Last verified: October 2026, against the HIPAA rules on eCFR and HHS's January 2025 Security Rule proposal. General information, not legal advice — confirm with your compliance officer or attorney.
HIPAA violation examples in a small practice are rarely dramatic. They look like a review reply that confirms a visit, a tracking pixel on a booking page, a records request that sat unanswered for two months, or a laptop with no encryption left in a car. This page groups them by where they happen, explains why each one counts, and shows what HHS's own enforcement data says. Each month about 22,200 US searches are for "hipaa violations," 2,400 for "hipaa violation examples" and 2,400 for "what is a hipaa violation" (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026).
In short: A HIPAA violation is any failure to comply with a HIPAA rule: using or disclosing PHI in a way the rules don't permit, failing to safeguard it, or failing to honor a patient's rights. A breach is narrower. Many violations are never breaches, and every breach starts with a violation.
What makes something a HIPAA violation
45 CFR 160.103 (opens in a new tab) defines "violation" simply as "failure to comply with an administrative simplification provision." In a practice, that usually means one of three things:
- An impermissible use or disclosure. Under 164.502(a) (opens in a new tab), a covered entity "may not use or disclose protected health information, except as permitted or required." Sharing PHI for marketing without authorization is the classic example.
- A failure to safeguard. The Privacy Rule requires "appropriate administrative, technical, and physical safeguards" under 164.530(c) (opens in a new tab). The Security Rule adds specific requirements for electronic PHI.
- A failure to honor patient rights, such as access to records, amendments or the Notice of Privacy Practices.
A breach, defined in 164.402 (opens in a new tab), is an impermissible acquisition, access, use or disclosure that "compromises the security or privacy" of PHI, and it is presumed unless a risk assessment shows a low probability of compromise. A missing risk analysis is a violation but not a breach. An email with lab results sent to the wrong patient is both. The breach notification rule covers what to do when one occurs. If you're unsure whether data counts as PHI at all, start with what is PHI.
Everyday front-desk slips
Illustrative examples: the scenarios in this and the following sections describe fictional practices.
- Saying too much at check-in. "Mr. Alvarez, the doctor wants to go over your biopsy results" in a full waiting room. HIPAA permits incidental disclosures (opens in a new tab) only where you've applied reasonable safeguards and minimum necessary; announcing results publicly fails both.
- Confirming a patient to a caller. A man calls asking whether his ex-wife has an appointment today. Confirming it is a disclosure.
- Leaving charts or screens visible. A sign-in sheet with visit reasons, or a monitor facing the waiting room.
- Texting schedules to personal phones. A photo of tomorrow's schedule sent to a staff group chat puts names and visit types on unmanaged devices.
- Snooping. A staff member looks up a neighbor's chart out of curiosity. Access without a job need breaks your minimum necessary policy, and your sanctions policy should treat it seriously.
Website and marketing violations
Marketing creates violations faster than any other area, because the tools are built to share data.
| Example | Why it's a violation |
|---|---|
| Meta or Google ad pixel on the appointment-request page, sending page URLs and form events | Discloses identifiers tied to a request for care to a vendor with no BAA |
| Review reply: "Glad the IV therapy helped your migraines, Tom!" | Confirms a patient relationship and a condition without authorization |
| Patient testimonial video posted without a signed authorization | Marketing use of PHI requires authorization under 164.508(a)(3) (opens in a new tab) |
| Contact-form submissions emailed in full to a Gmail account | PHI sent and stored outside your safeguards, with no BAA |
| Patient email list uploaded to an ad platform for a custom audience | Discloses that each person is a patient, for marketing, without authorization |
| Before-and-after photo on Instagram with a recognizable face | Full-face photo of a patient used in marketing without authorization |
The review-reply row is the one teams repeat most, so it's worth a script; see replying to reviews safely. Social posts have their own patterns, covered in social media HIPAA violations, and pixels in tracking pixel risks.
Security failures: risk analysis, devices, access
The Security Rule's requirements are specific, so failures are easy to identify:
- No risk analysis. 164.308(a)(1)(ii)(A) (opens in a new tab) requires "an accurate and thorough assessment" of risks to electronic PHI. Not having one is a standalone violation.
