What is the biggest HIPAA violation?

Editorial team Published on

The largest federal HIPAA penalty and settlement in history belongs to Anthem, Inc., which paid a $16 million fine to the U.S. Department of Health and Human Services (HHS) Office for Civil Rights alongside a $115 million class-action lawsuit settlement.

Key Details of the Case

  • The Incident: A massive 2015 cyberattack compromised the electronic protected health information (ePHI) of nearly 79 million individuals.
  • Exposed Data: Sensitive information including names, social security numbers, birthdays, medical IDs, and income details.
  • The Violations: Investigations revealed that Anthem, Inc. failed to execute an enterprise-wide risk analysis, lacked sufficient system activity monitoring, and did not properly implement technical access controls or security measures to detect unauthorized ePHI access.

What are the top 5 HIPAA violations?

The top 5 most common HIPAA violations involve failing to protect patient data through unauthorized access, weak safeguards, or delayed notifications.

1. Unauthorized Access to Patient Records

  • What it is: Staff members viewing Protected Health Information (PHI) out of curiosity or without a direct clinical need.
  • Example: Looking up the medical chart of a coworker, family member, or celebrity.

2. Theft or Loss of Unencrypted Devices

  • What it is: Laptops, phones, or USB drives containing electronic PHI (ePHI) going missing without proper encryption.
  • Example: Leaving a portable hard drive in an unlocked car where it gets stolen.

3. Lack of an Enterprise Risk Analysis

  • What it is: Failing to conduct regular, thorough security reviews of organizational systems and vulnerabilities.
  • Example: Not checking software or networks for security gaps that later lead to ransomware attacks.

4. Improper Disposal of Patient Records

  • What it is: Tossing physical paper files or un-wiped electronic media straight into standard trash or recycling bins.
  • Example: Putting printed daily appointment schedules into an open office dumpster.

5. Failure to Issue Timely Breach Notifications

  • What it is: Failing to notify affected individuals, the government, or the media within the mandatory 60-day window following a discovered data breach.
  • Example: Waiting six months to tell patients that their health records were exposed in a cyberattack.

What are the 10 most common HIPAA violations?

The 10 most common HIPAA violations involve mishandling protected health information (PHI) through employee error, weak security, or administrative oversight.

Top 10 Most Common Violations

  • Employee Snooping: Accessing patient files, family records, or coworker charts without a direct, professional need to know.
  • Lost or Stolen Devices: Leaving unencrypted laptops, smartphones, tablets, or USB drives where they can be stolen or accessed by outsiders.
  • Failure to Conduct Risk Analyses: Neglecting regular, organization-wide checkups to find and fix security gaps.
  • Improper Disposal of Records: Tossing paper charts in regular trash or failing to securely wipe old hard drives.
  • Weak Passwords and Access Controls: Using simple passwords or giving too many staff members broad, unmonitored access to electronic records (ePHI).
  • Unauthorized Texting or Emailing: Sending patient details over regular, unsecured text messages or standard email instead of encrypted platforms.
  • Missing Business Associate Agreements (BAAs): Failing to sign legal BAA contracts with outside vendors and cloud providers who handle patient data.
  • Delayed Breach Notifications: Missing the legal deadline to notify patients, the government, and the media within 60 days of discovering a data breach.
  • Inadequate Employee Training: Not providing regular, documented privacy and security awareness education for staff.
  • Denying or Delaying Patient Access: Taking longer than allowed (or refusing outright) to give patients copies of their own medical records.

What is the largest HIPAA fine ever paid?

The largest HIPAA fine ever paid is $16 million, settled by Anthem, Inc. in 2018 with the U.S. Department of Health and Human Services Office for Civil Rights (OCR).

Details of the Anthem Case

  • The Breach: Advanced cyberattacks using spear-phishing emails exposed the electronic protected health information of nearly 79 million people.
  • Stolen Data: Names, social security numbers, medical identification numbers, dates of birth, and income data.
  • The Violations: Anthem failed to conduct an enterprise-wide risk analysis, lacked proper access controls, and failed to adequately monitor system activity or respond to security incidents.
  • Additional Cost: Alongside the federal fine, Anthem also settled a related consolidated class-action lawsuit for $115 million.

What are some examples of HIPAA violations?

A HIPAA violation occurs when an individual or organization accesses, shares, or handles Protected Health Information (PHI) in a way that breaks federal privacy, security, or breach notification rules.

Common Examples of HIPAA Violations

  • Employee Snooping: Staff members looking up medical files of family members, friends, or public figures without a legitimate job-related reason.
  • Unencrypted Devices: Leaving laptops, tablets, or smartphones containing PHI unencrypted or unsecured, leading to lost or stolen data.
  • Improper Disposal: Tossing paper charts, prescription bottles, or unswiped hard drives into regular trash instead of securely shredding or destroying them.
  • Unsecured Communication: Sending patient details, lab results, or billing info via regular text messages or unencrypted emails.
  • Public Discussions: Talking about a patient's condition in open areas like waiting rooms, cafeterias, or elevators where others can overhear.
  • Missing Business Associate Agreements (BAAs): Working with third-party vendors (such as cloud storage or billing contractors) without signing a formal legal BAA.
  • Delayed Breach Notifications: Failing to notify affected patients or the government within 60 days of discovering a data breach.
  • Denying Patient Access: Refusing or taking longer than 30 days to give patients copies of their own medical records upon request.

You can review official case resolution summaries provided by the U.S. Department of Health and Human Services to see how past violations were handled. For a deeper breakdown of penalties and rules, visit BestNotes or read through Fortinet's compliance guide.

The 11 MOST Common HIPAA Violations

9 related questions found

Can HIPAA ever be violated?

No, not just anyone can violate HIPAA; the law only applies to specific groups known as covered entities and their business associates.

