When it was first introduced in 1996, the Health Insurance Portability and Accountability Act (HIPAA) aimed to transform the healthcare industry and bring it into the modern era. While its initial rollout lacked strong enforcement measures, subsequent rules and programs, like HITECH, have strengthened compliance and accountability. Today, any business found responsible for a HIPAA breach can face serious penalties. That’s why it’s essential to understand what counts as a HIPAA breach, the potential consequences, and the steps you can take to stay compliant.
In this article, we’ll explain what is considered a HIPAA breach, outline common violations, and share strategies to protect your organization and patient data.
What Is Considered a HIPAA Breach?
According to the U.S. Department of Health & Human Services (HHS), a HIPAA breach typically occurs when there is an impermissible use or disclosure of protected health information (PHI) that compromises its privacy or security. By default, any unauthorized use or disclosure of PHI is presumed to be a HIPAA breach, unless the covered entity or business associate can show that the risk of the PHI being compromised is low.
To determine the severity of a HIPAA breach and the appropriate penalties, a risk assessment must be conducted. The HHS evaluates the following factors:
- Nature and extent of the PHI involved: This includes the type of identifiers and the likelihood that the information could be re-identified.
- Who accessed the PHI: Whether the unauthorized individual used or received the PHI.
- Actual acquisition or viewing: Whether the PHI was actually obtained or seen.
Mitigation measures: The extent to which the risk to the PHI has been reduced.
HIPAA Breach Notification Rule
When HIPAA was first introduced, one major criticism was that it allowed many uses and disclosures of electronically protected health information (ePHI) without patient consent. Covered entities also had no obligation to notify patients when a HIPAA breach occurred.
Dr. Deborah Peel, psychiatrist and founder of the Patient Privacy Rights Foundation, explained:
“Our existing federal privacy law is toothless. The federal government amended HIPAA in 2003, allowing hundreds of thousands of businesses and millions of business associates to access medical records without patient consent for treatment, payment, and healthcare operations. To argue that medical privacy will increase costs or obstruct research is simply wrong. How can anything be private with this loophole?”
The HITECH Act addressed this issue by requiring covered entities to notify both the government and the public, especially in cases of significant HIPAA breaches. Notification requirements are categorized based on the size of the breach:
- Smaller breaches: For breaches affecting 500 or fewer individuals, entities must notify the affected individuals and record the incident in their annual data breach report to the HHS Secretary.
Larger breaches: For breaches impacting more than 500 individuals, entities must notify the affected individuals, the HHS Secretary, and the general public.
What Is PHI?
Under HIPAA, protected health information (PHI) is defined as:
“Any individually identifiable information relating to the past, present, or future health status of an individual that is created, collected, transmitted, or maintained by a HIPAA-covered entity in connection with healthcare provision, payment for healthcare services, or healthcare operations.”
PHI only applies to personal information about patients or health plan members, and mishandling it can result in a serious HIPAA breach.
According to the U.S. Department of Health & Human Services (HHS), examples of PHI include:
- Names
- All geographic subdivisions smaller than a state, including street address, city, county, precinct, ZIP code, and their geocodes (except the first three digits of the ZIP code)
- All elements of dates (except year) related to an individual, such as birth date, admission date, discharge date, death date, and ages over 89 (aggregated as 90+)
- Telephone numbers
- Vehicle identifiers and serial numbers, including license plates
- Fax numbers
- Device identifiers and serial numbers
- Email addresses
- Web URLs
- Social Security numbers
- IP addresses
- Medical record numbers
- Biometric identifiers, including fingerprints and voiceprints
- Health plan beneficiary numbers
- Full-face photographs and comparable images
- Account numbers
- Any other unique identifying numbers, characteristics, or codes
- Certificate or license numbers
Understanding what counts as PHI is critical to preventing a HIPAA breach and ensuring your organization remains HIPAA compliant.
common HIPAA Breaches
Many HIPAA breaches occur simply because employees are unaware of what constitutes a violation. Regular HIPAA compliance training is essential to ensure staff know what they can and cannot do when handling protected health information (PHI).
Below are some of the most common HIPAA violation examples:
- Mishandling medical records: Printed patient charts, medical history, notes, or tests must be securely stored and out of sight. Leaving records unattended or accessible to unauthorized individuals can result in a HIPAA breach.
- Lost or stolen devices: Laptops, smartphones, and tablets often contain PHI and are easily lost or stolen. Organizations should follow NIST Mobile Security Guidelines, including:
- Dual-authentication
- Encryption
- VPN access
- Social media violations: Posting patient photos, even without names, can reveal private information and is a clear HIPAA violation.
