What is a violation of HIPAA from an employer?

Editorial team Published on

A HIPAA violation by an employer occurs when a covered entity (like a healthcare provider or health plan) or its management fails to protect Protected Health Information (PHI).

(Note: HIPAA generally only applies to healthcare organizations and their business associates, not standard non-medical employer HR files like general sick notes or FMLA forms).

Common Examples in the Workplace

  • Unauthorized Record Snooping: Management or staff looking at an employee's or patient's medical files without a direct, job-related "need to know".
  • Improper Disposal of Records: Tossing physical medical files into regular office trash or leaving un-wiped digital hard drives/copiers exposed.
  • Misdirected Communications: Faxing or emailing private medical test results or health data to the wrong recipient, such as an employee's general department or wrong vendor.
  • Disclosing PHI Publicly or to Coworkers: Discussing an employee's or patient's specific health condition or treatment openly where others can overhear, or sharing details on social media.
  • Lacking System Security Safeguards: Failing to use encrypted laptops, strong individual passwords, or secure communication channels for medical data.
  • Failing to Train Employees: Neglecting required annual staff training on privacy rules and data security protocols.
  • Missing Business Associate Agreements (BAAs): Sharing protected data with third-party vendors (like IT providers or billing companies) without a formal legal contract ensuring they also follow HIPAA rules.

For official enforcement cases and compliance rules, check the U.S. Department of Health and Human Services guidelines.

What is considered a HIPAA violation at work?

A HIPAA violation at work occurs when protected health information (PHI) is improperly accessed, used, or disclosed without authorization.

Common Workplace HIPAA Violations

  • Unauthorized Access: Looking at a patient's medical chart, file, or electronic record out of curiosity or without a direct job-related reason (such as snooping on a coworker, celebrity, or neighbor).
  • Improper Disclosure: Sharing patient details with unauthorized individuals, including family members, friends, or coworkers who are not involved in the patient's care.
  • Gossip and Casual Talk: Discussing patient information in public areas like hallways, cafeterias, elevators, or on social media, even if the patient's name is not explicitly stated.
  • Inadequate Security Safeguards: Leaving a computer screen unlocked with patient data visible, using weak or shared passwords, or failing to encrypt mobile devices and laptops containing PHI.
  • Improper Disposal: Throwing paper charts, notes, or printed labels with identifiable patient data into standard trash cans instead of shredding them.
  • Unsecured Communications: Sending patient health information via personal email, text messages, or unencrypted platforms.

Consequences of Violations

  • Disciplinary Action: Employees can face formal warnings, mandatory retraining, suspension, or termination from their job.
  • Fines and Penalties: Civil penalties range from $100 to over $50,000 per violation depending on culpability, while criminal penalties for intentional theft or malicious use can reach up to $250,000 and 10 years in prison.

Will a HIPAA violation get you fired?

Yes, a HIPAA Violation Grounds for Termination update shows that a HIPAA violation can get you fired, but whether it does depends heavily on intent, severity, and your employer's policies.

Intent and Severity

  • Intentional breaches: Snooping in patient files out of curiosity, stealing data, or sharing patient photos on social media usually results in immediate termination.
  • Accidental mistakes: Minor errors, like clicking the wrong patient file or sending an email to the wrong person by honest mistake, often lead to a verbal warning, retraining, or a written warning instead of losing your job.
  • Severe accidents: Even an accidental mistake can lead to termination if it causes massive harm, repeats past behavior, or shows complete disregard for basic safety rules.

Employer Policies

  • Sanctions policy: Every healthcare workplace must have a rulebook that lists progressive discipline, such as retraining, suspension, or firing.
  • Self-reporting: Telling your boss or privacy officer right away when you make an honest mistake often saves your job, because it shows honesty and helps fix the problem fast.

Can I sue my employer for a HIPAA violation?

No, you cannot directly sue your employer under HIPAA because the law does not provide a private right of action for individuals.

