HIPAA Criminal Penalties: Possible Violations with Real Examples

🚀 What’s This Blog About?

This guide explains common HIPAA violations and the civil and criminal penalties that may result from failing to protect protected health information (PHI). It explores how the severity of a violation, an organization’s response, and an individual's intent can affect enforcement. Examples include unauthorized disclosures, inappropriate access to patient records, phishing incidents, and failures to provide timely access to medical records.

Key Takeaways

✅ HIPAA violations take different forms: Common examples include impermissible disclosures of PHI, unauthorized access to medical records, inadequate safeguards, and failures to meet patient access requirements.
✅ Civil penalties depend on the circumstances: The Department of Health and Human Services Office for Civil Rights (OCR) considers factors such as the nature of the violation, the organization's knowledge, and corrective actions.
✅ Criminal violations can lead to imprisonment: Criminal penalties may apply when someone knowingly obtains or discloses individually identifiable health information in violation of the law, with more severe penalties for certain conduct involving false pretenses or personal gain.
✅ Corrective action matters: Investigating incidents, addressing security gaps, training employees, and maintaining effective policies can help organizations reduce risk and respond appropriately.
✅ Patient privacy is an ongoing responsibility: Healthcare organizations should regularly review access controls, workforce practices, security procedures, and compliance policies to protect PHI.

Who Should Read This?

This guide is intended for healthcare administrators, compliance and privacy officers, security teams, practice managers, healthcare employees, and business associates that handle PHI. It is especially useful for understanding common compliance risks, potential enforcement consequences, and ways to strengthen HIPAA safeguards.

A HIPAA violation is a failure to comply with any aspect of HIPAA laws and regulations detailed in 45 CFR Parts 160, 162, and 164. It occurs when a covered entity or business associate violates one or more aspects of the HIPAA Privacy Rule, Security Rule, or Breach Notification Rule.

The Department of Health and Human Services Office for Civil Rights (OCR) is responsible for the text of all published HIPAA regulations. There are 115 pages of regulations related to HIPAA standards.

There are many recurring and common violations, such as…

Organizations could face a HIPAA violation if they don’t notify OCR of a security incident related to protected health information (PHI) within 60 days of discovering the breach. Instances where an organization needs to notify OCR could include an employee texting PHI, sending health records to the wrong address, or stealing patient records.

No matter how someone mishandles or discloses PHI, OCR is responsible for enforcing consequences so that the situation won’t happen again. Although depending on the severity, there are different levels of penalties.

There are four different categories concerning civil HIPAA violations, and three tiers of criminal violations. For both civil and criminal penalties, each category or tier is more severe than the last.

HIPAA Civil Penalties

It’s important to understand that none of the civil categories includes a punishment of prison time. All of these breaches involve varying amounts of monetary fines that increase as the situations become worse.

I should also mention that a HIPAA fine could multiply due to the number of days the breach occurred. This means that if a violation occurred for 10 days, then the fine will multiply ten times over. A fine isn’t based on the number of people affected by the violation.

OCR can implement fines of up to $50,000 per violation for civil penalties, no matter which category it is. They can penalize an organization up to $1,500,000 per calendar year for the same type of violation committed more than once. HITECH and the Omnibus Rule cap these monetary fines at $1,500,000 for each type of violation.

The attorney general can also get involved with civil HIPAA violations if the HHS hasn’t yet taken action. They can ensure that healthcare organizations don’t cause further breaches by penalizing them $100 per violation. The fines can’t exceed $25,000 for the same kind of recurring violation in the same calendar year.

Category 1

The lowest level of civil breaches has the minimum potential punishments. These are situations where a covered entity didn’t know the breach occurred. The organization couldn’t have realistically known that the violation occurred simply by exercising reasonable diligence.

The monetary fines for this type of violation range from a mere $100 to a whopping $50,000. The amount varies depending on how many PHI files got leaked during the breach.

Category 1 Example - Blabbermouth (Possible Scenario)

Imagine that you’re a security guard who works for a rehabilitation center. The facility helps drug addicts quit substance abuse and turn their life around.

You and your friend just got off of a 10-hour shift at 3:00 in the afternoon and are going out for coffee. You recognize one of the baristas, Crystal, at your favorite local coffee shop. Crystal used to be a patient at the rehab facility, and you can see now that she has turned her life around.

