involve internal actors. Snooping on medical records of celebrities, family members, and co-workers is one of the most common and most preventable HIPAA violations. Every access to a patient record should be logged and auditable.

Real enforcement case: A health plan paid $5.1 million after OCR found that the organization had not implemented sufficient access controls, allowing unauthorized employees to access ePHI. The investigation revealed that former employees retained access to systems containing PHI long after their termination.

How to prevent this violation: Implement role-based access controls (RBAC) that align system permissions with job functions. Establish and enforce a procedure for immediately revoking access upon employee termination or role change. Conduct quarterly access reviews to identify and remove excessive privileges. Deploy audit logging on all systems containing PHI and review logs regularly. Implement MFA for all systems accessing ePHI. Prohibit shared credentials and generic accounts.

Violation 4: Failure to Maintain HIPAA-Compliant Business Associate Agreements

Any organization that performs services for a covered entity that involves access to PHI is a business associate under HIPAA. Covered entities must have a signed Business Associate Agreement (BAA) with every business associate before sharing PHI. This includes cloud service providers, IT support companies, billing services, shredding companies, and any vendor that may encounter PHI.

Why organizations fail: Many covered entities do not maintain a complete inventory of their business associates. They share PHI with vendors without ensuring a BAA is in place. Some organizations use BAAs that do not meet current HIPAA requirements or have not been updated to reflect changes in the HIPAA Omnibus Rule.

Cloud service gotcha: If you store ePHI in a cloud service (AWS, Azure, Google Cloud, Microsoft 365, etc.), the cloud provider is a business associate. You must have a BAA with them before uploading any PHI. Most major cloud providers offer BAAs, but you must explicitly request and execute them. Simply using the service without a BAA in place is a violation.

Real enforcement case: A dermatology practice paid $150,000 and agreed to a corrective action plan after OCR found that the practice had disclosed PHI to a third-party vendor without a BAA in place. The vendor was providing cloud-based medical records storage.

How to prevent this violation: Maintain a complete inventory of all business associates. Ensure every business associate has a signed BAA before any PHI is shared. Update BAAs to comply with current HIPAA requirements including breach notification provisions. Review BAAs annually and after any regulatory changes. Monitor business associates' compliance with BAA terms. Terminate arrangements with business associates that refuse to execute a BAA.

Violation 5: Insufficient Security Awareness Training

HIPAA requires that all workforce members receive training on policies and procedures related to PHI. This includes not just clinical staff but all employees, volunteers, and contractors who may encounter PHI. Insufficient or absent training is cited in a significant percentage of enforcement actions, particularly those following breaches caused by human error.

Why training failures occur: Some organizations provide training only at onboarding and never again. Training content does not address current threats like phishing and social engineering. Organizations fail to document training completion. Temporary staff, volunteers, and contractors are excluded from training programs. Training is generic rather than role-specific.

The human factor: Over 80% of healthcare breaches involve human error or social engineering. Phishing emails, lost devices, improper disposal of PHI, and accidental disclosures are all preventable through effective training. Without regular, relevant training, your workforce is your biggest vulnerability.

Real enforcement case: A hospital agreed to a $2.4 million settlement after a phishing attack compromised the ePHI of over 300,000 patients. The investigation revealed that the hospital had not provided adequate security awareness training, and employees had not been trained to recognize phishing attacks.

How to prevent this violation: Provide HIPAA security awareness training to all workforce members at onboarding and at least annually thereafter. Include role-specific training for employees with access to PHI systems. Address current threats including phishing, social engineering, ransomware, and mobile device security. Conduct regular simulated phishing exercises and provide targeted training to employees who fail. Document all training activities including content, dates, and attendee lists. Retain training records for at least six years.

Beyond the Top 5: Additional HIPAA Risk Areas

Breach Notification Failures: HIPAA requires notification to affected individuals within 60 days of discovering a breach. Breaches affecting 500 or more individuals must also be reported to HHS and media. Late or incomplete notifications can result in additional penalties.

Lack of PHI Disposal Procedures: Improper disposal of PHI, whether paper records in regular trash or electronic media without proper sanitization, is a common violation. Implement shredding for paper and certified data destruction for electronic media.

Social Media and Communication: Workforce members posting patient information on social media, even without names, can constitute a HIPAA violation if the patient is identifiable. Clear social media policies and training are essential.

Frequently Asked Questions

What are the penalty tiers for HIPAA violations?

HIPAA penalties are structured in four tiers: Tier 1 covers violations where the entity did not know and could not have reasonably known ($100 to $50,000 per violation). Tier 2 covers violations due to reasonable cause ($1,000 to $50,000 per violation). Tier 3 covers violations due to willful neglect that are corrected within 30 days ($10,000 to $50,000 per violation). Tier 4 covers violations due to willful neglect that are not corrected ($50,000 per violation). The annual cap is $1.5 million per violation category.

Can individuals face criminal charges for HIPAA violations?

Yes. Criminal penalties apply to individuals who knowingly obtain or disclose PHI in violation of HIPAA. Penalties range from $50,000 and one year in prison for knowing violations, up to $250,000 and ten years in prison for violations committed with intent to sell PHI or use it for commercial advantage or malicious harm.

Does HIPAA apply to my business if I am not a healthcare provider?

HIPAA applies to covered entities (health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically) and their business associates. If your company provides services to a covered entity and handles PHI in any form, you are likely a business associate subject to HIPAA requirements.

How often should we conduct a HIPAA risk analysis?

At minimum, annually. Additionally, conduct an updated risk analysis whenever there are significant changes to your environment such as new systems, new facilities, organizational changes, or after a security incident. The OCR has consistently emphasized that risk analysis is an ongoing process, not a one-time compliance checkbox.

Achieve and Maintain HIPAA Compliance with PTG

Petronella Technology Group has helped healthcare organizations and their business associates achieve and maintain HIPAA compliance for over two decades. Our services include comprehensive risk analysis, policy development, technical safeguard implementation, workforce training, and ongoing compliance monitoring.

With cybersecurity expertise, managed IT services, and private AI deployment that keeps PHI on your infrastructure, we help you protect patient data while meeting every HIPAA requirement.

Do not wait for an OCR investigation to find your gaps. Contact PTG today for a HIPAA compliance assessment. For ongoing education, join our Training Academy at petronellatech.com/training/.

---

Related Resources

• HIPAA Security Guide
• HIPAA Business Associate Agreements
• HIPAA Compliance for Healthcare
• Schedule a Free Consultation