- Employees sharing information: Discussing patients with friends, family, or coworkers without authorization is prohibited and considered a serious HIPAA breach.
- Social conversation breaches: Even casual discussions about someone’s healthcare with friends or colleagues can lead to penalties if done without patient consent.
- Texting or messaging patient information: Using unsecured messaging apps to share PHI exposes it to cybercriminals. Always use encrypted communication for patient data.
- Reading patient information on home computers: Accessing PHI at home is not inherently a violation, but leaving screens visible to others can result in a HIPAA breach. Laptops should be encrypted and password-protected.
- Failure to obtain authorization: Written patient consent is required for sharing PHI outside treatment, payment, or healthcare operations. Not obtaining authorization can result in violations.
Illegal access by employees: Accessing patient records outside of work purposes, whether out of curiosity, personal gain, or spite, is illegal and can lead to costly penalties.
Penalties for a HIPAA Breach
Through the HITECH Act, the U.S. Department of Health & Human Services (HHS) established an enforcement system for HIPAA breaches and failures to maintain compliance. To distinguish levels of noncompliance, HHS outlines a four-tier penalty system:
- Tier 1 – Unaware of violation:
Your business was unaware it was violating HIPAA rules. If due diligence had been exercised, the violation likely would not have occurred.
Penalty: $100 to $50,000 per violation, with an annual maximum of $1,500,000. - Tier 2 – Reasonable cause:
Your business should have known about the violation and failed to exercise reasonable diligence.
Penalty: $1,000 to $50,000 per violation, with an annual maximum of $1,500,000. - Tier 3 – Willful neglect (corrected):
Your business willfully neglected HIPAA rules but corrected the issue within 30 days of discovery.
Penalty: $10,000 to $50,000 per violation, with an annual maximum of $1,500,000. - Tier 4 – Willful neglect (uncorrected):
Your business willfully neglected HIPAA rules and made no corrective efforts.
Penalty: $50,000 per violation, with an annual maximum of $1,500,000.
Understanding these tiers is crucial for avoiding HIPAA violation fines and ensuring your organization remains fully HIPAA compliant.
Individual Civil Penalties for a HIPAA Breach
Employees who violate HIPAA rules can face serious civil penalties if found guilty. According to the HIPAA Journal, the Office for Civil Rights (OCR) can impose fines based on the severity of the violation:
- Unaware of violation: $100 per violation, up to $25,000 for repeat violations.
- Reasonable cause: $1,000 per violation, up to $100,000 for repeat violations.
- Willful neglect (corrected): $10,000 per violation, up to $250,000 for repeat violations.
- Willful neglect (uncorrected): $50,000 per violation, up to $1.5 million for repeat violations.
These civil penalties highlight the importance of proper training, policies, and oversight to prevent a HIPAA breach in your organization.
Criminal Charges for HIPAA Violations
If the OCR identifies malicious or criminal conduct, cases may be referred to the U.S. Department of Justice. Criminal penalties depend on the knowledge and intent of the employee:
- Low-level violation: Maximum fine of $50,000 and/or up to 1 year in prison.
- Violation under false pretenses: Maximum fine of $100,000 and/or up to 5 years in prison.
- Knowingly committing a HIPAA breach: Maximum fine of $250,000 and/or up to 10 years in prison, especially if the healthcare information was stolen for personal gain, commercial advantage, or malicious harm.
Understanding both civil and criminal consequences is critical for maintaining HIPAA compliance and avoiding costly penalties.
Complying with HIPAA
A HIPAA breach can have serious consequences, including loss of patient trust, damage to your organization’s reputation, and costly fines. To protect your business, employees, and patients, it’s essential to implement effective HIPAA compliance measures and follow best practices for data security.
At RSI Security, we help organizations prevent HIPAA breaches and maintain full compliance with HIPAA and HITECH requirements. As a full-service HIPAA Compliance Assessor and Advisory, we provide:
- Employee training: Educating staff on HIPAA rules and handling PHI securely.
- Oversight and monitoring: Ensuring policies and procedures are followed consistently.
- Patient data security assessments: Identifying vulnerabilities and areas for improvement.
- Prescriptive recommendations: Offering actionable solutions to mitigate risks and prevent breaches.
With over a decade of experience, RSI Security partners with companies to strengthen HIPAA security measures and protect sensitive healthcare data. When it comes to preventing HIPAA breaches, having an expert on your side makes all the difference help!
Download Our HIPPA Checklist
