A HIPAA violation is any action, by a covered entity or one of its business associates, that fails to protect a patient’s protected health information the way the Privacy, Security, or Breach Notification Rule requires. Common real-world examples include a staff member looking up a patient’s chart out of curiosity, sending PHI to a personal email account, leaving a laptop unlocked with patient data visible, or disposing of records without shredding them first. For a behavioral health or addiction treatment program, the stakes run higher than they do for most other providers, since 42 CFR Part 2 adds a stricter, separate layer of protection on top of standard HIPAA rules for anything tied to substance use disorder treatment.
What Actually Counts as a HIPAA Violation?
A HIPAA violation happens when protected health information, anything from a diagnosis to a billing record to a photo showing an identifiable patient, gets accessed, shared, or handled in a way that breaks the Privacy Rule, the Security Rule, or the Breach Notification Rule, regardless of whether the person doing it meant any harm.
The intent behind the action matters for how OCR eventually penalizes it, but it doesn’t change whether the violation happened in the first place, which is a distinction worth sitting with, since a lot of staff assume an honest mistake with no bad intent behind it somehow doesn’t count. A nurse who looks up a coworker’s chart out of pure curiosity has committed a violation just as surely as someone who sells patient data for profit, even though OCR treats those two situations very differently once an investigation starts. Protected health information itself covers more than most people expect: names, dates of birth, diagnoses, treatment notes, billing and insurance details, device identifiers, biometric data, photos, and even IP addresses tied to a patient portal login all count. Patients can authorize a specific disclosure through written consent, and they can revoke that authorization later, which means a disclosure that was compliant last month can become a violation today if the underlying consent changed and nobody updated the record.
What Are Real Examples of HIPAA Violations?
Real HIPAA violations tend to fall into a handful of recurring patterns: unauthorized access to a record without a business reason, sending PHI through an unsecured channel, failing to encrypt data on a portable device, denying a patient timely access to their own record, delaying required breach notification, and disposing of PHI improperly.
Unauthorized access shows up most often as a staff member opening a patient’s chart without a treatment, payment, or operations reason, sometimes out of curiosity about a public figure or someone they know personally. Insecure sharing covers a wide range of everyday habits: forwarding PHI to a personal Gmail account to finish work at home, texting a patient’s information to a colleague over an unencrypted messaging app, or discussing a case loudly enough in a public hallway that a passerby overhears identifying details. A laptop or phone left unlocked with patient data visible while a staff member steps away counts too, even if nobody actually looked at it, since the exposure itself is the violation. Improper disposal, throwing printed records in a regular trash bin instead of a shredding bin, or handing off an old device without wiping it first, remains one of the most common findings in OCR’s enforcement history, precisely because it’s so easy to overlook in the rush of a normal day.
Two more patterns show up often enough to name specifically. Delayed breach notification happens when a program discovers that PHI was exposed, an email sent to the wrong recipient, a stolen laptop, a hacked patient portal, but takes longer than the required 60 days to notify affected individuals, either from uncertainty about whether the exposure counts as reportable or simple organizational slowness in routing the decision to the right person. Denying a patient timely access to their own record is the other recurring pattern, and it catches programs off guard because it feels less like a security failure and more like an administrative delay, but HIPAA’s Privacy Rule gives patients a right to their own record within 30 days of a request, and missing that window is a violation regardless of the reason behind the delay.
What Happens After a Violation Gets Reported?
After a violation gets reported, HHS’s Office for Civil Rights opens an investigation, typically taking around 180 days, and if it substantiates the complaint, it assigns a penalty from one of four tiers based on whether the covered entity knew about the risk and how quickly it corrected the problem.
Patients or staff have 180 days from discovering a violation to file a complaint with OCR, and the complaint needs to identify the covered entity and describe the act or omission they believe violated the rules. Once OCR assigns the four tiers, penalties adjust each year for inflation, and the amounts that took effect on January 28, 2026 are meaningfully higher than the figures still floating around on older compliance pages. Tier 1, where the entity didn’t know and couldn’t reasonably have known about the violation, now runs $145 to $73,011 per violation. Tier 2, reasonable cause without willful neglect, runs $1,461 to $73,011. Tier 3, willful neglect that got corrected within 30 days, runs $14,602 to $73,011. Tier 4, willful neglect left uncorrected, runs $73,011 up to $2,190,294 per violation, with an annual cap of $2,190,294 across all tiers. A lot of pages still quote the older $100 to $50,000 range, which hasn’t been accurate since HHS’s inflation adjustments started compounding those figures upward each year. Worth noting: OCR still applies a 2019 enforcement discretion policy that lowers the practical annual caps for Tiers 1 through 3 below the statutory maximum shown above, so the numbers that actually get assessed in most cases land lower than the ceiling figures suggest, though Tier 4 cases involving willful, uncorrected neglect don’t get that same discretion.
How Is 42 CFR Part 2 Different From a Standard HIPAA Violation?
42 CFR Part 2 is different from a standard HIPAA violation because it protects substance use disorder treatment records specifically, requires a separate written consent naming the exact recipient and purpose for any disclosure, and now carries its own active civil enforcement program through OCR as of February 16, 2026.
