Common HIPAA Violations and How to Avoid Them

INTRODUCTION

 

The Reality:

 

Most HIPAA violations are not malicious. They’re the result of:

• Lack of training
• Convenience over compliance
• Not understanding the rules
• Workplace culture that doesn’t prioritize privacy
• Simple human error

The Good News:

 

If you can recognize the patterns, you can prevent violations!

The Bad News:

 

Even unintentional violations carry serious consequences.

**VIOLATION #1: UNAUTHORIZED ACCESS (“SNOOPING”)**

 

What It Is:

 

Accessing patient records without a legitimate work-related reason.

Common Scenarios:

 

• Looking up your own medical records through work systems
• Checking on family members or friends
• Looking up celebrities or high-profile patients
• Viewing coworkers’ medical information
• Browsing records out of curiosity

Real Case Study:

 

Hospital employee accessed records of 1,000+ patients over 6 months, including celebrities. Audit logs revealed the pattern. Employee was terminated, criminally prosecuted, and the hospital was fined $800,000.

Why It Happens:

 

• Curiosity
• Concern for friends/family
• Not understanding it’s prohibited
• “Everyone does it” mentality
• Easy access without oversight

How to Avoid It:

 

• Only access records for patients you’re actively treating or have legitimate business reason
• Use “need to know” test before accessing
• Know that all access is logged and monitored
• Use proper patient portals for your own records
• Ask family to sign authorization if you need to check their records

Warning Signs You’re About to Violate:

 

[!] “I’ll just take a quick look…”

[!] “They’re my friend/family, so it’s okay…” [!] “I’m just curious about…”

[!] “Everyone wants to know about the celebrity patient…”

—

**VIOLATION #2: IMPROPER DISPOSAL OF PHI**

 

What It Is:

 

Throwing away PHI in regular trash or failing to properly destroy electronic media.

Common Scenarios:

 

• Tossing patient documents in regular trash
• Not shredding printouts, labels, or paperwork
• Throwing away computers/hard drives without destroying data
• Discarding CDs, USB drives, or backup tapes in trash
• Not emptying printer trays or fax machines

Real Case Study:

 

Pharmacy threw patient prescription bottles with labels in outside dumpster. Journalist found them and reported it. Pharmacy fined $125,000 and required to implement destruction protocols.

Why It Happens:

 

• Shredder is inconvenient
• Don’t realize printouts contain PHI
• Not thinking about device hard drives
• End-of-day rush to clean up
• Lack of proper disposal containers

How to Avoid It:

 

• Shred ALL documents with ANY PHI
• Physically destroy hard drives before disposal
• Use certified destruction services for large volumes
• Place secure disposal bins in convenient locations
• Empty all printer/fax trays daily
• Never take PHI home to dispose of there

What to Shred:

 

• Patient charts and notes
• Appointment schedules
• Lab results and reports

—

• Billing statements
• Sign-in sheets
• Prescription labels
• Any paper with patient names/info

**VIOLATION #3: GOSSIPING ABOUT PATIENTS**

 

What It Is:

 

Discussing patient information in public areas or with unauthorized people.

Common Scenarios:

 

• Talking about patients in elevators, cafeterias, hallways
• Discussing interesting cases with family at home
• Posting about patients on social media (even without names)
• Talking about patients with other patients
• “You won’t believe what I saw today…” stories

Real Case Study:

 

Two nurses discussed patient’s HIV status in hospital elevator with others present. Visitor overheard, posted on social media. Both nurses terminated, hospital fined $387,000.

Why It Happens:

 

• Need to decompress after difficult cases
• Excitement about unusual cases
• Not realizing verbal disclosures violate HIPAA
• Thinking it’s okay if you don’t use names
• Workplace culture of gossip

How to Avoid It:

 

• Never discuss patients in public areas
• Use private conference rooms or offices
• Don’t discuss work at home or with friends
• Never post about patients on social media

• Use generic terms when teaching (no identifying details)
• Remember: even without names, details can identify people

Public Places to AVOID Patient Discussions:

•  Elevators
• Cafeterias
• Parking lots
• Waiting rooms
• Hallways
• Bathrooms
• Break rooms (if not secure)

**VIOLATION #4: SENDING UNENCRYPTED EMAILS WITH PHI**

 

What It Is:

 

Emailing patient information without encryption or to wrong recipients.

Common Scenarios:

 

• Using regular email instead of secure methods
• Replying to patient emails with medical information
• Sending PHI to personal email for convenience
• Emailing to wrong person (typo or autocomplete error)
• Using non-secure cloud services

Real Case Study:

 

Medical practice employee emailed spreadsheet with 500 patients’ names, DOBs, SSNs, and diagnoses to wrong recipient. Recipient was competitor. Fine: $100,000 plus cost of breach notification.