Alternative Legal Options

Even though a direct federal HIPAA lawsuit is not allowed, you may still have grounds for legal action through other laws:

  • Americans with Disabilities Act (ADA): The Garrison Law explains that the ADA requires employers to keep employee medical information confidential and stored separately from standard personnel files.
  • State Privacy Laws: You can file claims under common law privacy torts, such as invasion of privacy or the public disclosure of private facts.
  • Federal Complaints: You can report the infraction to the U.S. Department of Health and Human Services Office for Civil Rights to trigger a federal investigation and potential penalties.

What are the 10 most common HIPAA violations?

The 10 most common HIPAA violations involve mishandling protected health information (PHI) through employee error, weak security, or administrative oversight.

Top 10 Most Common Violations

  • Employee Snooping: Accessing patient files, family records, or coworker charts without a direct, professional need to know.
  • Lost or Stolen Devices: Leaving unencrypted laptops, smartphones, tablets, or USB drives where they can be stolen or accessed by outsiders.
  • Failure to Conduct Risk Analyses: Neglecting regular, organization-wide checkups to find and fix security gaps.
  • Improper Disposal of Records: Tossing paper charts in regular trash or failing to securely wipe old hard drives.
  • Weak Passwords and Access Controls: Using simple passwords or giving too many staff members broad, unmonitored access to electronic records (ePHI).
  • Unauthorized Texting or Emailing: Sending patient details over regular, unsecured text messages or standard email instead of encrypted platforms.
  • Missing Business Associate Agreements (BAAs): Failing to sign legal BAA contracts with outside vendors and cloud providers who handle patient data.
  • Delayed Breach Notifications: Missing the legal deadline to notify patients, the government, and the media within 60 days of discovering a data breach.
  • Inadequate Employee Training: Not providing regular, documented privacy and security awareness education for staff.
  • Denying or Delaying Patient Access: Taking longer than allowed (or refusing outright) to give patients copies of their own medical records.

The 11 MOST Common HIPAA Violations

9 related questions found

What is the most common reason for a HIPAA violation?

The single most common reason for a HIPAA violation is unauthorized access to patient records (often called "snooping"), where staff members view Protected Health Information (PHI) without a legitimate clinical or business need to know.

Other Common HIPAA Violations

  • Impermissible Disclosures: Sharing or discussing patient information in public areas, on social media, or with unauthorized family members.
  • Lack of Employee Training: Employees making preventable mistakes due to inadequate or missing compliance training.
  • Improper Disposal: Tossing paper records in regular trash or failing to securely wipe digital drives.
  • Cybersecurity Weaknesses: Leaving electronic PHI (ePHI) vulnerable to hacking, ransomware, or phishing due to missing encryption or weak passwords.
  • Stolen or Lost Devices: Leaving unencrypted laptops, tablets, or phones unattended or accessible.

Does HR have to abide by HIPAA?

Human Resources (HR) departments do not generally have to abide by HIPAA, unless they handle protected health information linked to a company-sponsored, self-insured health plan or administer health benefits.

When HIPAA Does Not Apply to HR

  • Day-to-Day HR Records: Most medical information collected by HR—such as doctor's notes for sick leave, FMLA forms, accommodation requests, drug tests, or workers' compensation details—counts as employment records, not health plan data.
  • General Disclosures: If an employee voluntarily tells an HR manager about an illness, HIPAA does not govern that conversation.
  • Other Governing Laws: Even though HIPAA usually doesn't apply here, HR must still keep medical data private under other laws like the Americans with Disabilities Act (ADA), the Family and Medical Leave Act (FMLA), and the Genetic Information Nondiscrimination Act (GINA). These laws require storing medical files in separate, locked cabinets or secure digital folders apart from standard personnel files.

When HIPAA Does Apply to HR

  • Self-Insured Health Plans: If your company runs its own group health plan rather than buying fully insured commercial coverage, the plan is a covered entity under SHRM Cybersecurity Guidance. HR staff who handle health claims, enrollment data, or billing must follow HIPAA rules.
  • Firewalls and Segregation: If HR personnel handle health plan administration, they can only use protected health information for approved plan duties. They must legally separate that medical data from regular employee personnel files.
  • Third-Party Tools: If your HR team uses outside software or vendors to manage health data or benefits, the organization must secure a signed Business Associate Agreement (BAA) as outlined in resources like Virtru's HIPAA Guide for HR.

