HIPAA Violation Examples: Real Cases for Therapy Practices

Most lists of HIPAA violation examples are written for hospitals, and many never name a real case. This guide is for therapists in private practice and small group practices. It starts with real enforcement: 18 cases from the HHS Office for Civil Rights (OCR), checked on HHS's own pages, including a psychiatric practice that replied to Google reviews, a solo counselor who didn't hand over records, a mental health center that took 216 days to answer a records request, and two behavioral health providers that hadn't done an accurate risk analysis. Then come everyday examples from a therapy practice, sorted by type, each with a way to prevent it.

After the examples you'll find the difference between a violation, a security incident and a breach; the Breach Notification Rule's deadlines; the penalty tiers with the amounts in force today; and a self-audit checklist you can copy into your compliance file.

What counts as a HIPAA violation?

A HIPAA violation is a failure by a covered entity or business associate to meet a requirement of the HIPAA Privacy, Security or Breach Notification Rules. In a therapy practice, nearly every violation falls into one of four groups:

A violation doesn't need a breach. The mental health center below paid $100,000 without leaking anything; it was simply late with one client's records. And the reverse is true too: a careful practice can still have a breach, which then has to be handled under the Breach Notification Rule.

HHS lists the issues most often alleged in complaints since 2003, in order: impermissible uses and disclosures, lack of safeguards, lack of patient access, lack of administrative safeguards for electronic records, and using or disclosing more than the minimum necessary (HHS, Enforcement Highlights). The cases below follow the same pattern.

Real HIPAA violation examples from HHS enforcement

Each case below comes from an HHS resolution agreement, a civil money penalty notice or an HHS announcement. A resolution agreement is a settlement in which the practice pays an amount and agrees to a corrective action plan that HHS monitors, usually for two or three years. The agreements state that they are not an admission of liability. The details are as HHS describes them.

Replying to online reviews

Manasa Health Center, a New Jersey psychiatric practice (2023, $30,000). The practice, which provides adult and child psychiatric services, "impermissibly disclosed the PHI of four (4) patients in response to their negative reviews posted on Google Reviews." It also had no policies for these situations. It paid $30,000 and accepted a two-year corrective action plan (HHS resolution agreement).

New Vision Dental, California (2022, $23,000). The owner answered Yelp reviews, sometimes giving a patient's full name where the patient had posted under a nickname, and adding details about visits and insurance. Besides paying $23,000, the practice had to remove every post containing patient information, send breach notices to each person involved, and post a substitute breach notice on its own Yelp page (HHS resolution agreement).

Elite Dental Associates, Dallas (2019, $10,000). A reply to a Yelp review disclosed the patient's last name, details of her treatment plan, and insurance and cost information. OCR then found replies to other patients' reviews that did the same (HHS).

What it means for you: a client's review is their disclosure, not your permission. Any reply that confirms the person was your client, even "I'm sorry our sessions didn't help," discloses protected health information (PHI). Our guide to the 18 HIPAA identifiers includes a review reply you can adapt that never confirms a treatment relationship.

Talking to the media, and posting client stories

Allergy Associates of Hartford, Connecticut (2018, $125,000). A patient contacted a local TV station about a dispute with one of the practice's doctors. When the reporter called the doctor, the doctor disclosed the patient's information, after the practice's privacy officer had told him not to respond or to say "no comment." The practice also took no disciplinary action afterward. It paid $125,000 and accepted two years of monitoring (HHS; HHS announcement).

Cadia Healthcare Facilities, Delaware (2025, $182,000). Five rehabilitation and long-term care providers posted "success stories" on their websites for 150 patients without written HIPAA authorizations. The one that prompted the complaint showed a patient's name, photograph and details of their conditions, treatment and recovery (HHS press release).

What it means for you: "no comment" is the whole answer to a reporter, a landlord, an employer or anyone else who calls about a client. A testimonial or client story needs a valid written authorization first, and the APA, ACA and NASW codes bar soliciting testimonials from current clients in the first place. See our marketing guide for ways to market a practice without client stories.

Not giving clients their records on time

Lack of access to records is the third most common issue alleged in HIPAA complaints, and it's one a client notices the day the deadline passes. HHS runs a Right of Access Initiative; the 2026 cases below were its 55th and 56th enforcement actions.

David Mente, MA, LPC, Pittsburgh (2023, $15,000). A parent complained that the counselor refused to give them their minor children's records. OCR gave the counselor technical assistance and closed the first complaint in January 2018. A second complaint arrived in May 2018, and OCR found the counselor had "failed to provide timely access" since April 6, 2018. He paid $15,000 and accepted a two-year corrective action plan (HHS resolution agreement).

Rio Hondo Community Mental Health Center, Los Angeles County (2024, $100,000 penalty). A client filled in the clinic's records request form in person on March 18, 2020, the day before California's stay-at-home order. When she came to collect the records in May, she left after waiting 20 minutes, and her follow-up calls in July and August didn't get them to her. She complained to OCR in August, and the clinic mailed the records on October 20, 2020, 216 days after the request. OCR didn't accept the pandemic as a defense. It counted each day from day 60 (the 30 days plus one extension) until the records went out as a violation: 156 days at $1,379 a day, which came to $215,124 and was capped at $100,000 (HHS Notice of Proposed Determination; Notice of Final Determination).