Why It Happens:

 

• Regular email is faster/easier
• Don’t understand encryption requirements
• Responding quickly without thinking

• Using autocomplete without verifying
• Working from home on personal devices

How to Avoid It:

 

• Use encrypted email or secure patient portals only
• Never email PHI to personal accounts
• Double-check recipient before sending
• Use secure file transfer for large files
• Don’t include PHI in subject lines
• Use patient portals for patient communication

Secure Communication Methods:

 

 

 

 

 

 

 

 

 

 

 

—

• Encrypted email (TLS/S/MIME)
• Secure patient portals
• HIPAA-compliant messaging apps
• Secure fax (yes, still used!)
• Encrypted file transfer (SFTP)

**VIOLATION #5: LOST OR STOLEN DEVICES**

 

What It Is:

 

Unencrypted devices with ePHI are lost, stolen, or left unattended.

Common Scenarios:

 

• Laptop stolen from car
• USB drive lost
• Smartphone left in restaurant
• Tablet left in airport
• Unattended computer in public place

Real Case Study:

 

Employee’s laptop stolen from car. Contained unencrypted data for 600,000 patients. Fine: $1.7 million plus cost of providing credit monitoring to all affected individuals.

Why It Happens:

 

• Convenience over security
• “It won’t happen to me” thinking
• Not understanding encryption requirements
• Devices left in cars “just for a minute”
• Using personal devices for work

How to Avoid It:

 

• Encrypt ALL portable devices
• Never leave devices in vehicles
• Use strong passwords/biometrics
• Enable remote wipe capability
• Report loss immediately
• Use physical locks (cable locks for laptops)

If Device Is Lost/Stolen:

 

1. Report IMMEDIATELY to security officer

2. Remote wipe if possible

3. Change passwords

4. File police report

5. Assess what PHI was on device

6. Begin breach assessment

—

**VIOLATION #6: WEAK PASSWORDS & SHARED CREDENTIALS**

 

What It Is:

 

Using weak passwords or sharing login credentials with others.

Common Scenarios:

 

• Using simple passwords (Password123)

• Writing passwords on sticky notes
• Sharing passwords with coworkers
• Using same password for multiple systems
• Never changing passwords
• Using generic/shared logins

Real Case Study:

 

Employee shared password with temporary worker who then accessed records inappropriately. Both employees terminated. Organization fined for inadequate access controls.

Why It Happens:

 

• Password fatigue
• Helping coworkers
• Trying to be efficient
• Not understanding unique login requirement
• Weak password policies

How to Avoid It:

 

• Create strong, unique passwords
• Never share credentials
• Use password managers
• Change passwords regularly
• Never write down passwords
• Report if you think your password is compromised

Strong Password Guidelines:

 

 

 

 

 

 

 

 

 

 

 

—

• Minimum 8 characters (longer is better)
• Upper and lowercase letters
• Numbers and symbols
• Not related to personal information
• Unique for each system

**VIOLATION #7: FAILING TO LOG OUT**

 

What It Is:

 

Leaving workstations unattended while still logged in.

Common Scenarios:

 

• Stepping away “just for a minute”
• Going to lunch without logging out
• End of shift – rushing out
• Answering phone at another desk
• Quick bathroom break

Real Case Study:

 

Nurse left workstation logged in. Patient family member accessed other patients’ records. Multiple privacy violations. Nurse suspended, hospital fined.

Why It Happens:

 

• Rushing/busy environment
• Not thinking about it
• Slow login process
• “I’ll only be gone a second”
• Workplace culture that doesn’t enforce it

How to Avoid It:

 

• Log out EVERY time you step away
• Use Windows key + L for quick lock
• Enable automatic screen lock (5 minutes)
• Make it a habit
• Remind coworkers who forget

The Rule:

 

If you can’t see your screen, you should be logged out!

—

**VIOLATION #8: SOCIAL MEDIA VIOLATIONS**

 

What It Is:

 

Posting patient information or photos on social media.

Common Scenarios:

 

• Posting “interesting case” without realizing details identify patient
• Photographing whiteboards with patient names
• Sharing X-rays or images
• Posting about celebrities treated
• Complaining about difficult patients online

Real Case Study:

 

EMT posted photo on Facebook of patient being treated at accident scene. Patient identifiable. EMT fired, company fined $10,000.

Why It Happens:

 

 

• Not thinking before posting
• Wanting to share interesting/difficult day
• Taking photos for “educational” purposes
• Not realizing how identifying details can be
• Social media blur between personal/professional

How to Avoid It:

 

• Never photograph patients or PHI
• Never post about patients online
• Don’t discuss work situations that could identify patients
• Remember: even without names, details identify people
• Check your privacy settings
• Think before you post

Examples of VIOLATIONS:

 

“Crazy day! Treated a famous actress for…” “Patient in Room 5 is driving me crazy…”

“Can’t believe what I saw today…” [with identifying details]

*Posts photo of X-ray showing patient name*

—

**VIOLATION #9: ACCESSING OWN MEDICAL RECORDS THROUGH WORK SYSTEMS**

 

What It Is:

 

Using work system access to view your own patient records instead of proper patient access methods.