- Unencrypted laptops and phones. Encryption is "addressable" under 164.312 (opens in a new tab), which means you must implement it or document why an equivalent alternative is reasonable. Skipping both is a violation, and a lost unencrypted device is usually a reportable breach.
- Shared logins. The rule requires unique user identification. One front-desk password used by four people defeats audit logs.
- No offboarding. A former employee who can still log in to the EHR or the form inbox weeks after leaving.
- No backups or no tested restore. A data backup plan is required; ransomware turns its absence into a crisis.
Patient-rights violations: records requests
The right of access is the rule patients notice first. Under 164.524 (opens in a new tab), a practice must act on a request "no later than 30 days after receipt," with one 30-day extension if it explains the delay in writing. Fees for copies are limited to a "reasonable, cost-based fee" covering labor for copying, supplies, postage and an agreed summary.
Common violations: holding records until the patient pays an old balance (an unpaid bill isn't among the grounds for denial the regulation lists), insisting on an in-person pickup when the patient asked for an electronic copy you can readily produce, or charging a "records retrieval" fee that isn't one of the permitted cost components. Each one is a complaint waiting to be filed.
Vendor violations: missing BAAs
If a vendor creates, receives, maintains or transmits PHI for you without a business associate agreement, the practice is in violation the moment the data flows. 164.308(b) (opens in a new tab) requires written assurances before a vendor handles electronic PHI.
Typical gaps: the free form builder on the website, the answering service, a chat widget, the shredding company and the marketing agency that receives leads. Make a list of every vendor that touches patient data, and collect a signed BAA from each. Medfy, for example, signs a BAA with every practice before any patient data flows, stores patient information in separate, encrypted HIPAA databases in the US or Canada, and never sends patient data to ad platforms; details are in how Medfy protects patient data.
What OCR enforcement shows
HHS's January 2025 Security Rule proposal (opens in a new tab) summarizes what OCR has been finding, in HHS's own words:
- In audits from 2016 to 2017 covering 166 covered entities and 41 business associates, only 14 percent of covered entities were "substantially fulfilling their regulatory responsibilities" for risk analysis, and 94 percent "failed to implement appropriate risk management activities."
- In 2023, OCR entered into seven resolution agreements after investigations indicated potential Security Rule violations, "constituting almost half of the total resolution agreements OCR entered into that year."
- In one of those cases, a regulated entity "did not detect an intrusion into its network until 20 months later when its files were encrypted with ransomware," and OCR found evidence of a failure to conduct a risk analysis.
The lesson for a small practice: in HHS's own examples, an incident started the investigation, but the missing basics, such as a risk analysis, were what investigators found. For how penalties are calculated, see HIPAA fines and penalties. To catch the website-side issues above before a patient does, run a free marketing audit; it flags privacy risks such as pixels on patient forms.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Frequently asked questions
What is the most common HIPAA violation?
We can't point to one official ranking, but HHS's own audit data is telling. In its 2016–2017 audits, HHS found only 14 percent of covered entities substantially meeting their risk analysis obligations, and 94 percent failing to implement adequate risk management. For small practices, missing risk analysis is the gap most worth closing first. Confirm your own priorities with your compliance officer or attorney.
Is talking about a patient in public a HIPAA violation?
It can be. Discussing a patient by name in a coffee shop, a hallway or a group chat is a disclosure the rules don't permit. HIPAA does allow incidental disclosures, such as a name overheard at the front desk, when you've applied reasonable safeguards and limited what's shared. Train staff to move conversations out of public areas and drop identifying details.
Is replying to a patient's review a HIPAA violation?
Replying isn't; confirming the reviewer is your patient or discussing their care is. A reply like 'Sorry your crown was uncomfortable, call us' discloses a patient relationship and treatment without authorization, even though the patient posted first. Use a neutral reply that invites them to contact the office. If your team has already posted something revealing, talk to your compliance officer or attorney about next steps.
What should we do after a HIPAA violation?
Contain it, then mitigate any harm, as 45 CFR 164.530(f) requires. Document what happened, run the four-factor breach risk assessment, and notify patients and HHS if it's a reportable breach, within 60 days of discovery at most. Apply your sanctions policy and fix the cause. Call counsel early, especially if a vendor was involved or more than a few patients were affected.