Shen Smiles, Pennsylvania (2026, $140,000). A dental practice didn't give a patient her records despite several requests, and told OCR it couldn't because a workforce member had stolen them. OCR found the practice had no right of access policies and hadn't reasonably safeguarded the records. After OCR proposed a civil money penalty, the practice settled in August 2026 for $140,000 (HHS press release, October 8, 2026).

Azul Vision, California (2026, $50,000). A patient asked for her records in January 2023 and received them in January 2025, after OCR opened an investigation (HHS press release, August 27, 2026).

What it means for you: you must act on a request for access within 30 days, with one 30-day extension if you tell the client in writing, within the first 30 days, why and by when (45 CFR 164.524). You can charge only a reasonable, cost-based fee. Psychotherapy notes, kept separately from the record, are not part of the right of access. Requests from parents for a minor's records depend on state law and on who consented to the treatment, so that is a question for a lawyer before you refuse.

Lost or stolen devices without encryption

Lifespan, Rhode Island (2020, $1,040,000). An employee's laptop was stolen with patients' names, medical record numbers, demographic information and medication information for 20,431 people. OCR found that the health system hadn't encrypted laptops even after deciding encryption was reasonable and appropriate, and lacked device and media controls (HHS; HHS announcement).

What it means for you: encryption is the difference between a stolen laptop and a reportable breach. HHS's guidance says electronic PHI encrypted to its standard, with the key not compromised, is not "unsecured," so losing it doesn't trigger breach notification (HHS encryption guidance). Turn on full-disk encryption and a passcode on every laptop, tablet and phone that holds client information.

Email, phishing and online tools without a BAA

Lafourche Medical Group, Louisiana (2023, $480,000). A phishing email gave an attacker access to an owner's email account, which held patient information. The practice couldn't tell which patients were affected, so it notified all of them, about 34,862 people. OCR found it had never done a Security Rule risk analysis before the attack (HHS resolution agreement).

Top of the World Ranch Treatment Center, Illinois (announced 2026, $103,000). A phishing attack on a workforce member's email account at this substance use disorder treatment provider exposed information for 1,980 patients. OCR found no accurate and thorough risk analysis (HHS press release, February 19, 2026).

Pagosa Springs Medical Center, Colorado (2018, $111,400). The hospital didn't deactivate a former employee's username and password, and that person accessed information for at least 557 people after leaving. It had also disclosed the same patients' information to Google, which HHS treated as its business associate, without a written BAA (HHS).

What it means for you: an inbox full of client emails is a target, so turn on two-step sign-in and train yourself and staff to spot phishing. Any online service that stores client information for you, including email, calendars, cloud storage and forms, needs a BAA. Our guides cover Gmail and Google Meet, and the day someone leaves, remove their access everywhere.

Snooping in records

Yakima Valley Memorial Hospital, Washington (2023, $240,000). Twenty-three security guards in the emergency department used their own logins to look at the records of 419 people without a job-related reason, including names, dates of birth, addresses, certain treatment notes and insurance information (HHS resolution agreement; HHS announcement).

What it means for you: in a group practice, give each person only the access their job needs (a biller doesn't need session notes), use individual logins, and check who opened what. The Shen Smiles case above points to the other insider risk: the practice told OCR that a workforce member had stolen the records.

Throwing records away

New England Dermatology (2022, $300,640). For ten years the practice put empty specimen containers, labeled with patients' names, dates of birth and dates of sample collection, into a dumpster in its parking lot. A security guard found one in the lot (HHS resolution agreement).

What it means for you: HHS says plainly that covered entities "are not permitted to simply abandon PHI or dispose of it in dumpsters" that others can reach. Paper must be shredded, burned or pulped so it can't be reconstructed, and old drives and phones must be wiped or destroyed (HHS disposal FAQ).

Websites, portals and tracking code

Deer Oaks, a behavioral health provider (2025, $225,000). Deer Oaks provides psychological and psychiatric services in long-term care and assisted living facilities. A coding error in a pilot patient portal made discharge summaries public, and search engines cached them from at least December 2021 until May 2023, with names, dates of birth and diagnoses for 35 people. A separate 2023 account compromise led to notices to 171,871 people. OCR found Deer Oaks had failed to conduct an accurate and thorough risk analysis (HHS press release, July 7, 2025).

Tracking pixels and analytics. OCR's bulletin on online tracking says tracking code on a page where people book appointments can collect PHI, such as an email address or the reason for seeking care, and that a cookie banner "do[es] not constitute a valid HIPAA authorization." The bulletin names "frequency of visits to a therapist" as the kind of sensitive information at stake. In June 2024 a federal court vacated the part saying HIPAA applies when tracking code links a visitor's IP address to a visit to a public page about a health condition or a provider, and HHS has added that ruling to the top of the page. The court didn't vacate the rest, including what the bulletin says about booking pages, logged-in portals and BAAs (HHS tracking bulletin).

