In what ways can HIPAA be violated?

A HIPAA violation occurs when a covered entity or its business associate fails to comply with the regulations set by the Health Insurance Portability and Accountability Act (HIPAA), resulting in the compromised security or privacy of Protected Health Information (PHI). These violations can be entirely accidental or intentionally malicious.

The most common ways individuals and organizations violate HIPAA include:

1. Unauthorized Access and Curiosity Snooping

Healthcare professionals are only permitted to access patient files for legitimate treatment, billing, or operational reasons.

• Examples: A nurse looking up a neighbor’s or relative’s medical records out of concern, or administrative staff looking at a celebrity's file out of curiosity. Even without malicious intent, "snooping" is a direct violation.

2. Impermissible Disclosures and Casual Gossip

Sharing or discussing identifiable patient details with unauthorized parties, or talking about patients in settings where others can overhear, breaches privacy rules.

• Examples: Discussing a patient’s condition in a crowded hospital elevator or cafeteria, sharing patient stories or photos on social media, or accidentally sending an email or fax containing PHI to the wrong recipient.

3. Mishandling Equipment and Unencrypted Data

If portable devices containing PHI are lost or stolen, it is automatically legally presumed to be a data breach unless the data is encrypted.

• Examples: Leaving an unencrypted work laptop or USB drive in a car where it gets stolen, texting patient medical information over unsecured, standard messaging apps, or letting a child use a personal phone that has unsecured access to a hospital's patient database.

4. Denying or Delaying Patient Access to Records

Under HIPAA, patients have a strict legal right to view and obtain copies of their own medical records.

• Examples: A clinic refusing to release records because the patient has an outstanding medical bill, overcharging for printing copies, or failing to fulfill a records request within the legally mandated timeframe.

5. Improper Disposal of Records

When PHI is no longer needed, it must be destroyed completely so that it cannot be reconstructed or read.

• Examples: Throwing intact paper medical charts, patient labels, or intake forms directly into a standard trash can or recycling bin instead of shredding them, or throwing away old office computers without permanently wiping the hard drives.

6. Administrative Neglect

Organizations can violate HIPAA simply by failing to maintain the mandatory compliance programs required by law.

• Examples: Failing to conduct regular, organization-wide data security risk analyses; neglecting to provide mandatory HIPAA training to employees; or sharing data with third-party vendors without first signing a formal Business Associate Agreement (BAA).

Penalties for Violations

The Department of Health and Human Services' Office for Civil Rights (OCR) enforces these rules. Civil penalties utilize a tiered system based on the level of neglect, ranging from $100 to $50,000+ per individual violation. For severe, knowing, or malicious violations—such as stealing patient data for financial gain or identity theft—the Department of Justice can file criminal charges leading to fines up to $250,000 and up to 10 years in federal prison.