HIPAA Violation Examples: Real Cases, Including Tracking

Common HIPAA violations include impermissible uses and disclosures of protected health information (PHI), missing safeguards, failing to give patients access to their records, weak administrative safeguards for electronic PHI, and sharing more than the minimum necessary, which are the complaint types HHS reports most often (HHS). Website tracking is a newer example: HHS says disclosing PHI to tracking vendors for marketing without authorization is impermissible (HHS). Curve Compliance strips PHI before data reaches an ad platform and signs a BAA on every plan.

Book a call. Curve Compliance sends your conversions to ad platforms server-side, and Curve's team does the setup. Book a call with Curve.

What counts as a HIPAA violation

HIPAA defines a violation as a "failure to comply with an administrative simplification provision" (45 CFR 160.103), which include the Privacy, Security and Breach Notification Rules. The rules bind covered entities and business associates; HHS says "If an entity does not meet the definition of a covered entity or business associate, it does not have to comply with the HIPAA Rules" (HHS). A covered entity is also liable for violations by its agents, "including a workforce member or business associate, acting within the scope of the agency" (45 CFR 160.402). That can include a marketing agency or vendor, when it acts as your agent.

The complaint types HHS sees most

HHS's enforcement highlights, with results as of October 31, 2024, list the issues "most often alleged in complaints," in order (HHS):

• 1. Impermissible uses and disclosures of protected health information.
• 2. Lack of safeguards of protected health information.
• 3. Lack of patient access to their protected health information.
• 4. Lack of administrative safeguards of electronic protected health information.
• 5. Use or disclosure of more than the minimum necessary protected health information.

The same page says OCR had received over 374,321 HIPAA complaints since 2003 and had settled or imposed a civil money penalty in 152 cases (HHS). OCR also says it resolved "over 31,191 cases by requiring changes in privacy practices and corrective actions by, or providing technical assistance to" covered entities and business associates (HHS).

Website tracking and pixel cases

HHS's position on tracking is set out in its bulletin: "disclosures of PHI to tracking technology vendors for marketing purposes, without individuals' HIPAA-compliant authorizations, would constitute impermissible disclosures" (HHS). It adds that a privacy policy or notice alone does not permit such disclosures, and that cookie banners "do not constitute a valid HIPAA authorization" (HHS). A federal court vacated part of the bulletin in June 2024, about IP addresses on unauthenticated pages; see the bulletin annotated after AHA v. Becerra.

Two FTC orders show how regulators treat health data sent to advertisers through tracking. Neither is a HIPAA case. GoodRx was brought under the FTC Act and the FTC's Health Breach Notification Rule (FTC), and BetterHelp under Section 5 of the FTC Act (complaint).

Company	What the FTC said	Outcome
GoodRx, announced February 1, 2023 (FTC)	Shared "sensitive personal health information" including "prescription medications and personal health conditions" with "Facebook, Google, and Criteo"; the first action under the Health Breach Notification Rule	Ban on sharing health data for advertising; a $1.5 million civil penalty; order entered by the court (case page)
BetterHelp, final order July 14, 2023 (FTC)	Shared "sensitive health data with third parties such as Facebook and Snapchat for advertising after promising to keep such data private"	Ban on sharing health data for advertising and personal information for re-targeting; $7.8 million for partial consumer refunds (case page)

For the full list of FTC actions, see FTC health privacy actions, and for class action pixel settlements, which are private lawsuits rather than HIPAA enforcement, see pixel settlements to date.

Real examples from HHS enforcement

A resolution agreement is a settlement in which the entity agrees to obligations and reports to HHS, "generally for a period of three years," and it "may include the payment of a resolution amount" (HHS). These cases were each opened on hhs.gov today:

Entity and date	What HHS described	Outcome
Advanced Care Hospitalists, December 4, 2018	A physicians' group "shares protected health information with unknown vendor without a business associate agreement"	$500,000 and a corrective action plan (HHS)
St. Joseph's Medical Center, November 20, 2023	Allowed "a reporter from the Associated Press (AP) to observe three (3) patients who were being treated for COVID" without valid authorizations	$80,000 (HHS; list)
Allergy Associates of Hartford, November 26, 2018	A doctor's disclosure of patient information to a reporter	$125,000 and a corrective action plan (HHS)
Yakima Valley Memorial Hospital, June 15, 2023	Snooping in medical records by hospital security guards, as HHS's list puts it; HHS cited Security Rule policy and procedure requirements	$240,000 (HHS; list)
Oregon Health & Science University, March 6, 2025	Did not give a patient's personal representative timely access to records	$200,000 civil monetary penalty (HHS)
Regional Women's Health Group, August 28, 2025	A cyberattack "that potentially impacted the protected health information of over 37,000 patients"; Security Rule noncompliance	$320,000 (HHS; list)
Anthem, October 15, 2018	Cyberattacks that "exposed the electronic protected health information of almost 79 million people"	$16 million and corrective action (HHS)

Marketing teams should read the Advanced Care Hospitalists case twice: the issue HHS named was sharing PHI with a vendor that had no BAA. HHS lists every agreement on its resolution agreements page.