Common Scenarios:

 

• Checking your own lab results
• Looking up family members’ records
• Checking on test results before doctor calls
• Reviewing your own medical history

Real Case Study:

 

Nurse accessed own medical records through EHR instead of patient portal. Discovered she was pregnant, told coworkers. Terminated for policy violation even though it was her own information.

Why It Happens:

 

• Convenience
• Faster than waiting for portal access
• “It’s my information, so it should be okay”
• Not understanding the policy

How to Avoid It:

 

• Always use patient portals for own records
• Request records through proper channels
• Don’t use work system access for personal info
• Sign authorization like any other patient
• Understand that audit logs track ALL access

The Rule:

 

At work, you’re an employee, not a patient. Access your records as a patient!

—

VIOLATION #10: USING UNSECURED PUBLIC WiFi

 

What It Is:

 

Accessing ePHI over unsecured wireless networks.

Common Scenarios:

 

• • Working at coffee shop on public WiFi
  • Using airport WiFi to check patient info
  • Using hotel WiFi without VPN
  • Connecting to any unsecured network

Real Case Study:

 

Physician accessed patient records at coffee shop on public WiFi. Hacker intercepted connection, obtained patient data. Physician disciplined, practice fined.

Why It Happens:

 

• Need to work remotely
• Don’t understand WiFi security risks
• Convenience
• Not provided VPN access
• Emergency access needs

How to Avoid It:

 

• Never access ePHI on public WiFi
• Use VPN if you must work remotely
• Use cellular data instead of public WiFi
• Wait until you’re on secure network
• Turn off WiFi auto-connect features

Secure vs. Unsecure Networks:

 

SECURE:

 

• Your organization’s network

• VPN connection
• Cellular data (4G/5G)
• Home WiFi (if properly secured)

UNSECURE:

 

• Coffee shop WiFi
• Hotel WiFi
• Airport WiFi
• Any public hotspot

WORKPLACE CULTURE AND VIOLATIONS

 

Red Flag Cultures:

 

[!] “Everyone does it” mentality [!] Jokes about HIPAA violations

[!] Gossip about patients in break room [!] No consequences for violations

[!] “Don’t ask, don’t tell” approach

[!] HIPAA seen as obstacle, not protection

Healthy Cultures:

 

• Privacy is a core value
• Violations taken seriously
• Regular training and reminders
• Easy to report concerns
• Leadership models compliance
• Positive reinforcement for good practices

Your Role:

 

Even if workplace culture is poor, YOU must:

• Follow HIPAA requirements

• Report violations you witness
• Not participate in gossip or snooping
• Protect your license and career
• Remember: “everyone does it” is not a defense!

WHAT TO DO IF YOU WITNESS A VIOLATION

 

Step 1: Don’t Participate

 

• Do not join in gossip
• Do not look at records you shouldn’t
• Do not ignore the violation

Step 2: Report It

 

• Tell supervisor or privacy officer
• Use anonymous hotline if available
• Document what you witnessed
• Include date, time, what happened

Step 3: Don’t Retaliate

 

• HIPAA protects whistleblowers
• You can’t be fired for good faith reporting
• Retaliation is illegal

What to Report:

 

• Unauthorized access to records
• PHI in trash
• Gossip about patients
• Unsecured PHI
• Lost/stolen devices
• Any suspected violation

How to Report:

 

“I observed [specific behavior] on [date/time] involving [general description]. I’m concerned this may be a HIPAA violation.”

WHAT TO DO IF YOU COMMIT A VIOLATION

 

Step 1: STOP the violation immediately Step 2: REPORT yourself

• Tell your supervisor
• Be honest about what happened
• Don’t try to cover it up

Step 3: COOPERATE with investigation Step 4: LEARN from it

• Understand what went wrong
• Participate in additional training
• Help prevent future violations

Important:

 

Self-reporting shows good faith and may reduce penalties! Trying to hide a violation makes it MUCH worse!

PREVENTION STRATEGIES

 

Daily Habits:

 

Morning:

• Review your schedule – know which patients you’ll access
• Ensure devices are secure
• Check that workstation is properly positioned During Work:
• Think before accessing any record
• Lock screen every time you step away
• Keep PHI secure (no visible papers)
• Have conversations in private areas End of Day:

• Log out of all systems
• Shred any paper with PHI
• Secure all devices
• Check that no PHI is left visible

Weekly Reviews:

 

• Did I access only necessary records?
• Were all my communications secure?
• Did I witness any violations?
• What can I do better?

Monthly Reminders:

 

• Review HIPAA policies
• Check password strength
• Update security software
• Attend training sessions

KEY TAKEAWAYS

 

• Most violations are preventable with awareness and care
• Top violations: snooping, improper disposal, gossiping, unencrypted email, lost devices
• Convenience is the enemy of compliance
• Even unintentional violations carry serious consequences
• Workplace culture matters, but individual responsibility is paramount
• Report violations you witness – it’s protecting patients and yourself
• If you violate, report yourself immediately
• Prevention through daily habits is key