A hospital employee in Texas looks up her ex-husband's medical records out of curiosity. A health plan leaves 18 boxes of patient files in a parking lot. A clinic responds to a negative Yelp review by disclosing the patient's diagnosis. These aren't hypothetical scenarios. These are actual HIPAA violation cases that triggered federal investigations, six- and seven-figure penalties, and permanent reputational damage for the organizations involved.

If you work in healthcare — or any organization that touches protected health information (PHI) — these cases aren't just cautionary tales. They're the playbook HHS and the Office for Civil Rights (OCR) use to set enforcement priorities that directly affect your organization in 2026.

I've spent years analyzing OCR enforcement actions and advising covered entities on what actually triggers investigations. Here's what the real cases tell us.

The $4.3 Million Wake-Up Call: Anthem's Record-Setting Case

In 2018, OCR announced a $16 million settlement with Anthem Inc. following a breach that exposed the ePHI of nearly 79 million individuals. It remains the largest HIPAA settlement in history. The breach stemmed from a series of spear-phishing emails that gave hackers access to Anthem's IT system for weeks before anyone noticed.

OCR's investigation found Anthem failed to conduct an enterprise-wide risk analysis, lacked adequate procedures for reviewing information system activity, and didn't implement sufficient access controls. You can read the full resolution agreement on the HHS enforcement page.

Here's what catches my attention about this case: the failures weren't exotic. No nation-state zero-day exploit. No elaborate inside job. Anthem got hit because basic, well-documented safeguards weren't in place. Risk analysis. Access controls. Monitoring. The stuff every covered entity is supposed to do on day one.

What This Case Means for Your Organization

If you haven't completed a thorough, enterprise-wide risk analysis — not a checklist, an actual analysis — you're operating with the same gap that cost Anthem $16 million. OCR has made risk analysis failures the single most common finding in HIPAA violation cases. It shows up in nearly every settlement they publish.

Snooping Employees: The Breach That Starts From the Inside

The UCLA Health System paid $865,500 to settle a case where a physician was caught repeatedly accessing celebrity patient records without authorization. This wasn't a hack. It was an employee with legitimate system access using it for illegitimate purposes.

I've seen this pattern more than any other. An intake coordinator checks on a neighbor's prescription history. A nurse looks up a coworker's lab results. A billing clerk pulls records for a family member's custody dispute. Every one of these is a potential HIPAA violation case.

OCR investigates these incidents aggressively, especially when the covered entity can't demonstrate that it had reasonable safeguards in place — audit logs being reviewed, workforce training on permissible access, and sanctions policies being enforced.

If your staff doesn't understand the boundaries, our course Accessing Records: If It's Not Your Job, It's a Breach walks through exactly where the line is and what happens when someone crosses it.

What Counts as a HIPAA Violation Case?

A HIPAA violation case is any instance where OCR determines that a covered entity or business associate has failed to comply with HIPAA's Privacy, Security, or Breach Notification Rules. Cases can originate from individual complaints, breach reports, or compliance reviews initiated by OCR. Penalties range from corrective action plans with no financial penalty to multi-million-dollar settlements and, in criminal cases, imprisonment. OCR publishes resolved cases on its enforcement examples page.

Social Media: The Fastest Way to Create a HIPAA Violation Case in 2026

In my experience, social media violations are accelerating faster than any other category. Staff members post photos from inside treatment areas. Someone shares a "feel-good" patient story on Instagram without realizing they've disclosed PHI. A receptionist vents about a difficult patient encounter on Facebook, including just enough detail to identify the individual.

OCR doesn't need a formal complaint to act on these. A single screenshot can trigger an investigation. And the Breach Notification Rule doesn't include an exception for "I didn't mean to."

The $4.3 million settlement with New York-Presbyterian Hospital and Columbia University in 2014 included issues around unauthorized filming that involved PHI being visible to camera crews. While that case predated TikTok and Instagram Reels, the principle is the same: if PHI is captured and shared publicly, you have a reportable breach.