What it means for you: keep advertising pixels and session-recording scripts off booking, intake and contact pages unless the vendor signs a BAA and the use is allowed. Every field a client fills in on a booking page is information a tracker could pick up. Before you add any marketing tool to your site, walk through the booking page on practice.tranqbay.health to see what a client types before a first session.

No risk analysis, then ransomware

Green Ridge Behavioral Health, Washington, D.C. area (2023, $40,000). A ransomware attack on this outpatient mental health group practice reached the information of more than 14,000 patients. HHS's investigation pointed to no accurate and thorough risk analysis, security measures that didn't reduce risks enough, and no regular review of system activity. The corrective action plan runs three years (HHS resolution agreement).

Comprehensive Neurology, New York (2025, $25,000). HHS describes it as "a small New York neurology practice." After a ransomware attack, it settled over the risk analysis requirement (HHS press release).

What it means for you: the risk analysis is required and has to be written down, and OCR says the organizations it investigates often have deficient risk analysis practices or none at all. A solo practice's risk analysis can be short. HHS and ONC's Security Risk Assessment Tool is built for small and medium providers.

What these cases have in common

Everyday HIPAA violation examples in a therapy practice

Every example in this section is invented, and any resemblance to a real person or practice is a coincidence. They are sorted by type, each with a way to prevent it.

Disclosures

Security

Client rights and paperwork

Disposal

Violation, security incident or breach?

The three words get used as if they meant the same thing. They don't, and the difference decides what you have to do.

Three situations are not breaches: an unintentional, good-faith access by a workforce member within their authority that goes no further; an inadvertent disclosure between two people authorized at the same practice; and a disclosure where you believe in good faith the recipient couldn't have kept the information. And notification applies only to unsecured PHI: information encrypted or destroyed to HHS's standard isn't covered (HHS, Breach Notification Rule).

Five invented situations, sorted:

HHS puts the burden of proof on you: keep the risk assessment or the notices you sent (HHS, Breach Notification Rule). HIPAA documentation is kept for six years (45 CFR 164.530(j)).

The Breach Notification Rule, in brief

When a breach of unsecured PHI happens, the rule sets out who must hear about it and by when (HHS, Breach Notification Rule; 45 CFR 164.404 to 164.410):

When something goes wrong, the first hours look like this: contain it (reset passwords, recall the email, lock the account), write down what happened while you remember it, do the four-factor assessment, then notify as required. HIPAA also requires you to lessen any harmful effect you know of, as far as practicable (45 CFR 164.530(f)).

HIPAA violation penalties: the four tiers

Civil money penalties fall into four tiers based on what the practice knew and how quickly it fixed the problem (45 CFR 160.404). HHS adjusts the amounts for inflation each year. As listed in 45 CFR 102.3 on October 25, 2026 (HHS's latest adjustment, published in the Federal Register on January 28, 2026), the amounts per violation are:

The regulation's calendar-year cap for identical violations is $2,190,294 in every tier. In practice, OCR has applied lower yearly caps for identical violations under a 2019 notice of enforcement discretion: $25,000, $100,000 and $250,000 for the first three tiers and $1.5 million for the fourth. The Rio Hondo notice cited that policy and capped a reasonable-cause penalty at $100,000 (HHS). An enforcement discretion notice is a policy, not a regulation, and can change.

Money is rarely the only cost. Nearly every settlement above came with a corrective action plan. State attorneys general can also bring HIPAA cases. Criminal penalties apply to knowingly obtaining or disclosing health information in violation of HIPAA: up to $50,000 and one year in prison, up to $100,000 and five years under false pretenses, and up to $250,000 and ten years when done for commercial advantage, personal gain or malicious harm (42 U.S.C. 1320d-6). And a confidentiality failure can also become a licensing board matter.

A HIPAA self-audit checklist you can copy

Paste this into your compliance file and date it. A "no" on any line is your to-do list. Run it once a year and whenever you add a new tool, hire someone or move offices.

How this works in TranqBay

TranqBay is practice software for therapists in private practice. Several examples above come down to where client information lives and who has signed for it, so here is what TranqBay covers:

TranqBay's BAA covers TranqBay, not your phone, your inbox or a pixel someone adds to another site. The checklist above still applies to those.

Questions to take to a lawyer

Frequently asked questions about HIPAA violations

Before your next audit

Pick the three examples above that sound most like your practice and fix those first, then work through the checklist. Many of the real cases came down to a missing risk analysis, a public reply to a review, or a records request nobody answered.

If you'd like booking, video sessions, client forms and notes in one place under one BAA, see how TranqBay works for private practice: you can look at a practice website template and the booking page your clients would use, and see what a client is asked before a first session. If you're deciding whether to join, this page explains how joining TranqBay works, and you'll find more guides for therapists in private practice on the blog.

Sources