HIPAA Violation Cases: Real Fines, What OCR Found, and What It Means for You

Core insight

HIPAA penalties rarely follow a single catastrophic failure. The organizations that end up paying seven figures - Anthem, Excellus, Montefiore, Gulf Coast - were found to have the same small set of gaps: no current risk analysis, no visibility into who was accessing patient data, no process for terminating access when it should have ended. OCR (Office for Civil Rights) does not fine organizations for being hacked, but for the compliance failures that made the breach possible, invisible, or worse to respond to. The enforcement record is consistent enough that the risk is largely predictable - and largely preventable. 

What exactly is a HIPAA violation case?

A HIPAA violation case is a formal compliance investigation opened by the Department of Health and Human Services' Office for Civil Rights (OCR). It starts in one of two ways: a patient or employee files a complaint through OCR's portal, or an organization self-reports a data breach affecting 500 or more individuals. From that point, OCR decides whether to investigate. If it finds evidence of noncompliance, the case can result in a corrective action plan, a financial settlement, or a civil monetary penalty - depending on the severity and duration of the violations found.

The distinction between a breach and a violation is important. A breach is an unauthorized disclosure of protected health information (PHI). A violation is any failure to comply with HIPAA Rules - and a violation can exist without any breach occurring at all. OCR has fined organizations for failing to conduct a risk analysis, failing to provide patients with their records on time, and failing to train employees, even when no data was ever stolen or exposed.

Where OCR investigations go before a penalty lands

When HHS Office for Civil Rights opens a HIPAA investigation, it notifies the covered entity or business associate and requests information about the alleged violation. OCR can also initiate a compliance review independently - no complaint required. Investigators review risk analyses and risk management plans, access controls and safeguards, workforce training, policies and procedures, and whether those policies were actually followed in practice.

If OCR finds noncompliance, it typically seeks voluntary compliance, corrective action, or a resolution agreement. Most investigations end here. Resolution agreements require the organization to implement specified corrective measures and report progress to HHS - monitoring typically runs three years, though the exact requirements vary by agreement.

If OCR cannot reach a satisfactory resolution, it may propose a civil money penalty (CMP). The entity can then request a hearing before an HHS Administrative Law Judge to challenge the proposed penalty or the underlying findings.

How OCR calculates what you owe

HIPAA's CMP framework assigns penalties across four culpability tiers. The amounts below reflect inflation-adjusted federal figures effective January 28, 2026:

In practice, OCR applies lower annual caps to Tiers 1–3 under its enforcement discretion policy: $36,505.50 for Tier 1, $146,053 for Tier 2, and $365,052 for Tier 3. Tier 4 remains subject to the full $2,190,294 annual limit.

Culpability tier is only one input. Under 45 CFR § 160.408, OCR also weighs the nature and scope of the violation, the number of individuals affected, how long the violation persisted, resulting harm, the organization's compliance history, and its financial condition.

Where organizations face the largest exposure is systemic, long-standing noncompliance across multiple HIPAA requirements. Each distinct violation generates a separate penalty calculation - and organizations that failed to address known deficiencies can face cumulative settlements well into the millions.

Famous HIPAA violation cases

The cases below represent some of the largest and most instructive enforcement actions in OCR's history. Each illustrates a pattern that appears repeatedly across smaller, less-publicized investigations.

Anthem Inc. - $16,000,000 (2018)

In 2015, Anthem disclosed a breach of 78.8 million records - the largest health data breach in U.S. history. Hackers gained access to Anthem's systems using a spear-phishing attack and exfiltrated names, Social Security numbers, dates of birth, and employment information over a period of weeks.

OCR's investigation found that Anthem had failed to conduct an enterprise-wide risk analysis, failed to implement sufficient controls to detect anomalous network activity, and failed to respond adequately after detecting the breach. Anthem agreed to a $16 million settlement - at the time a record - along with a two-year corrective action plan.

The OCR traced the breach directly to the absence of foundational security processes that should have been in place years earlier.

Excellus Health Plan - $5,100,000 (2021)

In 2015, Excellus - the largest health plan in upstate New York - reported a breach involving the PHI of 9.3 million individuals. Hackers had accessed its systems for more than a year before the breach was detected.

OCR's investigation identified four areas of noncompliance: failure to conduct a thorough risk analysis, failure to implement a risk management plan, lack of information system activity reviews, and insufficient technical policies to prevent unauthorized access. The case was settled for $5.1 million.