Your workforce needs specific training on this — not a generic "be careful on social media" slide. Our Social Media & PHI training covers the exact scenarios that are generating complaints to OCR right now.

The $1.5 Million Lesson in Breach Response Timing

In 2017, Presence Health agreed to a $475,000 settlement with OCR for a breach notification failure — specifically, failing to notify affected individuals and HHS within the required 60-day window after discovering a breach involving paper-based PHI. The organization discovered the breach in October 2013 but didn't notify HHS until January 2014.

That settlement was notable because the underlying breach was relatively small — it involved operating room schedules for about 836 individuals. The penalty wasn't about the size of the breach. It was about the delay in notification.

This is a pattern I see constantly. Organizations discover a potential breach and then spend weeks debating internally whether it "really" qualifies. Meanwhile, the 60-day clock from the Breach Notification Rule is ticking. By the time legal, compliance, and leadership align on a response, they've already blown the deadline.

Your First Hour Determines Your Outcome

The decisions you make immediately after discovering a potential incident shape everything that follows — your regulatory exposure, your notification timeline, and your ability to mitigate harm. That's exactly why we built First 60 Minutes: Incident Response. It gives your workforce a concrete framework for those critical early decisions.

Small Practices Aren't Exempt: The Cases That Prove It

There's a persistent myth that OCR only goes after large health systems. The enforcement record says otherwise.

In 2019, OCR settled with Bayfront Health St. Petersburg for $85,000 after an employee accessed patient records without a work-related reason. In 2018, Filefax Inc., a medical records storage company, paid $100,000 for leaving PHI in an unlocked vehicle accessible to unauthorized individuals. Neither of these was a Fortune 500 company.

OCR has explicitly stated that covered entities of all sizes are expected to comply with HIPAA rules. The risk analysis requirement applies to a two-physician practice just as much as it applies to a hospital network. Smaller organizations often lack dedicated compliance staff, which makes workforce training even more critical.

Criminal HIPAA Violation Cases: When It Goes Beyond Civil Penalties

Most HIPAA violation cases result in civil penalties. But the Department of Justice prosecutes criminal violations under 42 U.S.C. § 1320d-6, found at law.cornell.edu. Criminal penalties apply when someone knowingly obtains or discloses PHI in violation of HIPAA.

Penalties escalate based on intent:

  • Knowingly obtaining or disclosing PHI: Up to 1 year imprisonment and $50,000 fine
  • Under false pretenses: Up to 5 years and $100,000
  • With intent to sell, transfer, or use for commercial advantage, personal gain, or malicious harm: Up to 10 years and $250,000

These criminal cases typically involve employees selling patient data, identity theft rings operating inside healthcare organizations, or individuals accessing records to stalk or harass someone. They're rarer than civil cases, but they happen — and they destroy careers.

Five Patterns That Show Up in Nearly Every HIPAA Violation Case

After reviewing hundreds of OCR enforcement actions, I see the same five failures over and over:

  • No enterprise-wide risk analysis. OCR cites this in the majority of settlements. It's the single most common deficiency.
  • Insufficient access controls. Too many people have access to too much data with no role-based restrictions.
  • Failure to monitor audit logs. Organizations generate logs but never review them, so unauthorized access goes undetected for months.
  • Inadequate workforce training. Generic annual training doesn't address the specific risks staff face daily — snooping, social media, phishing, and breach response.
  • Delayed breach notification. Organizations miss the 60-day window because they don't have a documented incident response process.

Every one of these is preventable. None of them requires a massive budget. They require attention, documentation, and training that actually connects to the work your staff does every day.

What These Cases Should Change About Your Compliance Program

Reading about HIPAA violation cases is useful. Changing your operations because of them is what matters.

Start with your risk analysis. If it's more than 12 months old — or if it was a one-time exercise you've never updated — it's insufficient. Then look at your access controls and audit log review processes. Finally, invest in targeted workforce training that goes beyond checking a box.

Browse our full training catalog to find courses built around the exact scenarios driving OCR enforcement in 2026. Because the next HIPAA violation case OCR publishes doesn't have to be yours.