HIPAA Violations Examples: 7 Everyday Mistakes That Led to Fines

By the SureSend Team · Published November 6, 2026

A HIPAA violation is any use, disclosure or handling of protected health information that breaks the HIPAA Privacy, Security or Breach Notification Rules. The HIPAA violations examples below show that most cases start with an everyday task, not a hacker.

A letter goes out in the wrong envelope. A list of patients leaves with an employee. A file sits unencrypted on a server. Nobody meant any harm.

Each of those mistakes led to a real penalty. This guide walks through seven enforcement cases, explains what each one teaches, sets out the current penalty amounts, and ends with a checklist you can use this week.

What Are HIPAA Violations?

HIPAA violations are failures to follow the rules that protect patients' health information in the United States. They include disclosing information without permission, sharing more than necessary, missing security safeguards such as encryption or risk assessments, and failing to notify patients of a breach on time.

HIPAA applies to covered entities (health plans, health care clearinghouses and health care providers that transmit health information electronically in connection with a covered transaction) and to their business associates, the vendors that handle health information for them. Our guide to HIPAA-compliant file sharing explains who is covered and what the Security Rule requires.

Three rules cause most violations:

• The Privacy Rule limits who may see health information. Under 45 CFR § 164.502(b), a covered entity or business associate "must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose."
• The Security Rule requires safeguards for electronic health information, including access controls and "technical security measures to guard against unauthorized access" to information sent over a network.
• The Breach Notification Rule requires notice to affected patients "without unreasonable delay and in no case later than 60 calendar days after discovery of a breach."

HIPAA Violations Examples From Real Enforcement Cases

The seven HIPAA violations examples below come from settlements announced by state attorneys general, who can enforce HIPAA under federal law. Each started with an ordinary task: a mailing, a staff move, a website tool or an unprotected file. The amounts are what each organization agreed to pay.

Amounts as announced by each attorney general's office; see Sources.

1. A Mailing That Revealed Patients' HIV Status

In July 2017, Aetna mailed letters to about 2,460 New York members in envelopes with a large transparent window. The New York Attorney General said names, addresses, claim numbers and "the first several lines of the letter containing instructions related to HIV medications, were clearly visible from the outside of the envelope." Aetna agreed in January 2018 to a $1.15 million USD civil penalty and to hire an independent consultant.

The lesson: check what a document shows before it leaves, including the parts a stranger can see.

2. Letters Sent to Patients' Relatives

Regional Cancer Care Associates in New Jersey had two problems in 2019. First, staff email accounts were compromised through a targeted phishing scheme. Then, while notifying patients of that breach, a third-party vendor addressed letters intended for 13,047 living patients to their prospective next of kin.

The New Jersey Attorney General said family members "were informed of their relatives' illnesses without their consent." The providers agreed in December 2021 to pay $425,000 USD and adopt new security measures, while disputing the allegations.

3. A Patient List Taken to a New Job

In spring 2015, a nurse practitioner at the University of Rochester Medical Center gave a list of 3,403 patient names, addresses and diagnoses to her future employer, which used it to mail patients about switching practices. The medical center learned of it when upset patients called. It agreed to train its workforce and pay a $15,000 USD penalty.

One person's decision became the employer's breach. That is why HIPAA training has to cover what staff may take with them when they leave.

4. Patient Phone Numbers Used for Marketing

In 2015, the CEO of one home care agency planned his own company, which then used the agency's patient phone numbers to call patients and urge them to switch. The New York Attorney General said this violated the HIPAA Privacy Rule, which requires written authorization before health information is used for marketing, with limited exceptions. All American Home Care agreed in December 2016 to pay $25,000 USD in penalties and costs.

5. Website Tracking Tools That Shared Health Searches

Between June 2016 and June 2022, NewYork-Presbyterian Hospital used third-party tracking tools on its website. When a visitor searched for a doctor or a condition, details such as "spine surgery" could appear in the page address sent to those companies. The hospital reported that over 54,000 people were affected and agreed in December 2023 to pay $300,000 USD.

6. Unencrypted Files and a Stolen Login

In 2023, attackers used compromised login information to reach OrthopedicsNY's network and downloaded unencrypted files with the health and personal information of about 656,000 people. The New York Attorney General said the practice had failed to use multifactor authentication for remote access, encrypt sensitive patient data and regularly assess risks. It agreed in December 2025 to pay $500,000 USD in penalties and costs.

7. A Law Firm That Handled Hospital Records

Business associates are covered too. Heidell, Pittoni, Murphy & Bach, a law firm that represents New York City area hospitals, had not applied Microsoft Exchange patches released months earlier. A 2021 attack exposed the information of 114,979 people. The Attorney General said the firm had not done regular risk assessments, encrypted information on its servers or adopted data minimization practices. It agreed in March 2023 to pay $200,000 USD.