Social media examples

Replying to a patient's online review can be a disclosure. Three HHS cases:

• Manasa Health Center. HHS said it "impermissibly disclosed the PHI of four (4) patients in response to their negative reviews posted on Google Reviews," and paid $30,000 (HHS).
• New Vision Dental. A complaint alleged it "disclosed PHI when it responded to patient posts" on Yelp; HHS's investigation also indicated it "failed to have the minimum content required in its Notice of Privacy Practices" and it paid $23,000 (HHS). See the notice of privacy practices.
• Elite Dental Associates. A Dallas practice that paid $10,000 "to settle potential violations" of the Privacy Rule over social media disclosures (HHS).

For a team policy, see HIPAA and social media for clinic teams, and for review replies, responding to reviews without HIPAA violations.

What happens next: penalty tiers

Civil penalties follow four tiers in 45 CFR 160.404, from violations the entity "did not know" about to willful neglect "not corrected during the 30-day period" (eCFR). The worst violations under that scheme are willful neglect left uncorrected. Amounts are "updated annually and published at 45 CFR part 102" (eCFR); see the HIPAA marketing penalties reference table. Criminal cases go elsewhere: OCR refers "the knowing disclosure or obtaining of protected health information in violation of the Rules" to the Department of Justice (HHS). For who does what, see who enforces HIPAA.

How Curve Compliance helps

Impermissible disclosure is the top complaint type, and an ad pixel on a booking or intake page can make one on every page load. Curve's free website scan lists the pixels and trackers on a page. Curve Compliance then replaces browser ad pixels with one script, sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, checks every event for PHI-like patterns and strips PHI before data reaches an ad platform.

Each platform receives only a fixed list of fields, contact identifiers are off by default on Meta, Google Ads and TikTok, and Event Logs show what Curve sent and what each platform accepted. Curve is SOC 2 Type II, signs a BAA on every plan, and Curve's team does the setup, typically live in about a week. For questions about a specific incident, talk to your counsel.

Sources, checked October 26, 2026: HHS, Enforcement Highlights; HHS, Resolution Agreements; HHS, Use of Online Tracking Technologies; HHS, Covered Entities; HHS, Treatment, Payment, and Health Care Operations; HHS, Filing a Complaint; HHS, Your Rights Under HIPAA; HHS agreements with Advanced Care Hospitalists, St. Joseph's, Allergy Associates, Yakima Valley, OHSU, Regional Women's Health Group, Anthem, Manasa, New Vision Dental, Elite Dental; FTC on GoodRx and BetterHelp; 45 CFR 160.103; 160.402; 160.404; 164.512; 42 U.S.C. 1320d-6.

Frequently Asked Questions

What are some examples of HIPAA violations?

Examples include sending PHI to a vendor with no business associate agreement, disclosing patient details in replies to online reviews, letting a reporter see patients, staff snooping in records, and late access to records, all from HHS cases (HHS). Sharing PHI with ad platforms for marketing without authorization is a newer one (HHS).

What are the 10 most common HIPAA violations?

HHS publishes a top five, not a top ten: impermissible uses and disclosures, lack of safeguards, lack of patient access, lack of administrative safeguards for electronic PHI, and more than the minimum necessary (HHS).

Can normal people violate HIPAA?

The HIPAA Rules apply to covered entities and business associates (HHS). But the criminal provision covers "a person (including an employee or other individual)" who knowingly obtains or discloses health information held by a covered entity without authorization (42 U.S.C. 1320d-6).

What proof do you need for a HIPAA violation?

None to file. HHS says "Anyone can file a complaint if they believe there has been a violation of the HIPAA Rules or Part 2" (HHS), and OCR investigates from there.

Who is subject to HIPAA in social media rules?

The same covered entities and business associates, which answer for their staff and agents (45 CFR 160.402). The social media cases above apply the ordinary disclosure rule, 45 CFR 164.502(a), to review replies (HHS; HHS).

What is the biggest HIPAA violation?

HHS called its Anthem resolution a "record HIPAA settlement following largest health data breach in history" when it announced it on October 15, 2018 (HHS).

Can you go to jail for breaching HIPAA?

Yes. Knowingly obtaining or disclosing health information in violation of HIPAA can bring up to 1 year in prison, up to 5 years under false pretenses, and up to 10 years with intent to sell, transfer or use the information for commercial advantage, personal gain or malicious harm (42 U.S.C. 1320d-6).

Who can access my medical records without my permission?

Your providers and health plan, for treatment, payment and health care operations (HHS), business associates under contract (HHS), and others in situations 45 CFR 164.512 lists, such as uses required by law (eCFR). See HIPAA TPO.

Talk to Curve Compliance

Book a call. See what your site sends to ad platforms today and how Curve Compliance removes PHI before anything is sent to an ad platform, under the BAA it signs on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.