HIPAA violations occur when an organization runs afoul of the standards defined by this 1996 U.S. Federal legislation. Many HIPAA violations are related to accessing or sharing patients’ protected health information (PHI). However, violations can also include items such as not training staff or monitoring access logs.
HIPAA laws aim to modernize healthcare information in an era of digital records. They delineate patient data privacy regulations by requiring security measures around access to healthcare information with three primary rules:
The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) administers HIPAA. Since HIPAA’s debut in 1996, the U.S. Congress has augmented it with updates like the 2009 HITECH Act.
Its rules affect “covered entities”:
They also impact vendors who provide services to healthcare providers who might come into contact with PHI.
What is considered a HIPAA violation? HIPAA violations span a wide range. They even include accidental HIPAA violations, for example, losing a personal cell phone that allows for access to workplace applications. Sadly, unintentional breaches don’t make them less damaging. However, many breaches stem from an imperfect understanding of what constitutes a violation. For example, one organization was fined when it had a third party convert x-rays to a digital format without a business agreement in place to ensure HIPAA regulations were met.
Since 2003, OCR has investigated almost 300,000 potential HIPAA privacy rule violations. Yet many healthcare employees still don’t know what constitutes a HIPAA violation despite the high stakes for these types of violations in the workplace. For example, any breach of HIPAA rules can result in a $50,000 fine. And obtaining PHI with reasonable cause or no knowledge of a violation can potentially result in jail time. To avoid these penalties, knowledge of examples of HIPAA violations by employees—and examples of HIPAA violations by employers—is crucial.
HIPAA breaches can occur inadvertently or intentionally. Let’s look at the 12 common categories of breaches:
For some issues, HIPAA violation examples are less clear. For example, is losing medical records a HIPAA violation? Some outcomes of record loss can violate HIPAA. According to HIPAA, patients have a right to their medical records within 30 days of a request; failure to provide them is a HIPAA violation. Losing a device or record that exposes patient records to unauthorized actors is also a HIPAA violation.
In another example of what qualifies as a HIPAA violation, law enforcement and military agencies can sometimes face a penalty for a HIPAA violation—but not always. Law enforcement agencies aren’t covered entities. However, if they operate their own medical service, only then can they face HIPAA violation fines.
What about HIPAA military requirements? The military exception means care providers can disclose PHI to military personnel to determine fitness for duty or a particular mission.
In 2022 alone, more than 40 million health records were compromised. For the most part, responsible employees of covered entities reported these HIPAA violations to OCR. Covered entities can also uncover violations through internal auditing and self-reporting. Of course, co-workers also have a hand in reporting HIPAA violations in the workplace.
OCR’s own audits of covered entities and their business associates also reveal violations. OCR maintains an audit pool through random selection, pre-screening questionnaires, and pool selection. These audits can also occur due to a complaint or because the covered entity helps represent a cross-section of U.S. healthcare providers.
What happens after a HIPAA complaint is filed? OCR decides whether the complaint warrants investigation. It notifies the organization against which a complaint is filed. Next, it requests information related to its investigation of the claim. Covered entities must comply with OCR requests regarding HIPAA violation complaints. HIPAA stipulates that an entity should not retaliate against you for filing a complaint. Victims of retaliation can contact OCR for guidance. After an investigation, OCR finds covered entities compliant or requires them to take corrective action.
A resolution agreement is a settlement with OCR and the covered entity (or business associate) for remediation. It typically includes bringing violations into compliance and periodic reporting to the HHS. It can lead to civil HIPAA non-compliance penalties.
Covered entities and individual healthcare workers have different concerns about HIPAA violations. The breadth of this law means organizations must focus on systems and training, especially for those who are just starting their career in healthcare, while employees need ways to proactively protect themselves and their careers.
Avoiding HIPAA violations means being prepared for audits and making sure you have policies to address areas of concern in your risk analysis. Here are some items to address:
OCR has guidance for professionals about their requirements under HIPAA. Training employees on common violations is a primary way to ensure your organization avoids HIPAA violations. Address the following areas:
While your IT department has a small part to play in making sure your organization moves patient charts from room to room, it has an outsized role in protecting digital PHI. And with cybersecurity threats to healthcare institutions up 150% since the COVID-19 pandemic, its role in managing digital assets has become more critical.