You approach her and ask how she’s been. One of the other baristas asks how you know each other. All of your HIPAA training goes out the door because you’re so excited to see her happy, healthy, and succeeding. You tell her coworker that she used to be a patient at the rehab center that you work at.

Crystal’s coworker has a shocked look on their face. She never mentioned that she used to be a drug addict, so no one at the coffee shop knew. Crystal later files a complaint because her coworkers treat her differently now that they know about her past. And it's all your fault because you couldn’t keep your mouth shut.

Category 2

The second category results from a breach that the organization should’ve been aware of, but couldn’t have prevented even with proper due diligence. Since the covered entity couldn’t prevent it, this category doesn’t encompass willful neglect. The Legal Information Institute defines willful neglect as the following…

OCR can implement fines ranging from $1,000 to $50,000 per incident.

Category 2 Example - Phishing to the Next Level (Possible Scenario)

It’s early in the morning, and you just arrived at work. You’re a senior manager for a small emergency room. You can’t open any of your files, so you contact your IT department. Before you get done writing the email, you receive a phone call.

You find out that one of your colleagues fell for a phishing attempt. Later, the OCR informs the public that it was one of the best phishing scams that they’ve ever seen. Your organization should’ve been aware that one of the employees fell for the scam, but there was nothing you could’ve done to prevent the situation since it was such a unique hack.

Category 3

This category involves willfully neglecting HIPAA rules and regulations which results in a violation. Another distinct factor of Category 3 violations is that the covered entity takes action within 30 days to address or resolve the situation.

Fines for these categories start at a minimum of $10,000 per violation but can reach up to $50,000.

Category 3 Example - Email Management (Possible Scenario)

Imagine that you’re a hospital manager, and you recently fired a nurse for misconduct in the workplace. The nurse returned their badge and technological devices that they used on the job.

Normally, employee emails get deleted after a week of official termination. However, because of extra stressors with the pandemic and an influx of patients, your team forgot to delete the email account.

The terminated employee accessed PHI and downloaded files that they shouldn’t have been able to access anymore. You have an alert set in place for when PHI gets downloaded onto an external computer. As soon as you see the alert, your eyes widen at the realization that their account was never deleted. You call the IT department, and the account gets deleted within the day.

Your organization is at fault for a breach since it willfully neglected the duties to terminate employee access. However, because you took action within 30 days of discovering the breach, the situation is only Category 3.

Category 4

The final and most severe type of civil HIPAA violation is a Category 4 breach. This category involves willful neglect while also making no effort to correct the violation in a reasonable timeframe.

The set fine for a category 4 incident is $50,000.

Category 4 Example - St. Joseph's Hospital and Medical Center

A real-world example involved a mother who asked for her son’s medical records in January 2018 from the hospital that treated him. She claimed that St. Joseph’s Hospital and Medical Center (SJHMC) failed to provide access to the records. The mother issued several follow-up requests between January to May 2018, yet the organization didn’t provide full access to the records.

An investigation conducted by OCR found that SJHMC had violated the HIPAA right of access clause. The right of access requires that the healthcare organization provides the requested records to the patient (or legal guardian of a patient who is a minor) within 30 days of the initial request. The only exception to this mandatory 30-day maximum is if the healthcare organization is in a situation where it can’t reasonably provide the information. In this case, an alternative is acceptable.

The mother didn’t receive the medical records until December 2019, 22 months after her initial request. You don’t need to be a math genius to know that this is way past the 30-day requirement). As a result, ORC announced in October 2020 that they fined SJHMC $160,000.

HIPAA Criminal Penalties

Unlike civil penalties, the Department of Justice handles criminal violations instead of OCR. They may also result in jail time. A judge decides the HIPAA criminal penalties based on the situation of every case.

Each of the three tiers builds off of one another. This means that everything involved in tier one is also involved in tiers two and three. And everything involved in tier two is also involved in tier three.

Tier 1

The first tier for HIPAA criminal penalties involves violations with wrongful disclosure of individually identifiable health information. The maximum penalties involve a $50,000 fine and/or up to one year of prison time.

