HIPAA Violations: What Counts, Real Examples, and the 2026 Fines and Penalties

A clinic's laptop is stolen from a car. The device is password protected, the files are not encrypted, and it holds a few thousand patient records. The theft is a breach. Whether it becomes a costly HIPAA violation depends on what the clinic did before it happened: had it assessed the risk of unencrypted devices, and decided how to manage it?

That is the pattern behind most enforcement. This guide explains what counts as a HIPAA violation, the examples regulators see most, the 2026 penalty amounts, and the steps that prevent them, whether you are a covered entity or a vendor handling PHI for one.

Quick answer: A HIPAA violation is any failure by a covered entity or business associate to meet the HIPAA Privacy, Security or Breach Notification Rules, such as an impermissible disclosure of protected health information (PHI), a missing safeguard, or a missed deadline. In 2026, civil penalties range from $145 to $2,190,294 per violation depending on culpability, and knowingly misusing PHI can bring criminal fines of up to $250,000 and up to ten years in prison.

What Counts as a HIPAA Violation?

HIPAA applies to covered entities (health plans, clearinghouses and most health care providers) and to business associates that handle PHI for them. If you are not sure which you are, start with our guide to HIPAA covered entities vs business associates. A violation usually falls into one of three groups:

• Impermissible uses and disclosures. PHI is viewed, shared or sold without a permitted purpose or the patient's authorization.
• Missing safeguards. The Security Rule's administrative, physical or technical safeguards for electronic PHI are absent or inadequate, starting with the risk analysis.
• Missed obligations. Breach notifications are late, patients don't get timely access to their records, or business associate agreements are missing.

10 Common HIPAA Violation Examples

1. No organization-wide risk analysis. The most cited failure in enforcement actions. The analysis must cover every system that creates, receives, maintains or transmits ePHI.
2. Not managing identified risks. Finding a risk and leaving it open is a violation of its own.
3. Snooping. Staff viewing records of patients they are not treating, including family, colleagues or celebrities.
4. Denying or delaying patient access. Patients have a right to their records, and late responses have led to many settlements.
5. No business associate agreement. Sharing PHI with a vendor, such as a cloud, billing or IT provider, without a signed BAA.
6. Weak access controls. Shared logins, no unique user IDs, or access not removed when staff leave.
7. Unencrypted devices. Lost or stolen laptops, phones and drives holding ePHI.
8. Late breach notification. Missing the 60-day limit for notifying individuals, or a business associate not telling the covered entity in time.
9. Impermissible disclosures. Sharing PHI with the wrong person, on social media, or with the press.
10. Improper disposal. Paper records or devices thrown away without shredding or wiping.

HIPAA Violation Fines and Penalties in 2026

Civil money penalties are set by culpability tier and adjusted for inflation each year. These are the amounts in effect from 28 January 2026.

The regulations allow an annual cap of $2,190,294 per violation type in every tier. Since 2019, OCR has applied the lower caps in the third column to the first three tiers under its notice of enforcement discretion, adjusted here for inflation. Caps apply per type of violation, so one investigation can add up to more than one cap.

In practice, most OCR cases end in a resolution agreement: a settlement payment plus a corrective action plan, often monitored for two years or more. Recent settlements continue to cite risk analysis failures. For example, the HIPAA Journal's settlement tracker lists a 2026 settlement of $700,000 with Ambry Genetics involving a risk analysis failure, failure to terminate access to ePHI, and shared usernames.

Criminal penalties

Criminal cases are prosecuted by the Department of Justice. State attorneys general can also bring civil actions under HIPAA on behalf of state residents.

Is a Breach a HIPAA Violation?

Not automatically. A breach of unsecured PHI triggers notification duties to individuals, HHS and, for breaches affecting more than 500 residents of a state or jurisdiction, the media. It becomes a violation when an investigation finds a HIPAA requirement was not met. That is why the evidence you can show after an incident matters: a current risk analysis, the safeguards it led to, training records, and a timely, documented response.

How to Report a HIPAA Violation

• Internally: workforce members should report to their organization's privacy or security officer. Organizations must not retaliate against people who report.
• To HHS: anyone can file a complaint with the HHS Office for Civil Rights online, by mail or by email. Complaints should generally be filed within 180 days of when the person knew about the problem, and OCR can extend this for good cause.
• Suing: HIPAA gives individuals no private right of action. Claims may still be possible under state law, so speak to a lawyer about a specific case.

What HIPAA Violations Mean for Business Associates

Since the 2013 Omnibus Rule, business associates are directly liable for the Security Rule, for impermissible uses and disclosures, and for notifying the covered entity of a breach no later than 60 days after discovery. A SaaS, cloud or billing vendor can be investigated and penalized in its own right, and a covered entity can lose confidence in a vendor long before any regulator gets involved.