Before the 2024 final rule aligned Part 2 more closely with HIPAA, the two frameworks operated on almost entirely separate tracks, with Part 2 enforcement historically much rarer and handled differently than a standard HIPAA complaint. That separation has closed considerably over the past two years. HHS’s Secretary delegated Part 2 enforcement authority to OCR in August 2025, and starting February 16, 2026, OCR has accepted complaints alleging Part 2 violations using the same civil monetary penalty structure that standard HIPAA violations already carry, including corrective action plans and resolution agreements. The practical difference that still matters for an addiction treatment program: a Part 2 disclosure requires a written consent naming the specific recipient and purpose, plus a redisclosure notice telling that recipient they can’t pass the information along again without separate permission. A general medical practice sharing a lab result under standard HIPAA doesn’t need to track that level of specificity. A program handling SUD treatment records does, every time, which means the software holding those records needs consent tracking built in as a core feature rather than a form filed away after intake. Our addiction treatment EHR page covers what a system needs to handle this correctly.
How Do Violations Show Up During a CARF or Joint Commission Survey?
Violations show up during a CARF or Joint Commission survey when an auditor spot-checks a chart, a workstation, or a disposal bin and finds evidence that PHI wasn’t handled the way your program’s own policy says it should be, which makes accreditation review one of the most common places a violation gets caught before it ever reaches a formal complaint.
A surveyor walking a unit might find a workstation left logged in and unattended, a printed schedule with client names left visible at a nurses’ station, or a shredding bin that hasn’t been emptied on schedule, any of which reads as a real compliance gap even if no formal complaint was ever filed. CARF and Joint Commission both expect documented evidence that staff are trained on PHI handling and that your program can show, on demand, who accessed a given record and when. A finding like this rarely triggers a HIPAA complaint on its own, but it tells the surveyor something about the program’s day-to-day habits, and habits are exactly what determine whether a real breach happens down the line. Programs that treat a survey finding as a warning sign and correct the underlying habit, not just the specific instance the surveyor happened to catch, tend to be the ones that never generate an actual OCR complaint in the first place. That expectation lines up closely with what OCR looks for during an actual investigation, which means a program that keeps its accreditation documentation current is usually much better positioned if a HIPAA or Part 2 complaint ever does get filed. Our behavioral health EHR page covers how audit trails and access logs support both accreditation review and HIPAA compliance from the same underlying record, and our psychotherapy notes and HIPAA piece goes deeper into the extra protection that category of record carries beyond standard PHI. See how BestNotes helps if closing that gap between accreditation readiness and HIPAA compliance is the specific problem your program is trying to solve.
Frequently Asked Questions
What is the most common HIPAA violation in behavioral health settings? Unauthorized access, a staff member opening a chart without a treatment, payment, or operations reason, remains one of the most frequently cited violations, often because curiosity about a client outweighs a moment’s thought about the access log it leaves behind.
How long does a HIPAA complaint investigation take? Around 180 days on average, though the exact timeline depends on how complex the alleged violation is and how quickly the covered entity responds to OCR’s requests for information.
Are HIPAA penalties different for a first-time violation? Not automatically. The tier assigned depends on what the entity knew and how quickly it corrected the problem, not simply on whether it’s a first offense, so a serious first violation with no correction can still land in a higher tier than a repeated but promptly fixed one.
Does 42 CFR Part 2 replace HIPAA for addiction treatment records? No. Part 2 works alongside HIPAA and adds stricter consent requirements specifically for substance use disorder treatment information, so a program has to satisfy both frameworks rather than choosing one over the other.
Can a HIPAA violation get caught during a CARF or Joint Commission survey before a formal complaint is ever filed? Yes, and it happens often. A surveyor checking chart access, workstation security, or disposal practices can flag a gap that would also count as a HIPAA violation, giving a program a chance to correct it before it becomes a formal complaint.
What’s the fastest way to reduce HIPAA violation risk in a behavioral health program? Consistent staff training paired with a system that enforces role-based access and logs who touched a record and when, since most real-world violations trace back to a habit, not a single dramatic security failure.
What This Means for Your Program
The penalty tiers get the headlines, but the pattern behind most real HIPAA violations is mundane: a chart left open, a file shared the easy way instead of the secure way, a disposal step skipped because nobody was watching. For a behavioral health or addiction treatment program, that same mundane risk carries an added layer through 42 CFR Part 2, and the programs that handle it best treat consent and access tracking as part of the clinical record itself, not a separate compliance exercise bolted on afterward. Check whether your current system actually supports that, or whether it’s asking your staff to remember rules a database should be enforcing for them.
About the Author
Nicole Hovey is a marketing and communications leader at BestNotes, where she helps behavioral health and addiction treatment organizations find tools that streamline workflows, strengthen outcomes, and support clinical excellence. With a background in behavioral health program operations, digital strategy, and customer engagement, Nicole brings a unique blend of industry insight and practical experience to her writing.
At BestNotes, Nicole develops educational content, webinar programs, and product-focused resources that empower providers to stay ahead of regulatory changes, leverage emerging technologies, and deliver more efficient, data-driven care. She is especially passionate about helping organizations understand how EHRs, AI, and outcomes tracking work together to improve client experiences and reduce clinician burnout.