What makes this case notable is the timeline. The breach began in 2013. Excellus reported it in 2015. OCR's investigation ran until 2021. The penalty reflected not just the breach, but six years of demonstrated noncompliance that preceded and enabled it.

Montefiore Medical Center - $4,750,000 (2024)

In 2015, the New York Police Department notified Montefiore that a current employee had been stealing patient data. The employee had accessed the records of 12,517 patients and sold the data to an identity theft ring - over a period of approximately one year.

OCR's investigation found three failures: no accurate risk analysis covering internal threats, no procedures for reviewing information system activity logs, and no technical mechanisms to record and examine who was accessing what data and when. Montefiore settled for $4.75 million.

For clinics and health systems, this case is a direct challenge to the assumption that HIPAA compliance is primarily about external attackers. The Montefiore breach was entirely internal - and invisible, because nobody was looking.

Solara Medical Supplies - $3,000,000 (2025)

Solara, a supplier of diabetes management equipment, fell victim to a phishing attack between April and June 2019. Eight employee email accounts were compromised, exposing the PHI of 114,007 individuals.

OCR identified multiple violations: failure to conduct a risk analysis, failure to manage and reduce risks to an acceptable level, and impermissible disclosure of PHI. But the detail that stands out is what happened next: when Solara sent breach notification letters to affected individuals, 1,531 letters went to incorrect addresses - creating a second, separate breach in the process of responding to the first.

OCR settled for $3 million. The case illustrates how a compliance failure under pressure compounds. A breach notification process with no procedure behind it is itself a liability.

Athens Orthopedic Clinic - $1,500,000 (2020)

In 2016, Athens Orthopedic Clinic in Georgia was hacked. The attacker stole data belonging to 208,557 patients, then attempted to extort the clinic. When the clinic refused to pay, the attacker posted the stolen data online.

OCR's investigation found the clinic had no business associate agreements in place, had provided no HIPAA Privacy Rule training to its workforce, had conducted no risk analysis, and had no system for monitoring information system activity. The case was settled for $1.5 million.

For smaller practices, the key finding here is the combination of failures. Each individual gap - missing BAA, no training, no risk analysis - would have been actionable on its own. Together, they indicated a compliance program that existed in name only.

Banner Health - $1,250,000 (2023)

In 2016, Banner Health - one of the largest nonprofit health systems in the United States - experienced a hacking incident that resulted in the impermissible disclosure of the PHI of 2.81 million individuals.

OCR's investigation found a failure to conduct a risk analysis, a lack of reviews of system activity logs, a failure to verify identity for access to PHI, and insufficient technical safeguards. The case was settled for $1.25 million.

Banner Health also appeared in a separate 2021 settlement for $200,000, this time for failing to provide patients with timely access to their medical records. The same organization, two different investigations, two different violation categories.

Gulf Coast Pain Consultants - $1,190,000 (2024)

On February 19, 2019, Gulf Coast Pain Consultants - a Florida pain management practice - discovered that a former contractor had accessed patient records without authorization on three separate occasions after their engagement had ended.

The contractor had accessed the electronic protected health information of 34,310 patients. OCR found four violations: no risk analysis, no review of system activity logs, failure to promptly terminate the contractor's access rights when the engagement ended, and no policies for modifying access rights when workforce members' roles change.

OCR imposed a civil monetary penalty of $1.19 million - meaning Gulf Coast contested OCR's findings and lost. This is one of the cleaner examples in the enforcement record of what "access control failure" actually looks like in a clinical setting: a contractor who finished their work and kept their login.

What small and mid-size organizations consistently get wrong

The cases above involve organizations ranging from single-location practices to national health systems. The violations OCR finds in each are remarkably consistent.

Risk analysis exists on paper but not in practice. Anthem, Excellus, Athens Orthopedic, Banner Health, and Gulf Coast all had some compliance infrastructure in place. What OCR found in each was that the risk analysis had either never been conducted organization-wide, or had not been updated as systems changed. A risk analysis completed in 2018 for an environment that has since added three new vendors, a patient portal, and a cloud EHR is not a current risk analysis.

Contractor and former employee access outlasts the engagement. Gulf Coast is the explicit case, but the pattern runs through the entire enforcement record. Access rights granted for a specific role or project continue long after the reason for that access has ended. In clinical environments with high staff turnover and frequent vendor changes, this is one of the most common and preventable sources of unauthorized PHI access.