What Are Examples of Unintentional HIPAA Violations?

Unintentional HIPAA violations are mistakes made without any intent to harm, such as emailing a record to the wrong address, sending more of a chart than the recipient needs, or leaving files unencrypted. They are still violations, and they still have to be assessed and, where required, reported as breaches.

These everyday slips cause trouble in offices of every size:

• Auto-complete picks the wrong recipient and lab results go to another patient with a similar name.
• The whole file goes out when the recipient needed one page, against the minimum necessary rule.
• Records are emailed as plain attachments that stay in inboxes and can be forwarded.
• The password travels in the same email as the protected PDF, so one mistake exposes both.
• A reply to an online review confirms that the reviewer is a patient or mentions their treatment.
• A laptop or USB drive without encryption is lost or stolen.
• Staff forward work files to personal email to finish them at home.

Several of these come down to how files are sent. Our guides on whether email is secure and how to encrypt a file cover the safer options.

What Are the Penalties for HIPAA Violations?

HIPAA civil penalties depend on how much the organization knew. For 2025, HHS set them between $145 USD and $73,011 USD per violation, with a calendar-year cap of $2,190,294 USD. Willful neglect that is not corrected starts at $73,011 USD per violation. Criminal penalties apply to people who knowingly disclose health information.

2025 amounts from the HHS inflation adjustment published in the Federal Register on January 28, 2026 (45 CFR § 102.3), which apply to penalties assessed on or after that date.

Criminal penalties are set by 42 U.S.C. § 1320d-6. A person who knowingly obtains or discloses health information in violation of HIPAA can be fined up to $50,000 USD and jailed for up to one year. If the offence is committed with intent to sell or use the information for commercial advantage, personal gain or malicious harm, the limits rise to $250,000 USD and 10 years. The law says this includes "an employee or other individual."

State attorneys general can also bring civil actions on behalf of their residents under 42 U.S.C. § 1320d-5(d), a power added by the HITECH Act in 2009. Every case in the table above came from one.

How Can You Prevent Common HIPAA Violations?

You prevent most common HIPAA violations with a short list of habits: share only the minimum necessary, encrypt health information on devices and in transit, confirm every recipient, use multifactor login, vet vendors and website tools, and train staff on what they may and may not take or send.

Write the checklist into your policies, repeat it in training, and review it after any near miss.

Is There a Canadian Equivalent to HIPAA Violations?

Canada has no single equivalent to HIPAA; provincial health privacy laws and the federal PIPEDA set similar duties. Ontario, New Brunswick, Nova Scotia and Newfoundland and Labrador have their own health information laws, such as Ontario's PHIPA. The federal PIPEDA applies to private-sector organizations that handle personal information in the course of a commercial activity.

A Safer Way to Send Files With Health Information

This is where SureSend comes into the picture. SureSend is a Canadian secure file transfer service that sends files through a passphrase-protected link that expires on a date you choose. SureSend encrypts every file while it's sent and while it's stored (TLS in transit, AES-256 at rest). It addresses the file-sending mistakes above: a file isn't left as an attachment in an inbox, and the link alone opens nothing without the passphrase.

Here is exactly how it works:

1. Create a transfer. Sign in, add one or more recipient email addresses, upload your files, and choose an expiry date of up to 21 days.
2. Set a passphrase. SureSend emails each recipient a secure link, but the passphrase is never included in that email. You share it separately, by phone or text.
3. The recipient downloads. They open the link, enter the passphrase, and download the files. They do not need a SureSend account.
4. Track and control it. Your dashboard shows when the transfer is retrieved. You can cancel it before it is downloaded, and it expires automatically.

Each transfer allows one successful download. If the download is interrupted, the recipient can try again until one download completes; after that the link cannot be used again, and the transfer's status updates to Retrieved.

Your dashboard shows every transfer's status. If you send to the wrong address, you can cancel the transfer before it is downloaded.

Be clear about one thing. If you are a U.S. covered entity or business associate, HIPAA requires a business associate agreement with any service that stores your patients' files, SureSend included. Confirm that in writing before you send health information through any provider. A secure transfer tool is one safeguard within your privacy program, not a compliance solution on its own.

Your recipient needs no account. You can start on the free Starter plan; Pro is $7 CAD/month plus applicable taxes, with transfers up to 2 GB. SureSend doesn't keep your files forever; they're removed when the transfer expires.

