Can you give me an example of a HIPAA privacy and security violation?

Sending lab results to the wrong patient is a direct example of a HIPAA privacy and security violation.

Common Examples of Violations

• Misdirected Information: Faxing, emailing, or mailing private health data to an unintended person.
• Employee Snooping: Looking at a patient chart out of personal curiosity without a work reason.
• Insecure Devices: Leaving a laptop or paper chart unlocked and visible in a public area.
• Improper Disposal: Throwing away paper records containing patient names or medical details without shredding them first.
• Unencrypted Data: Storing or sending electronic protected health information without using required security encryption.

Learn more about enforcement actions and compliance through the official HHS Case Examples.

• Review recent compliance actions via the HHS Case Examples.

A common example of a HIPAA violation is an employee looking at a patient's medical files without a job-related reason, which is often called "snooping".

Common Examples of HIPAA Violations

• Employee Snooping: A hospital worker checks the medical chart of a neighbor, friend, or celebrity out of simple curiosity rather than an assigned care duty.
• Misdirected Communication: A clinic worker accidentally emails lab results or texts private health details to the wrong phone number or email address.
• Public Discussions: Medical staff talk about a patient's diagnosis or treatment details in a loud voice in a cafeteria, elevator, or waiting room where others can hear.
• Improper Disposal: A medical office throws paper charts containing patient names and social security numbers into an ordinary trash can instead of shredding them.
• Stolen Unencrypted Devices: A laptop or smartphone containing patient health data is stolen from an unlocked car because the device lacked proper encryption.
• Missing Vendor Agreements: A healthcare provider hires a third-party company to digitize paper records without first signing a formal Business Associate Agreement to guarantee data protection.

You can review a full list of historic enforcement actions and penalties on the US Department of Health and Human Services case page, or read a breakdown of major penalties in the UpGuard History of HIPAA Violations.

The 10 most common HIPAA violations involve mishandling protected health information (PHI) through employee error, weak security, or administrative oversight.

Top 10 Most Common Violations

• Employee Snooping: Accessing patient files, family records, or coworker charts without a direct, professional need to know.
• Lost or Stolen Devices: Leaving unencrypted laptops, smartphones, tablets, or USB drives where they can be stolen or accessed by outsiders.
• Failure to Conduct Risk Analyses: Neglecting regular, organization-wide checkups to find and fix security gaps.
• Improper Disposal of Records: Tossing paper charts in regular trash or failing to securely wipe old hard drives.
• Weak Passwords and Access Controls: Using simple passwords or giving too many staff members broad, unmonitored access to electronic records (ePHI).
• Unauthorized Texting or Emailing: Sending patient details over regular, unsecured text messages or standard email instead of encrypted platforms.
• Missing Business Associate Agreements (BAAs): Failing to sign legal BAA contracts with outside vendors and cloud providers who handle patient data.
• Delayed Breach Notifications: Missing the legal deadline to notify patients, the government, and the media within 60 days of discovering a data breach.
• Inadequate Employee Training: Not providing regular, documented privacy and security awareness education for staff.
• Denying or Delaying Patient Access: Taking longer than allowed (or refusing outright) to give patients copies of their own medical records.

The top 5 most common HIPAA violations involve failing to protect patient data through unauthorized access, weak safeguards, or delayed notifications.

1. Unauthorized Access to Patient Records

• What it is: Staff members viewing Protected Health Information (PHI) out of curiosity or without a direct clinical need.
• Example: Looking up the medical chart of a coworker, family member, or celebrity.

2. Theft or Loss of Unencrypted Devices

• What it is: Laptops, phones, or USB drives containing electronic PHI (ePHI) going missing without proper encryption.
• Example: Leaving a portable hard drive in an unlocked car where it gets stolen.

3. Lack of an Enterprise Risk Analysis

• What it is: Failing to conduct regular, thorough security reviews of organizational systems and vulnerabilities.
• Example: Not checking software or networks for security gaps that later lead to ransomware attacks.

4. Improper Disposal of Patient Records

• What it is: Tossing physical paper files or un-wiped electronic media straight into standard trash or recycling bins.
• Example: Putting printed daily appointment schedules into an open office dumpster.

5. Failure to Issue Timely Breach Notifications

• What it is: Failing to notify affected individuals, the government, or the media within the mandatory 60-day window following a discovered data breach.
• Example: Waiting six months to tell patients that their health records were exposed in a cyberattack.

The single most common privacy violation—particularly in regulated sectors like healthcare—is unauthorized access or snooping into confidential records by employees who have no job-related reason to view them.

Overview of Common Privacy Violations

While privacy violations occur across digital tracking, consumer data, and the workplace, the most frequently tracked and penalized official violations fall under regulations like HIPAA (Health Insurance Portability and Accountability Act).

The top reported infractions include:

• Unauthorized Record Snooping: Staff members viewing patient files or personal data out of curiosity without a clinical or professional need.
• Impermissible Disclosures: Sharing private information (such as Protected Health Information or PHI) with unauthorized family members, friends, or coworkers, or discussing details within earshot of the public.
• Lack of Data Safeguards: Failing to use encryption, strong passwords, or multi-factor authentication on electronic devices containing sensitive files.
• Improper Disposal: Throwing away physical paper records or unformatted digital media in standard trash bins instead of shredding or destroying them securely.
• Missing Risk Assessments: Organizations failing to run required annual security or privacy audits to catch vulnerable gaps.