What are some examples of HIPAA breaches?

A HIPAA breach occurs when protected health information (PHI) is accessed, used, or disclosed in a way that breaks privacy or security rules.

Common Examples of HIPAA Breaches

• Employee Snooping: Staff members look at patient health records without a work reason, such as checking a neighbor's or celebrity's chart out of curiosity.
• Lost or Stolen Devices: Laptops, tablets, or unencrypted flash drives containing patient data are misplaced or stolen from cars or offices.
• Insecure Communication: Staff send patient names, diagnoses, or test results via regular, unencrypted text messages or personal email accounts.
• Improper Disposal of Records: Paper charts are thrown into regular trash bins instead of being shredded, or old hard drives are discarded without erasing the electronic data.
• Hacking and Cyberattacks: Cybercriminals use phishing emails or ransomware to break into hospital network servers and steal electronic patient files.
• Discussing Patient Data in Public: Healthcare workers talk about identifiable patient details in elevators, cafeterias, or on social media platforms.
• Missing Business Associate Agreements (BAAs): A clinic shares patient information with an outside vendor or IT contractor without signing a formal legal contract that guarantees data protection.
• Delayed Breach Notifications: An organization fails to notify affected patients or the government within 60 days of discovering a data leak.

The 10 most common HIPAA violations involve mishandling protected health information (PHI) through employee error, weak security, or administrative oversight.

Top 10 Most Common Violations

• Employee Snooping: Accessing patient files, family records, or coworker charts without a direct, professional need to know.
• Lost or Stolen Devices: Leaving unencrypted laptops, smartphones, tablets, or USB drives where they can be stolen or accessed by outsiders.
• Failure to Conduct Risk Analyses: Neglecting regular, organization-wide checkups to find and fix security gaps.
• Improper Disposal of Records: Tossing paper charts in regular trash or failing to securely wipe old hard drives.
• Weak Passwords and Access Controls: Using simple passwords or giving too many staff members broad, unmonitored access to electronic records (ePHI).
• Unauthorized Texting or Emailing: Sending patient details over regular, unsecured text messages or standard email instead of encrypted platforms.
• Missing Business Associate Agreements (BAAs): Failing to sign legal BAA contracts with outside vendors and cloud providers who handle patient data.
• Delayed Breach Notifications: Missing the legal deadline to notify patients, the government, and the media within 60 days of discovering a data breach.
• Inadequate Employee Training: Not providing regular, documented privacy and security awareness education for staff.
• Denying or Delaying Patient Access: Taking longer than allowed (or refusing outright) to give patients copies of their own medical records.

Hacking and IT incidents—such as cyberattacks, phishing, and ransomware—are the most common causes of large-scale HIPAA data breaches today.

Leading Causes of Breaches

• Hacking and Cyberattacks: Digital security incidents involving network servers and email accounts dominate modern data breaches, accounting for the vast majority of compromised records. Phishing emails often trick employees into giving up login credentials or installing malware.
• Unauthorized Access: Internal staff viewing patient records or Protected Health Information (PHI) without a legitimate clinical reason remains the single most common everyday HIPAA violation.
• Loss or Theft of Devices: Unencrypted laptops, tablets, and portable storage media left behind or stolen continue to expose patient data.
• Lack of Employee Training: Staff members who do not understand privacy rules often cause accidental disclosures, such as misdirected emails, loose talk in public areas, or improper document disposal.
• Inadequate Technical Safeguards: Missing data encryption, weak access controls, or failing to conduct regular risk assessments leave systems wide open to compromise.

Some of the most famous HIPAA violation cases involve massive data breaches, internal record snooping, and severe financial penalties.

Major Data Breaches and Fines

• Anthem Inc.: A 2015 cyberattack via spear-phishing exposed the personal and health data of nearly 79 million people. Anthem paid a record $16 million fine to the federal government and a $115 million class-action settlement.
• Premera Blue Cross: Hackers used malware from a phishing email to access the health data of 10.4 million individuals. The breach went unnoticed for nearly nine months, resulting in a $6.85 million settlement.
• Advocate Health Care Network: A series of data breaches—including stolen unencrypted laptops—affected over 4 million people. They agreed to a then-record $5.55 million settlement.

Internal Snooping and Employee Misconduct

• Memorial Healthcare System: Dozens of staff members improperly used login credentials of former employees to access patient data between 2011 and 2021. They paid a $5.5 million settlement for failing to monitor system activity.
• UCLA Health System: Employees repeatedly snooped on the medical records of high-profile celebrity patients without a work purpose. The system faced an $865,000 fine and corrective actions, while individual workers faced criminal charges and termination.

A HIPAA breach is any unauthorized acquisition, access, use, or disclosure of unsecured Protected Health Information (PHI) that compromises the security or privacy of the data.

Core Definition

Under the HHS Breach Notification Rule, any impermissible use or disclosure of PHI is presumed to be a breach. It remains classified as a breach unless the organization proves a low probability of compromise through a four-factor risk assessment.

The Four-Factor Risk Assessment

Organizations evaluate incidents using four specific criteria:

• Nature and extent of PHI: Look at the types of identifiers and sensitivity of the medical data.
• Unauthorized recipient: Identify who accessed or received the information.
• Actual viewing or acquisition: Determine if the data was actually seen or stolen.
• Mitigation extent: Assess how quickly and effectively the risk was reduced.

Key Exceptions

An impermissible action is not a breach if it falls under one of three exceptions:

• Unintentional, good-faith access by an authorized workforce member.
• Inadvertent internal disclosures between authorized persons at the same facility.
• Good-faith belief that the unauthorized recipient could not have reasonably retained the information.

Common Examples

• Lost or stolen hardware: Unencrypted laptops, tablets, or flash drives containing patient files.
• Hacking and malware: Ransomware attacks or cyber breaches exposing electronic health records (ePHI).
• Misdirected communication: Sending patient medical details or emails to the wrong external recipient.
• Unauthorized snooping: Staff members viewing patient charts without a legitimate job-related reason.