Who Can Violate HIPAA

  • Covered Entities: This includes health care providers (like doctors, clinics, and hospitals that transmit health data electronically), health insurance plans, and health care clearinghouses.
  • Business Associates: These are outside vendors, contractors, or service providers (such as cloud storage providers, billing companies, or IT consultants) that handle protected health information on behalf of a covered entity.
  • Employees and Workforce Members: Any individual working for a covered entity or business associate—such as nurses, receptionists, or administrators—can commit a violation if they mishandle patient data.

Who Cannot Violate HIPAA

  • Private Individuals: Ordinary people who do not work for a health care provider or its partners cannot violate HIPAA. For example, if a private citizen posts a neighbor's medical diagnosis on social media, it is a general privacy breach or gossip, but it is not a legal HIPAA violation.
  • Non-covered Workers: Employees at businesses or organizations completely unrelated to health care cannot violate this federal law.

What are the 5 main HIPAA rules?

The five main rules of the Health Insurance Portability and Accountability Act (HIPAA) are the Privacy Rule, Security Rule, Breach Notification Rule, Transactions and Code Sets Rule, and Unique Identifiers Rule.

1. The Privacy Rule

  • What it does: Controls how protected health information (PHI) is used and shared by healthcare providers and plans.
  • Key right: Gives patients the right to view, get copies of, and request corrections to their medical records.

2. The Security Rule

  • What it does: Protects electronic protected health information (ePHI).
  • Key controls: Requires administrative, physical, and technical safeguards—such as encryption and access controls—to secure digital medical data.

3. The Breach Notification Rule

  • What it does: Requires healthcare groups to report compromised PHI.
  • Key requirement: Mandates notifying affected individuals, the government, and sometimes the media without unreasonable delay (within 60 days).

4. The Transactions and Code Sets Rule

  • What it does: Standardizes electronic billing and data exchanges.
  • Key goal: Makes healthcare claims and transactions uniform and efficient by using standard coding formats like ICD-10.

5. The Unique Identifiers Rule

  • What it does: Assigns standard identification numbers to healthcare participants.
  • Key example: Requires providers to use a unique 10-digit National Provider Identifier (NPI).

What are some famous HIPAA violation cases?

Some of the most famous HIPAA violation cases involve massive data breaches, internal record snooping, and severe financial penalties.

Major Data Breaches and Fines

  • Anthem Inc.: A 2015 cyberattack via spear-phishing exposed the personal and health data of nearly 79 million people. Anthem paid a record $16 million fine to the federal government and a $115 million class-action settlement.
  • Premera Blue Cross: Hackers used malware from a phishing email to access the health data of 10.4 million individuals. The breach went unnoticed for nearly nine months, resulting in a $6.85 million settlement.
  • Advocate Health Care Network: A series of data breaches—including stolen unencrypted laptops—affected over 4 million people. They agreed to a then-record $5.55 million settlement.

Internal Snooping and Employee Misconduct

  • Memorial Healthcare System: Dozens of staff members improperly used login credentials of former employees to access patient data between 2011 and 2021. They paid a $5.5 million settlement for failing to monitor system activity.
  • UCLA Health System: Employees repeatedly snooped on the medical records of high-profile celebrity patients without a work purpose. The system faced an $865,000 fine and corrective actions, while individual workers faced criminal charges and termination.

What is the new HIPAA rule in 2026?

The main new HIPAA requirement for 2026 is updating privacy notices under the HHS Model Notices of Privacy Practices to include stricter protections for substance use disorder (SUD) patient records.

Key 2026 Privacy Rule Updates

  • February 16, 2026 Deadline: Healthcare providers and health plans had to update their Notice of Privacy Practices (NPP).
  • Substance Use Records: Notices must now explain how substance use disorder records are protected under 42 CFR Part 2.
  • Legal Protections: Patient records generally cannot be used in civil or criminal legal cases without explicit consent or a court order.
  • Patient Rights: Patients gained clearer rights to restrict sharing, opt out of fundraising, and file complaints.

Proposed Security Rule Changes (Under Review)

Regulators are also pushing a major update to the HIPAA Security Rule that changes how organizations handle data safety:

  • No More "Addressable" Rules: Optional security steps are becoming mandatory.
  • Mandatory MFA: Multi-factor authentication is required across all systems.
  • Required Encryption: Patient data must be encrypted both in transit and at rest.

Can normal people violate HIPAA?

No, a regular private person cannot violate HIPAA unless they work for a healthcare provider, health plan, healthcare clearinghouse, or a business partner of one of those organizations.

Who HIPAA Applies To

  • Covered entities: Doctors, hospitals, clinics, nursing homes, pharmacies, and health insurance companies.
  • Business associates: Contractors, billing companies, IT providers, or vendors who handle protected health information on behalf of a covered entity.
  • Most users on Reddit agree that a private individual without a professional healthcare role is not subject to HIPAA regulations.

When a "Regular Person" Might Seem to Violate HIPAA

  • Family and friends: If a friend or family member shares someone else's medical diagnosis, it is a bad breach of trust or an invasion of privacy, but it is not a federal HIPAA violation because they are not a medical provider.
  • Patients sharing their own info: Patients can share their own medical records anywhere they want. They cannot violate HIPAA regarding their own data.
  • Former or current healthcare workers: If an everyday person is actually a nurse, receptionist, or billing clerk who snoops on charts or blabs about a patient outside of work, they can be held liable because they work for a covered entity.

Other Legal Protections

Even though regular people cannot violate HIPAA, sharing private medical data can still break other laws. Victims can sometimes sue under state privacy laws or common-law torts for an invasion of privacy or defamation. You can learn more about how rules are applied or file a grievance through the U.S. Department of Health and Human Services.