Business associate agreements are missing or unsigned. Athens Orthopedic had no BAAs in place at all. Advanced Care Hospitalists - fined $500,000 in 2018 - allowed a business associate to access PHI without a signed agreement. The BAA is the legal mechanism that extends HIPAA obligations to every vendor, contractor, and service provider who touches PHI. Without it, there is no contractual basis for holding that party accountable - and OCR holds the covered entity responsible for the gap.

Breach notification is built on improvisation. Solara's second breach - 1,531 notification letters sent to wrong addresses - is an extreme version of a common pattern: organizations prepare for the possibility of a breach but not for the process of responding to one. Breach notification carries its own timelines (60 days to notify HHS and affected individuals) and its own documentation requirements. Improvising under pressure is how additional violations get created.

IT security and HIPAA compliance are treated as interchangeable. They overlap significantly, but OCR does not fine organizations for being hacked. It fines organizations for the compliance failures that allowed the breach to happen - or go undetected - and for how the organization responded afterward. Two organizations can experience identical breaches and face very different OCR outcomes depending on the state of their compliance programs before and after the incident.

How to avoid being a case study

The enforcement record points to a short list of things that consistently separate organizations that settle for seven figures from those that resolve investigations with technical assistance or corrective action plans alone.

Conduct a risk analysis - and update it

OCR has made risk analysis the centerpiece of its current enforcement initiative. Every hacking-related investigation now includes an assessment of whether the organization conducted a comprehensive, accurate, organization-wide risk analysis and whether identified risks were actually addressed. "We did one in 2021" is not sufficient if your infrastructure has changed since then.

Map and terminate access rights systematically

Know who has access to PHI, why they have it, and what triggers a review or termination of that access. This applies to employees changing roles, contractors finishing engagements, and vendors offboarding. The Gulf Coast case is a $1.19 million illustration of what happens when this process does not exist.

Sign BAAs before sharing PHI - with every vendor

Every service provider that touches PHI needs a signed BAA before any PHI is disclosed to them. This includes cloud storage providers, billing companies, EHR vendors, and any SaaS tool that processes patient data. "We assumed they were compliant" does not satisfy OCR.

Build a breach response process before you need it

Document who is responsible for breach detection, investigation, notification, and reporting. The 60-day notification clock starts from the date of discovery - not the date you finish your internal investigation. Organizations that discover a breach and improvise their response from that point tend to miss timelines and make the kind of errors Solara made.

Review system activity logs regularly

Montefiore's employee stole data for approximately a year. Nobody noticed because nobody was looking at the logs. OCR's corrective action plans consistently require organizations to implement and maintain regular reviews of who is accessing what in systems containing ePHI. This is a technical control, but it is also a HIPAA requirement - and its absence is one of the most frequently cited violations in the enforcement record.

HIPAA compliance gaps rarely stay hidden. If any of the patterns above look familiar - an outdated risk analysis, unsigned BAAs, no process for terminating contractor access - the time to fix them is before OCR opens an investigation. Get in touch with Apzumi to assess where you stand.

FAQ

What triggers an OCR investigation?

Two things: a complaint filed through OCR's online portal, or a breach report submitted to the HHS Breach Portal. Any breach affecting 500 or more individuals must be reported to HHS within 60 days of discovery and is automatically listed on OCR's public breach portal - commonly called the "Wall of Shame." OCR investigates all large breaches. For smaller breaches and complaints, OCR uses a triage process to prioritize cases based on the nature and severity of the alleged violation. Organizations can also be selected for a compliance audit, a program OCR restarted in 2025.

Can a small organization be fined under HIPAA?

Yes. OCR has settled cases with solo practitioners, single-location dental practices, small mental health providers, and ambulance companies. The financial penalty may be lower - OCR considers the organization's financial position when agreeing to settlements - but the compliance obligations are identical regardless of size. The 2020 enforcement record includes settlements for as little as $3,500 (King MD) alongside the $6.85 million Premera settlement. Small organizations are not exempt; they are simply more likely to receive technical assistance for minor violations rather than financial penalties.

What is the difference between a settlement and a civil monetary penalty?

A settlement is a negotiated resolution. The organization acknowledges potential violations, agrees to pay a reduced financial penalty, and implements a corrective action plan. No formal finding of wrongdoing is made. A civil monetary penalty (CMP) is imposed by OCR after the organization contests the findings and loses - either by not engaging with OCR's process or by losing a hearing before an Administrative Law Judge. CMPs carry no corrective action plan but are a formal determination that HIPAA Rules were violated. Gulf Coast Pain Consultants' $1.19 million penalty was a CMP - the practice contested OCR's findings and the penalty was upheld.