10 Common HIPAA Violations and How to Prevent Them

Most HIPAA violations start with everyday gaps in who can open patient records, how that data gets shared, and how fast an organization responds when something goes wrong.

Those gaps add up. Since April 2003, the HHS Office for Civil Rights (OCR) has received more than 374,000 complaints alleging HIPAA violations and resolved 152 cases with settlements or civil money penalties totaling $144.9 million, according to its enforcement highlights. The penalties are also getting heavier. Since January 28, 2026, a single violation can cost up to $73,011, with an annual cap of $2,190,294 for each provision violated, under the 2026 inflation adjustment. OCR has also been clear about where it is looking. When it announced a settlement under its Risk Analysis Initiative in 2025, the agency’s acting director said, “Effective cybersecurity includes knowing who has access to electronic health information.”

HIPAA violations can arise from everyday gaps in how healthcare organizations protect patient information, manage access, and respond to incidents. Common enforcement issues include impermissible uses or disclosures of protected health information (PHI), inadequate security safeguards, failures to conduct risk analyses, and delays in providing patients with access to their records.

This guide examines 10 common HIPAA compliance failures, using real enforcement actions to illustrate the risks and practical controls organizations can implement to reduce exposure. It also explains the applicable penalty framework and why accurate user identification and audit trails matter when employees access PHI on shared workstations.

What Counts as a HIPAA Violation?

HIPAA violations happen when a covered entity, a business associate, or a member of their workforce fails to meet a standard in the HIPAA Privacy Rule, Security Rule, or Breach Notification Rule. Covered entities include health plans, healthcare clearinghouses, and most healthcare providers. Business associates are vendors that handle protected health information (PHI) on their behalf.

HIPAA Violation vs Data Breach

The two terms get used interchangeably, but they are different. A HIPAA violation occurs when a covered entity or business associate fails to comply with an applicable HIPAA requirement. A breach, under the HIPAA Breach Notification Rule, generally involves an impermissible use or disclosure of unsecured protected health information that compromises its security or privacy, unless an exception applies or the organization demonstrates through the required risk assessment that there is a low probability the PHI was compromised.

The terms are related but not interchangeable. An organization can violate HIPAA without a reportable breach, such as by failing to conduct a required risk analysis. When an incident involving PHI occurs, the organization must assess the circumstances, determine whether breach notification is required, and document its response.

The difference matters when OCR investigates HIPAA violations. It asks whether safeguards were in place before the incident, not only what happened during it.

10 Common HIPAA Compliance Failures and Real Enforcement Examples

Here are the 10 most common HIPAA violations, the rule each breaks, a real enforcement example, and the primary fix.

Note: The enforcement examples illustrate specific HIPAA compliance issues. OCR settlements may address multiple alleged violations, and settlement amounts should not be interpreted as standard penalties for an individual type of violation.

The 10 Most Common HIPAA Violations, Explained

1. Employees Snooping on Patient Records

Snooping is unauthorized access to PHI by someone with legitimate system access: a staff member checking a celebrity’s chart, a coworker’s diagnosis, or an ex-partner’s records. It is one of the most common HIPAA violations because it requires no hacking, only curiosity and an open session. Snooping cases are among the most widely reported HIPAA violation examples.

When OCR penalizes snooping, the underlying failure is rarely the employee alone. It is the absence of controls that would have flagged the access sooner.

How to prevent it: apply minimum-necessary access by role, review audit logs for unusual patterns such as after-hours access or high record volumes, and enforce a documented sanctions policy.

2. Shared Logins and Weak HIPAA Access Controls

HIPAA access controls must limit ePHI to authorized users, including unique user identification for every person. Shared department accounts, credentials passed between shifts, and accounts left active after people leave all break that requirement and open the door to unauthorized access to PHI.

Some of OCR’s largest settlements trace back to this gap, including cases where a former employee’s credentials kept working long after they left.

How to prevent it: give every user a unique ID, deprovision accounts the day someone leaves, run periodic access reviews, and use role-based access control so people see only what their job requires. Our HIPAA access control checklist covers each requirement in detail.

3. No Organization-Wide HIPAA Risk Analysis

A HIPAA risk analysis identifies where ePHI lives and what threatens it. It is the foundation of the Security Rule, and it is the most frequently cited failure in OCR settlements for HIPAA violations. OCR now runs a dedicated Risk Analysis Initiative focused on this requirement alone.

The common thread across these HIPAA violations is a risk analysis that was never done, covered only part of the organization, or was years out of date.

How to prevent it: run an enterprise-wide HIPAA risk analysis covering every system, device, and vendor that touches ePHI, and repeat it whenever systems or workflows change.

4. No Risk Management After the Analysis

Finding risks is only half the requirement. The Security Rule also requires organizations to reduce identified risks to a reasonable level. Many organizations complete a HIPAA risk analysis, file it, and never act on it. That gap sits behind some of the costliest HIPAA violations OCR has settled, often involving known vulnerabilities that left ePHI exposed on the internet.

How to prevent it: turn every finding into a remediation item with an owner, a deadline, and evidence of completion.