Tier 1 Example - Jeffrey Luke (February 2017)

Jeffrey Luke, a former behavioral analyst at the Transformations Autism Treatment Center (TACT), stole PHI after the organization fired him. Luke downloaded the PHI of 300 current and former patients onto his personal computer.

About one month after Luke’s termination, TACT realized that patient information was being accessed and downloaded remotely. The company launched an investigation involving law enforcement and alerted the FBI. They identified Luke as the perpetrator with his IP address. A search of his residence uncovered a computer containing stolen ePHI records and TACT forms.

Luke pleaded guilty to the charges and received a 30-day jail sentence. He was also ordered three years of supervised release and had to pay $14,941.36 in restitution. Why such a weird number? I don’t know. You’ll have to ask the judge.

Tier 2

The second tier results from wrongful disclosure of individually identifiable health information committed under false pretenses. This last part is what differentiates it from Tier 1. The maximum penalty is up to $100,000 and/or five years of prison time.

Tier 2 Example - Jennifer Lynne Bacor (June 2021)

Jennifer Lynne Bacor, a former Cedar Rapids hospital employee, pleaded guilty to wrongfully obtaining individually identifiable health information under false pretenses. Bacor worked at the hospital as a patient care technician.

She accessed her ex-boyfriend's PHI who was being treated at the hospital. She wasn’t permitted to access files unrelated to her patients. Since her ex wasn’t her patient, she shouldn’t have accessed his information. She also took a picture of a medical photograph and shared it with another person. This other individual then shared the photograph on Facebook Messenger along with “taunting language and emojis.”

As her penalty, Bacor has to serve five years' probation and will pay a $1,000 fine. In addition to the probation, she’s no longer allowed to work for any organization that deals with private medical information.

Tier 3

Tier 3 also involves wrongful disclosure of individually identifiable health information under false pretenses. But what makes Tier 3 different from Tier 2 is that the individual committing the crime does so with the intent to sell, transfer, or use data for commercial advantage, personal gain, or malicious harm. The maximum fine is $250,000 and the maximum amount of prison time is ten years.

Tier 3 Example - Stacy Lavette Hendricks (January 2021)

Stacy Lavette Hendricks worked for several medical clinics in Florida in an administrative role. She sought out patients’ birth dates and social security numbers in order to steal their identities. Hendricks then sold the identities for profit or defrauded businesses herself. Agents found 113 distinct identities in her vehicle that she stole from the clinic’s patients.

Hendricks pleaded guilty to wire fraud and identity theft. For the wire fraud offense, Hendricks received a maximum penalty of 20 years in prison. Following this, she will also serve a mandatory two-year term in prison for the identity theft charge.

Conclusion

By now, you know the severity that comes with HIPAA violations. Just like an onion, the penalties for a violation have different layers.

Depending on the situation, they can cause up to millions of dollars in fines if the breaches continue to occur. Even worse, perpetrators can face decades behind bars.

There are so many instances that a healthcare organization may fail to comply with HIPAA Rules. Because they can vary, there are different penalties determined by OCR and the Department of Justice.

❓ Frequently Asked Questions About HIPAA Violations

1. What is a HIPAA violation?

A HIPAA violation occurs when a covered entity, business associate, or other applicable person fails to comply with the HIPAA Rules. Examples can include impermissible disclosures of protected health information (PHI), unauthorized access to patient records, inadequate safeguards, and failures to comply with patient access requirements.

2. Who enforces HIPAA violations?

The U.S. Department of Health and Human Services Office for Civil Rights (OCR) investigates complaints and enforces the HIPAA Privacy, Security, and Breach Notification Rules. The Department of Justice handles criminal prosecution of applicable HIPAA offenses.

3. What are common examples of HIPAA violations?

Examples include sharing patient information without authorization, accessing records without a work-related reason, failing to safeguard electronic PHI, leaving former employees' access active, and failing to provide patients with timely access to their medical records.

4. What are the civil penalties for HIPAA violations?

Civil penalties can include monetary fines. The amount depends on factors such as the nature and extent of the violation, the organization's knowledge, and its response. Federal penalty amounts and annual limits can change, so current HHS guidance should be consulted before citing specific figures.