That news provides little comfort to victimized entities. They’re often liable for losing patient records under HIPAA, with hefty settlement fees, and they incur significant costs to secure the systems they rely on to provide patient care. Crucial cybersecurity steps, like Delinea’s infrastructure access platform, help prevent these breaches.
Securing access to critical infrastructure is at the heart of the Delinea platform, helping upgrade security for PHI. With an infrastructure access platform, covered entities get:
HIPAA standards require covered entities to implement processes and procedures to detect and correct security violations. Access management solutions give teams a way to meet that standard. Delinea creates administrative controls to provide employees with only the permissions they need while preventing unauthorized users from accessing records.
Managing permissions, monitoring systems, and keeping up with compliance are long-term commitments. Delinea makes them a little easier by automating least-privilege access, centralizing logging, and locking down your PHI to make it easier to stay HIPAA-compliant.
See how Delinea protects your PHI from HIPAA violations. Try a Demo
Many frequently asked questions (FAQs) about HIPAA center on the process when an organization has a breach, a patient or employee needs to file a complaint, or OCR audits an organization. Yet, organizations and their employees should be confident they’re not intentionally violating HIPAA regulations. Follow the guidance in our FAQs to help your organization and employees be in the know.
A HIPAA violation occurs when an organization or individual fails to comply with the rules set by the Health Insurance Portability and Accountability Act (HIPAA). This includes unauthorized access, use, or disclosure of protected health information (PHI), failure to implement security measures, lack of employee training, improper data disposal, or failing to conduct risk assessments.
A HIPAA breach is any unauthorized access, acquisition, use, or disclosure of PHI that compromises its security or privacy. Breaches can be accidental (e.g., losing an unencrypted laptop with PHI) or intentional (e.g., unauthorized sharing of patient records). Covered entities must report breaches based on severity, with major breaches (500+ records) requiring immediate notification to HHS and affected individuals.
Who do you report HIPAA violations to? File a complaint with HHS. Anyone can file a complaint, and it's easy to find out how to report HIPAA violations. The simplest way to get started is through the online complaint portal. File complaints within 180 days of the violation, although HHS makes exceptions if you can demonstrate a good reason.
OCR requires the name and contact information of those filing complaints to start an investigation. However, you can download the complaint form and mail it to OCR without your contact information, which can result in no action taken against the covered entity.
A better option is to stipulate that OCR keeps your information private. By refusing to consent to reveal your identity, you can protect yourself from backlash, and your name won’t be given to the entity if OCR initiates an investigation. Other channels for anonymous reporting include hotlines or patient surveys.
Yes, a HIPAA violation is a crime. Even seemingly minor items on the list of HIPAA violations can come with steep criminal HIPAA violation penalties. For willfully violating rules, individuals can face HIPAA violation fines from $50,000 to $250,000, plus restitution. HIPAA violation consequences can also include jail time of up to ten years. What happens when you violate HIPAA? Civil fines for HIPAA violations by individuals start at $100 and can be as high as $25,000 for multiple infractions.
Yes, HIPAA breach penalties can result in termination. However, if the breach was accidental and “in good faith,” HIPAA rules do not designate the breach as reportable. The results of an internal investigation, the scope of the breach, and the employee’s role in it are all factors in the ultimate outcome. Penalties for violating HIPAA can range from criminal liability to increased organizational security and training.
HIPAA rules apply to covered entities who work with PHI and their contracted vendors who may access their data. So, can a non-medical person violate HIPAA? Yes, absolutely. Here’s who can violate HIPAA:
OCR offers guidance for individuals about their rights under HIPAA. However, patients cannot sue covered entities for violations of HIPAA alone. Individuals have some options to recover damages when they suffer harm following a privacy breach. They can bring a case against a provider on a related issue when they suffer provable injuries. Most often, the answer to whether you can sue for HIPAA violations is no. Lawsuits involving HIPAA stem from OCR and state attorneys general who take action against violators. They protect future individuals from harm but don’t provide relief for an affected individual.
Breaches that demand reporting under HIPAA involve unsecured PHI that’s accessed in a way that violates the privacy rule. When that violation occurs, business associates and individuals need to report breaches to covered entities within 60 days. If the breach involves fewer than 500 records, covered entities have 60 days to report it to HHS, but organizations must report larger breaches immediately.