5. Unencrypted Laptops, Phones, and Portable Media

Under the current HIPAA Security Rule, encryption is an addressable implementation specification. Addressable does not mean optional: organizations must assess whether the specification is reasonable and appropriate in their environment. If they do not implement it, they must document why and implement an equivalent alternative measure when reasonable and appropriate.

How to prevent it: Assess the risks associated with devices and removable media that store ePHI, implement encryption where reasonable and appropriate, document decisions and alternative safeguards, and use device-management controls to support enforcement and remote wiping.

6. Impermissible Disclosures of PHI

Impermissible disclosures are the HIPAA violations most often alleged in complaints to OCR. Common HIPAA violation examples include posting patient details on social media, texting PHI over unsecured apps, discussing patients where others can hear, emailing records to the wrong recipient, and allowing filming in clinical areas without patient authorization.

How to prevent it: set clear policies on messaging apps and social media, train staff with real scenarios, and apply sanctions consistently so the policy carries weight.

7. Denying or Delaying Patient Access to Records

Under the HIPAA Privacy Rule, covered entities generally must act on an individual's request for access to protected health information within 30 days. A single extension of up to 30 additional days may be available when the applicable requirements are met, including providing the individual with a written explanation and expected completion date.

How to prevent it: Assign responsibility for access requests, track deadlines, document any permitted extension, coordinate with release-of-information vendors, and ensure fees comply with applicable requirements.

8. No Business Associate Agreement

Any vendor that creates, receives, or stores PHI on your behalf needs a signed business associate agreement (BAA). A missing BAA counts among HIPAA violations even when no breach occurs, including when PHI is shared with a contractor before the paperwork is in place.

How to prevent it: keep an inventory of every vendor that touches PHI, confirm a BAA exists for each, and review it at contract renewal.

9. Missing the 60-Day Breach Notification Deadline

The HIPAA Breach Notification Rule generally requires covered entities to notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering a breach of unsecured PHI. Breaches affecting 500 or more individuals also trigger notification to HHS within the applicable timeframe, and breaches affecting more than 500 residents of a state or jurisdiction may require media notification. Smaller breaches are subject to separate HHS reporting deadlines.

How to prevent it: Maintain an incident response plan with defined responsibilities, escalation procedures, breach-assessment steps, and notification timelines. Test the process periodically and retain documentation of decisions and notices.

10. Improper Disposal of PHI

HIPAA requires covered entities and business associates to implement reasonable safeguards when disposing of PHI and when reusing electronic media. Paper records, storage devices, photocopiers, and other equipment may retain sensitive information if disposal or media sanitization is handled improperly.

How to prevent it: Establish documented disposal procedures, use appropriate destruction or media-sanitization methods, manage vendors with access to PHI, and retain records of disposal when appropriate.

Why Shared Workstations Make HIPAA Compliance Harder

Several of these HIPAA violations share a root cause that rarely appears in the policy manual: shared credentials on shared workstations.

The Security Rule expects every action involving ePHI to trace back to one person. It requires unique user identification, automatic logoff, and audit controls that record who accessed what. When a nursing unit, pharmacy counter, or registration desk runs on one shared login, those HIPAA access controls stop working, and HIPAA violations follow in three ways.

• Snooping becomes impossible to prove. The audit log shows the shared account opened a record. It can’t show which of the people on shift did it, so sanctions stall and the investigation widens.
• One person’s mistake becomes the organization’s. OCR treats unattributed access as an access-control failure. A violation that should have been one employee’s becomes evidence that the organization lacks unique user identification.
• Breach assessments get harder. Without attribution, the organization can’t show the access was limited, which weakens its case that the risk of compromise was low.

Staff rarely share logins out of carelessness. On a busy unit, a clinician may sign in to a shared workstation dozens of times a shift, often with gloves on, and a full password plus MFA each time is not workable. The workaround is a session left open or a password written on the monitor. The same pattern, and the same HIPAA violations, show up at pharmacy counters, in long-term care, and in EMS crews sharing tablets. We cover the audit impact in depth in shared passwords on the frontline break audit trails.

The fix is to make individual sign-in faster than sharing. A badge tap paired with a face match takes seconds. Presence detection locks the screen when a worker walks away, and fast user switching hands the workstation to the next person without inheriting the last session. Our guide to passwordless EHR access on shared workstations walks through the workflow.

Make every PHI access traceable to one person. OLOID’s auditable shared account login ties each session on a shared workstation to a verified individual. Book a demo

How OCR Finds HIPAA Violations

Most HIPAA violations reach OCR through four routes:

• Patient and employee complaints. Complaints are an important source of information for OCR investigations. OCR’s most common complaint allegations are improper uses and disclosures, inadequate safeguards, and denied access to records.
• Breach reports. Breaches affecting 500 or more individuals must be reported to HHS and may receive OCR scrutiny. Reporting does not necessarily mean that every incident will result in a formal investigation.
• Compliance reviews and audits, including targeted initiatives such as risk analysis and right of access.
• Media reports and referrals from other agencies.

