HIPAA violations and how they are enforced
The HHS Office for Civil Rights (OCR) enforces HIPAA’s civil rules; the Department of Justice handles criminal cases. Here is what tends to go wrong, how civil penalties are tiered, and how complaints work.
Last reviewed against the Code of Federal Regulations (45 CFR Parts 160 and 164) and HHS OCR guidance linked on this page on .
The short answer
A HIPAA violation is a failure to meet a requirement of the Privacy, Security, or Breach Notification Rules — not only a data leak. Missing a risk analysis, not answering a patient’s records request in time, or sharing PHI with a vendor that has no BAA are all violations even if no data is lost.
Patterns that recur in OCR enforcement
OCR’s published resolution agreements and civil money penalties (opens in a new tab) repeatedly involve the same failures:
- no accurate and thorough risk analysis, or no risk management after one;
- not giving patients timely access to their records — the focus of OCR’s Right of Access Initiative;
- impermissible disclosures, including PHI shared on social media or in responses to online reviews;
- PHI handled by a vendor without a business associate agreement;
- lost or stolen unencrypted devices;
- weak access controls and no review of system activity, which lets hacking or snooping go unnoticed.
OCR’s enforcement highlights (opens in a new tab) publish the most common compliance issues across all cases.
How civil money penalties are tiered (45 CFR 160.404)
| Tier | Level of culpability |
|---|---|
| 1 | The organisation did not know, and by exercising reasonable diligence would not have known, of the violation. |
| 2 | The violation was due to reasonable cause and not to willful neglect. |
| 3 | Willful neglect, corrected within 30 days of when the organisation knew or should have known. |
| 4 | Willful neglect, not corrected within 30 days. |
Penalty ranges per violation and annual caps rise with each tier. HHS adjusts the dollar amounts for inflation every year, so check the current figures on HHS or in the Federal Register rather than a number copied from a website. Many cases end in a resolution agreement and corrective action plan rather than a penalty.
Criminal penalties
Knowingly obtaining or disclosing individually identifiable health information in violation of HIPAA is a federal crime under 42 U.S.C. 1320d-6 (opens in a new tab), prosecuted by the Department of Justice. The statute sets higher maximum fines and prison terms where the offence involves false pretenses, or intent to sell, transfer, or use the information for commercial advantage, personal gain, or malicious harm.
Filing or responding to a complaint
Anyone can file a complaint with OCR (opens in a new tab). Complaints generally must be filed within 180 days of when the person knew of the problem; OCR can extend that for good cause. HIPAA prohibits retaliation against someone for filing. State attorneys general can also bring civil actions under HIPAA on behalf of state residents.
Common questions
- Is every data breach a HIPAA violation?
- Not necessarily. An organisation can suffer a breach despite reasonable safeguards. The violation questions are whether its safeguards met the Security Rule and whether it followed the Breach Notification Rule afterward.
- Can an individual sue under HIPAA?
- HIPAA does not give individuals a private right of action. People can complain to OCR, and state attorneys general can sue; state laws may provide other remedies.
- Can a practice reply to an online review?
- It can reply, but confirming that the reviewer is a patient or discussing their care can be an impermissible disclosure. Several OCR settlements involve exactly this.
Sources
- 45 CFR § 160.404 — Amount of a civil money penalty (opens in a new tab) — Electronic Code of Federal Regulations
- Resolution Agreements and Civil Money Penalties (opens in a new tab) — HHS Office for Civil Rights
- Enforcement Highlights (opens in a new tab) — HHS Office for Civil Rights
- Filing a HIPAA complaint (opens in a new tab) — HHS Office for Civil Rights
- 42 U.S.C. § 1320d-6 — Wrongful disclosure of individually identifiable health information (opens in a new tab) — Legal Information Institute, Cornell Law School (U.S. Code text)
Questions about this page
Ask about anything explained here, or tell us if a citation is out of date. We can point you to the HHS source; we cannot advise on your organisation’s obligations. Do not send protected health information through this form.
Get in touch
Last reviewed against the Code of Federal Regulations (45 CFR Parts 160 and 164) and HHS OCR guidance linked on this page on .
Every requirement on this page is cited to the regulation or to HHS guidance. If you find one that has changed, tell us and we will correct it.