A Quick Workflow That Works

Use this routine every time you send a file that contains health information:

1. Ask what the recipient needs, and remove everything else.
2. Check the recipient's address letter by letter, not from auto-complete.
3. Send a link that needs a passphrase instead of an attachment.
4. Share the passphrase by phone or text, never in the same email.
5. Set the shortest expiry that works.
6. If something goes to the wrong person, cancel it and follow your breach procedure at once.

If you can send an email, you can SureSend a file.

Frequently Asked Questions

What are HIPAA violations?

HIPAA violations are failures to follow the HIPAA Privacy, Security or Breach Notification Rules. Examples include disclosing health information without permission, sharing more than the minimum necessary, leaving electronic records unprotected, and notifying patients of a breach too late.

What are the most common HIPAA violations?

In the enforcement cases above, the common HIPAA violations were misdirected or revealing mail, records taken to a new employer, patient data used for marketing, website tools sharing health searches, and unencrypted files behind weak logins.

What is an example of an unintentional HIPAA violation?

Emailing lab results to the wrong patient because auto-complete chose a similar name can be an unintentional HIPAA violation. So can a vendor addressing letters to the wrong people: in a New Jersey case settled in 2021, letters meant for 13,047 living patients went to their prospective next of kin.

Can an employee be fined for a HIPAA violation?

Yes. Under 42 U.S.C. § 1320d-6, a person, including an employee, who knowingly obtains or discloses health information in violation of HIPAA can be fined up to $50,000 USD and jailed for up to one year, and more if it is done for personal gain.

How much is a HIPAA fine?

For 2025 amounts, HIPAA civil penalties range from $145 USD to $73,011 USD per violation, with a calendar-year cap of $2,190,294 USD. State attorneys general settlements in the cases above ranged from $15,000 USD to $1.15 million USD.

Is emailing patient information a HIPAA violation?

Not automatically, but it carries risk. The HIPAA Security Rule requires safeguards for health information sent over a network, and a misdirected or unprotected email can be an impermissible disclosure.

How does SureSend protect files?

SureSend encrypts files in transit (TLS) and at rest (AES-256), and SureSend manages the encryption keys. The passphrase is never included in the email with the link.

Sources

This article draws on the following sources, checked on November 3, 2026. Penalty amounts are adjusted for inflation, so confirm the current figures on each page.

• Office of the New York State Attorney General. A.G. Schneiderman Announces Settlement With Aetna Over Privacy Breach Of New York Members' HIV Status (January 23, 2018). ag.ny.gov
• New Jersey Office of Attorney General. New Jersey Health Care Providers Will Adopt New Security Measures and Pay $425,000 to Settle Investigation into Two Data Breaches (December 15, 2021). njoag.gov
• Office of the New York State Attorney General. A.G. Schneiderman Announces Settlement With University Of Rochester To Prevent Future Patient Privacy Breaches (December 2, 2015). ag.ny.gov
• Office of the New York State Attorney General. A.G. Schneiderman Announces $25,000 Fine For Rochester Home Health Care Company (December 23, 2016). ag.ny.gov
• Office of the New York State Attorney General. Attorney General James Secures $300,000 from NewYork-Presbyterian Hospital for Failing to Protect Patient Data (December 27, 2023). ag.ny.gov
• Office of the New York State Attorney General. Attorney General James Secures $500,000 from Capital Region Health Care Provider for Failing to Protect Patients' Information (December 26, 2025). ag.ny.gov
• Office of the New York State Attorney General. Attorney General James Secures $200,000 from Law Firm for Failing to Protect New Yorkers' Personal Data (March 27, 2023). ag.ny.gov
• U.S. Department of Health and Human Services, Federal Register. Annual Civil Monetary Penalties Inflation Adjustment, 91 FR 3665 (January 28, 2026). govinfo.gov
• 45 CFR § 164.502 (via Cornell Legal Information Institute). Uses and disclosures of protected health information: general rules. law.cornell.edu
• 45 CFR § 164.312 (via Cornell Legal Information Institute). Technical safeguards. law.cornell.edu
• 45 CFR § 164.404 (via Cornell Legal Information Institute). Notification to individuals. law.cornell.edu
• 42 U.S.C. § 1320d-6 (via Cornell Legal Information Institute). Wrongful disclosure of individually identifiable health information. law.cornell.edu
• 42 U.S.C. § 1320d-5 (via Cornell Legal Information Institute). General penalty for failure to comply with requirements and standards. law.cornell.edu

The Bottom Line

The HIPAA violations examples above share one thread: an ordinary task done without a second look. A window envelope, a list, a tracking tool, an unencrypted file. None needed a hacker to become a penalty.

Check what you send. Then just SureSend it.