Once an investigation opens, OCR asks for documentation: the risk analysis, policies, training records, BAAs, and audit logs. Organizations that can’t produce them turn a single incident into findings of multiple HIPAA violations.

HIPAA Violation Penalties in 2026

HIPAA civil monetary penalties depend on the nature of the violation, the organization's level of culpability, and the applicable penalty rules. HHS adjusts penalty amounts for inflation, and enforcement discretion may affect the limits OCR applies in practice.

The figures below reflect the cited 2026 inflation adjustment. Before relying on them for compliance planning, distinguish the published regulatory limits from any applicable enforcement-discretion limits and confirm the effective dates and amounts against the current HHS guidance.

Source: HHS Annual Civil Monetary Penalties Inflation Adjustment, Federal Register, January 28, 2026.

Under a 2019 enforcement discretion notice, HHS has applied lower annual caps of $25,000, $100,000, $250,000 and $1.5 million across the four tiers. The 2026 adjustment does not reflect these lower caps, so the figures above remain the regulatory ceiling.

Two things make HIPAA violation penalties costlier than the table suggests. The annual cap applies per provision, so an investigation that finds HIPAA violations in risk analysis, access control, and audit controls can stack several caps. And most settlements include a corrective action plan with two or more years of OCR monitoring and reporting, and some require independent assessments. Individuals who knowingly obtain or disclose PHI can also face criminal penalties for HIPAA violations, with fines up to $250,000 and prison terms up to ten years for the most serious offenses.

How to Prevent HIPAA Violations: A Control Checklist

Knowing how to prevent HIPAA violations comes down to a short list of controls, each tied to the violations above:

• Run an enterprise-wide HIPAA risk analysis at least annually and after major changes. (Prevents 3, 4)
• Track remediation with owners, deadlines, and evidence. (Prevents 4)
• Assign a unique ID to every user and remove shared department accounts. (Prevents 1, 2)
• Enforce automatic logoff and presence-based locking on shared workstations. (Prevents 1, 2)
• Review audit logs for unauthorized access to PHI and act on findings. (Prevents 1, 2)
• Encrypt every device that can store ePHI. (Prevents 5)
• Keep a BAA inventory for every vendor touching PHI. (Prevents 8)
• Run a right-of-access workflow with a 30-day clock. (Prevents 7)
• Maintain and rehearse an incident response plan. (Prevents 9)
• Document PHI destruction for paper and electronic media. (Prevents 10)
• Train with real scenarios and apply sanctions consistently. (Prevents 1, 6)

For the authentication side of this list, see our guide to HIPAA-compliant authentication.

What the Proposed HIPAA Security Rule Update Would Change

In January 2025, HHS proposed the first major update to the Security Rule in more than a decade. The proposal would remove the distinction between “required” and “addressable” specifications, make encryption and multi-factor authentication explicit requirements, and require a written inventory of technology assets that handle ePHI.

The rule is not final. Organizations that already enforce unique sign-in, MFA, and encryption won’t need to rebuild when it lands, and they are already better placed against today’s most common HIPAA violations. Until then, the checklist above shows how to prevent HIPAA violations under the current rule.

Prevent Access-Related HIPAA Violations With OLOID

Most HIPAA violations on this list come down to two questions OCR will ask: who accessed the record, and could you prove it? On shared workstations, shared logins make both questions impossible to answer.

OLOID gives healthcare teams fast, individual sign-in on shared devices with a badge tap, face, or palm, so every session belongs to one verified person and every audit log entry names the right user, which closes the access-related HIPAA violations behind items 1 and 2. Explore OLOID for healthcare or book a demo to see it on your workstations.

Frequently Asked Questions

1. What is the most common HIPAA violation?

Impermissible uses and disclosures of PHI are the most common HIPAA violations alleged in complaints to OCR, followed by inadequate safeguards and denied access to records. In settlements, failing to conduct a risk analysis is the most frequently cited failure.

2. Is sharing passwords a HIPAA violation?

Yes. The Security Rule requires unique user identification so every access to ePHI can be traced to one person. Shared passwords break that requirement and weaken audit controls, which makes other HIPAA violations harder to investigate.

3. Can an employee be fired for a HIPAA violation?

Yes. HIPAA requires covered entities to have and apply a sanctions policy, and termination is a common sanction for snooping and other intentional HIPAA violations. Individuals can also face criminal penalties for knowingly obtaining or disclosing PHI.

4. How much is a HIPAA violation fine in 2026?

Civil HIPAA violation penalties range from $145 to $73,011 per violation, with an annual cap of $2,190,294 per provision for penalties assessed on or after January 28, 2026.

5. Is a data breach always a HIPAA violation?

No. A breach is an impermissible use or disclosure of PHI. It becomes a HIPAA violation when the organization lacked required safeguards or failed to respond and notify correctly.

6. How are HIPAA violations discovered?

Most HIPAA violations surface through patient or employee complaints, breach reports, OCR compliance reviews, and media coverage. Audit logs often provide the evidence once an investigation begins.