Can you get rehired after a HIPAA violation?

Yes, you can get rehired after a HIPAA violation, but it depends heavily on the severity of the offense and the policies of the employer.

Factors That Affect Rehire Eligibility

  • Minor or Accidental Infractions: If the violation was an honest mistake (like sending an email to the wrong person and quickly fixing it) with no malicious intent, some employers may consider you for rehire after time passes or retraining.
  • Gross Misconduct or Criminal Intent: If you were fired for intentionally snooping through patient files, stealing data, or sharing protected health information (PHI) online, companies will view you as a high legal and financial risk and rarely rehire you.
  • Licensing and Legal Status: Serious violations can lead to a suspended or revoked professional license or criminal charges, which legally bars you from working in certain healthcare roles.

What Employers Look At

  • Company Policy: Many healthcare organizations have strict internal rules that classify anyone fired for a data privacy breach as "not eligible for rehire".
  • Background Checks: Future employers may run Office of Inspector General (OIG) exclusion checks or verify your professional license, which can reveal past disciplinary actions.
  • Record Retention: Employers typically keep internal records of privacy sanctions and violations on file for at least six years.

What is the average payout for a HIPAA violation?

The average federal HIPAA settlement or fine tracked by the Office for Civil Rights (OCR) often centers around $1.5 million, though typical payouts vary wildly depending on the severity of the breach and the size of the organization.

HIPAA Penalty Tiers and Settlement Ranges

Federal civil penalties are grouped into four tiers based on culpability, with annual inflation-adjusted caps reaching over $2.1 million:

  • Tier 1 (Unknowing): $141 to $71,162 per violation (annual cap of $25,000–$25,000+)
  • Tier 2 (Reasonable Cause): $1,424 to $71,162 per violation (annual cap of $100,000)
  • Tier 3 (Willful Neglect - Corrected): $14,232 to $71,162 per violation (annual cap of $250,000)
  • Tier 4 (Willful Neglect - Uncorrected): $71,162 per violation (annual cap of $2.13 million+)

Settlement Costs by Organization Size

  • Small Clinics / Single-Location Providers: Frequently resolve for low five figures to low six figures if issues are fixed quickly. Recent single-entity OCR settlements range from $200,000 to $700,000.
  • Midsize Hospitals / Regional Networks: Settle in the mid-six figures to low seven figures for systemic risk-analysis or cybersecurity failures.
  • Large Health Plans / Mass Breaches: Multi-million-dollar resolutions are common for massive data leaks or multi-year noncompliance, such as past landmark settlements reaching $16 million.

Private Lawsuits and Additional Costs

Patients do not have a direct private right of action under federal HIPAA rules, but state-level negligence and class-action lawsuits can yield significant payouts (ranging from modest cash and credit monitoring to multi-million-dollar jury awards like Hinchy v. Walgreen Co.). Organizations also face steep hidden expenses, including legal defense, breach notifications, and mandatory credit-monitoring services.

How long does it take for a HIPAA violation to be investigated?

A HIPAA violation investigation by the U.S. Department of Health and Human Services Office for Civil Rights (OCR) typically takes anywhere from several months to over a year, with many complex cases or major data breaches lasting multiple years.

While the OCR aims to review and handle complaints efficiently, there is no fixed universal deadline for completion.

Investigation Stages and Timelines

  • Initial Intake and Review: Takes weeks to months. The OCR screens the complaint or breach report to see if it has legal authority to investigate.
  • Evidence and Information Requests: Takes 30 to 90 days. The OCR asks the healthcare organization for documents, policies, and system logs.
  • Full Investigation Findings: Takes 6 to 18 months on average. Complex cases, large-scale data breaches affecting 500+ people, or systemic issues often extend well past a year.
  • Corrective Action Monitoring: Takes 1 to 3 years if a Corrective Action Plan (CAP) or settlement is put in place.

Important Deadlines to Know

  • 180 days: The window patients have to file a privacy complaint with the OCR after discovering a violation.
  • 60 days: The window healthcare groups have to report a major data breach to the OCR and affected individuals.
  • 30 days: The timeframe to pay a fine after signing an official resolution agreement.