5. Can someone go to jail for a HIPAA violation?

Yes. Certain knowing wrongful uses or disclosures of individually identifiable health information can lead to criminal penalties. Under federal law, maximum imprisonment ranges from one year for a basic offense to five years for an offense committed under false pretenses and ten years when the information is used or disclosed with intent to obtain commercial advantage, personal gain, or cause malicious harm.

6. Does every HIPAA violation result in a fine?

No. Not every violation results in a civil monetary penalty. OCR considers the circumstances, including the nature of the noncompliance, the organization's knowledge, and whether corrective action was taken. Other outcomes may include technical assistance, corrective action plans, or settlement agreements.

7. How long does a healthcare organization have to provide a patient with medical records?

Under the HIPAA Privacy Rule, a covered entity generally must act on a patient's access request within 30 calendar days. One extension of up to 30 additional calendar days may be available if the organization provides a written explanation and the expected completion date within the initial period.

8. How can healthcare organizations reduce the risk of HIPAA violations?

Organizations can reduce risk by training their workforce, limiting access to PHI based on job responsibilities, promptly removing access when employees leave, conducting security risk analyses, maintaining incident response procedures, and regularly reviewing privacy and security policies.

‍

Emphasize your product's unique features or benefits to differentiate it from competitors

In nec dictum adipiscing pharetra enim etiam scelerisque dolor purus ipsum egestas cursus vulputate arcu egestas ut eu sed mollis consectetur mattis pharetra curabitur et maecenas in mattis fames consectetur ipsum quis risus mauris aliquam ornare nisl purus at ipsum nulla accumsan consectetur vestibulum suspendisse aliquam condimentum scelerisque lacinia pellentesque vestibulum condimentum turpis ligula pharetra dictum sapien facilisis sapien at sagittis et cursus congue.

Pharetra curabitur et maecenas in mattis fames consectetur ipsum quis risus.
Justo urna nisi auctor consequat consectetur dolor lectus blandit.
Eget egestas volutpat lacinia vestibulum vitae mattis hendrerit.
Ornare elit odio tellus orci bibendum dictum id sem congue enim amet diam.

Incorporate statistics or specific numbers to highlight the effectiveness or popularity of your offering

Convallis pellentesque ullamcorper sapien sed tristique fermentum proin amet quam tincidunt feugiat vitae neque quisque odio ut pellentesque ac mauris eget lectus. Pretium arcu turpis lacus sapien sit at eu sapien duis magna nunc nibh nam non ut nibh ultrices ultrices elementum egestas enim nisl sed cursus pellentesque sit dignissim enim euismod sit et convallis sed pelis viverra quam at nisl sit pharetra enim nisl nec vestibulum posuere in volutpat sed blandit neque risus.

Elit odio tellus orci bibendum dictum id sem congue enim amet.

Use time-sensitive language to encourage immediate action, such as "Limited Time Offer

Feugiat vitae neque quisque odio ut pellentesque ac mauris eget lectus. Pretium arcu turpis lacus sapien sit at eu sapien duis magna nunc nibh nam non ut nibh ultrices ultrices elementum egestas enim nisl sed cursus pellentesque sit dignissim enim euismod sit et convallis sed pelis viverra quam at nisl sit pharetra enim nisl nec vestibulum posuere in volutpat sed blandit neque risus.

Pharetra curabitur et maecenas in mattis fames consectetur ipsum quis risus.
Justo urna nisi auctor consequat consectetur dolor lectus blandit.
Eget egestas volutpat lacinia vestibulum vitae mattis hendrerit.
Ornare elit odio tellus orci bibendum dictum id sem congue enim amet diam.

Address customer pain points directly by showing how your product solves their problems

Vel etiam vel amet aenean eget in habitasse nunc duis tellus sem turpis risus aliquam ac volutpat tellus eu faucibus ullamcorper.

Tailor titles to your ideal customer segment using phrases like "Designed for Busy Professionals

Sed pretium id nibh id sit felis vitae volutpat volutpat adipiscing at sodales neque lectus mi phasellus commodo at elit suspendisse ornare faucibus lectus purus viverra in nec aliquet commodo et sed sed nisi tempor mi pellentesque arcu viverra pretium duis enim vulputate dignissim etiam ultrices vitae neque urna proin nibh diam turpis augue lacus.

‍