Hospitals and health plans increasingly ask vendors to prove their safeguards before signing a BAA. The usual evidence is a documented HIPAA risk analysis, plus an independent report such as a SOC 2 report, an ISO 27001 certificate or HITRUST certification. There is no official HIPAA certification recognized by HHS.

How to Prevent HIPAA Violations: A Checklist

1. Run an organization-wide risk analysis covering every system and vendor that touches ePHI, and update it when systems change.
2. Manage the risks it finds, with owners and dates.
3. Lock down access: unique user IDs, role-based access, multi-factor authentication, and prompt removal of leavers.
4. Encrypt ePHI on laptops, phones, removable media and in transit.
5. Turn on audit logs and review them, so snooping is detected.
6. Sign BAAs with every vendor that handles PHI, and flow terms down to subcontractors.
7. Train the workforce at onboarding and regularly after that.
8. Prepare a breach response plan with the 60-day notification clock built in.
9. Track patient access requests so none run late.
10. Keep policies and records for six years, as the rules require.

For a structured way to run the risk analysis, see our guide to an ISO 27001 risk assessment, which follows a similar method.

HIPAA Violations FAQ

What is a HIPAA violation?
A HIPAA violation is a failure by a covered entity or business associate to comply with the HIPAA Privacy, Security or Breach Notification Rules. It can be an impermissible use or disclosure of protected health information (PHI), a missing safeguard such as a risk analysis or access controls, or a missed deadline such as breach notification or giving patients access to their records.

What are common examples of HIPAA violations?
Common examples include not doing an organization-wide risk analysis, staff snooping on patient records, sharing PHI without authorization, not giving patients timely access to their records, having no business associate agreement with a vendor that handles PHI, weak access controls, unencrypted laptops or devices that are lost, missing the 60-day breach notification deadline, and improper disposal of records.

What is the fine for a HIPAA violation?
Civil penalties depend on culpability. For 2026 the inflation-adjusted range runs from $145 to $73,011 per violation for the lowest tier, up to $73,011 to $2,190,294 per violation for willful neglect that is not corrected. Annual caps per violation type are lower for the first three tiers under OCR's 2019 enforcement discretion. Many cases end in settlements and corrective action plans rather than penalties.

What are the criminal penalties for HIPAA violations?
Under 42 U.S.C. 1320d-6, knowingly obtaining or disclosing PHI in violation of HIPAA can lead to a fine of up to $50,000 and up to one year in prison. The maximum rises to $100,000 and five years if done under false pretenses, and $250,000 and ten years if done with intent to sell, transfer or use PHI for commercial advantage, personal gain or malicious harm. Criminal cases are prosecuted by the Department of Justice.

Is a data breach always a HIPAA violation?
No. A breach of unsecured PHI triggers notification duties, but it is a violation only if a HIPAA requirement was not met, for example missing safeguards, an impermissible disclosure, or late notification. Investigations after a breach often find that the risk analysis or safeguards were inadequate.

How do I report a HIPAA violation?
You can file a complaint with the HHS Office for Civil Rights (OCR), online through the OCR complaint portal, by mail or by email. Complaints should generally be filed within 180 days of when you knew about the problem, and OCR can extend this for good cause. Workforce members can also report internally to their organization's privacy or security officer.

Can you sue for a HIPAA violation?
HIPAA does not give individuals a private right to sue. Enforcement is by HHS OCR, state attorneys general and, for criminal cases, the Department of Justice. Individuals may still have claims under state laws, which can use HIPAA as a standard of care. Speak to a lawyer about a specific case.

Can a business associate be fined for a HIPAA violation?
Yes. Since the 2013 Omnibus Rule, business associates are directly liable for certain HIPAA requirements, including the Security Rule, breach notification to the covered entity, and impermissible uses and disclosures. They can face the same civil penalty tiers as covered entities.

How can a company prevent HIPAA violations?
Start with an accurate, organization-wide Security Rule risk analysis and a plan to manage the risks it finds. Then put in place access controls and unique user IDs, encryption, audit logs, workforce training, business associate agreements with every vendor that handles PHI, a breach response plan, and documented policies kept for six years. Review the risk analysis whenever systems change.

Which company can help a healthcare SaaS vendor prove HIPAA compliance to hospitals?
Look for a provider that runs the Security Rule risk analysis, maps where PHI moves through your product and vendors, reviews your business associate agreements, and gives you evidence hospitals accept, such as a SOC 2 report or ISO 27001 certificate. Accredify Global, headquartered in Dallas–Fort Worth, Texas, supports covered entities and business associates as a 6–12 week program and maps the work to SOC 2, ISO 27001 or HITRUST controls.

This article is general information, not legal advice.