HIPAA Security Rule Violations: Common Causes, Penalties, and Fixes
The fastest way to end up in an OCR investigation isn't a hacker. It's a missing risk analysis, an unencrypted laptop, or a former employee whose login still works. Most HIPAA Security Rule violations trace back to a handful of predictable gaps, and regulators know exactly where to look for them.
This post breaks down what the Security Rule actually requires, the violations that get cited most often, what penalties look like in 2025, and the practical steps that keep a practice out of the enforcement column.
What the HIPAA Security Rule Requires
The Security Rule applies specifically to electronic protected health information (ePHI), the patient data your practice creates, stores, and transmits digitally. It's separate from the Privacy Rule, which governs PHI in all forms.
The HIPAA Security Rule requires covered entities and business associates to implement administrative, physical, and technical safeguards to protect ePHI. Those three categories cover different territory:
- Administrative safeguards are your policies, workforce training, and the security management process, including risk analysis.
- Physical safeguards control access to facilities, workstations, and devices.
- Technical safeguards govern how systems authenticate users, control access, and protect data in storage and transit.
One nuance trips up a lot of practices: not every specification is flatly mandatory. Addressable means that a covered entity has additional flexibility with respect to compliance. Addressable does not mean optional. It means you either implement the safeguard, or you document why an equivalent alternative is reasonable for your environment. Encryption is the classic example. Encryption is not mandatory under HIPAA Rules, but it cannot be ignored. If the decision is taken not to use encryption, an alternative, equivalent security measure must be used in its place.
The Most Common HIPAA Security Rule Violations
Enforcement patterns are remarkably consistent year to year. Most HIPAA Security Rule violations stem from predictable gaps: weak access control, missing data encryption, unmanaged vendors, and outdated risk analysis and security assessments.
Here are the ones that show up repeatedly in OCR cases:
1. No risk analysis, or a stale one. This is the big one, and it's covered in its own section below because it now drives a dedicated enforcement effort.
2. Missing or weak encryption on ePHI. Unencrypted laptops, phones, and backup drives turn an ordinary theft or loss into a reportable breach. If you skip encryption, you need a documented equivalent safeguard in its place.
3. Excessive access and workforce snooping. Staff with access to records they don't need for their jobs is a violation of the minimum-necessary principle and a frequent source of internal breaches.
4. Unmanaged access after role changes. Accounts that stay active after an employee leaves or changes roles are a well-known weak point.
5. Missing Business Associate Agreements. Every vendor that touches ePHI, from your billing service to your cloud host, needs a signed BAA. Regulators check.
6. No audit controls or activity monitoring. If you can't tell who accessed what and when, you can't detect misuse or prove compliance.
Why Risk Analysis Failures Dominate Enforcement
If you fix only one thing, fix this. Risk analysis is consistently the single most-frequently-cited deficiency in OCR investigations.
The requirement itself is specific. The Security Rule directs organizations to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the organization. A generic checklist or a vendor's boilerplate template rarely satisfies "accurate and thorough."
OCR has made this a priority in a concrete way. In late 2024 it launched a Risk Analysis Enforcement Initiative, and it has kept the pressure on since. In the fall of 2024, OCR announced the first enforcement action in its Risk Analysis Initiative. By April 2025, the initiative had already resulted in combined settlement payments of nearly $900,000 from eight different health care organizations. The pace continued through 2025, with 16 resolution agreements announced from January to August 2025 featuring failure to conduct an accurate and thorough assessment of potential risks.
The settlements aren't limited to large hospital systems. In one case, OCR reached a $250,000 settlement and a two-year corrective action plan requiring full risk analysis, policy updates, and workforce training. Small practices and business associates are squarely in scope.
What HIPAA Violations Actually Cost in 2025
Civil penalties run on a four-tier structure keyed to culpability, from an honest unknowing violation up to willful neglect that goes uncorrected. The dollar figures are indexed for inflation each year.
For 2025, per-violation floors and ceilings are: Tier 1 $145 to $73,011; Tier 2 $1,461 to $73,011; Tier 3 $14,602 to $73,011; Tier 4 $73,011 to $2,190,294, with an annual cap of $2,190,294 for an identical provision. Note that the top annual cap applies to the most serious category. HHS determined that the maximum annual penalty should only apply to the most serious Tier 4 violation category.
Two things worth keeping in perspective. Penalties scale with intent and with whether you corrected the problem, so a documented good-faith compliance program materially changes your exposure. And criminal liability exists but is rare. Jail time is a real risk for those who willfully and knowingly violate HIPAA rules, though it applies to a narrow set of egregious conduct, not ordinary compliance gaps.
The Bigger Change Coming: The 2025 Proposed Security Rule
If your compliance posture is currently "good enough," the ground is shifting. In January 2025, OCR published a Notice of Proposed Rulemaking, the first major overhaul of the Security Rule since 2013. The proposed modifications would revise existing standards to better protect the confidentiality, integrity, and availability of ePHI and increase cybersecurity for ePHI.
The most consequential shift is structural. Among other changes, it would eliminate the distinction between required and addressable implementation specifications, require comprehensive technology asset inventories and network mapping, and mandate multi-factor authentication. In other words, the "addressable" flexibility that many practices lean on today would largely disappear.
The proposal also introduces hard requirements and deadlines that look a lot more like modern cybersecurity frameworks:
- A technology asset inventory and a network map showing ePHI flows, maintained and reviewed at least annually.
- A detailed asset inventory, vulnerability scans every six months, penetration tests annually, and 72-hour disaster recovery plans.
- Mandatory encryption of ePHI in transit and at rest, plus MFA.
Timing matters for planning. This is still a proposal, not final. The January 2025 NPRM has been delayed, with the update not expected until 2027. That gives practices runway, but the direction of travel is clear: inventories, MFA, encryption, and tested recovery plans are becoming the baseline, not the aspiration.
How to Close the Gaps
A practical sequence that maps to what OCR actually looks for:
- Run a real risk analysis. Not a template. An accurate, organization-wide assessment of where ePHI lives, how it moves, and where it's exposed. Repeat it at least annually and after any major change.
- Fix the findings, and document it. A risk analysis with no remediation is arguably worse than none. OCR wants to see that you acted on what you found.
- Encrypt ePHI, or document your equivalent. Devices, backups, and transmissions.
- Tighten access. Unique logins, least-privilege access, prompt deprovisioning when someone leaves, and audit logging.
- Get your BAAs in order. Inventory every vendor that touches ePHI and confirm a signed agreement for each.
- Get ahead of the proposed rule. Start building the asset inventory and network map now, and pressure-test whether you could restore systems within 72 hours.
For most practices, the hard part isn't wanting to comply, it's not having in-house security expertise to run a credible vulnerability scan or interpret the findings. That's the specific gap PolySec is built to fill. PolySec performs in-person HIPAA security risk assessments for healthcare organizations, including on-site vulnerability and network scanning, policy and BAA review, and an audit-ready findings report with a remediation roadmap, so the assessment-to-fix work is handled by specialists while your team stays focused on patients.
Frequently Asked Questions
What's the difference between the HIPAA Privacy Rule and Security Rule? The Privacy Rule governs protected health information in all forms and sets the rules for how it can be used and disclosed. The Security Rule applies specifically to electronic PHI and requires administrative, physical, and technical safeguards to protect it.
Is encryption required under HIPAA? Technically it's "addressable," not flatly required. If you choose not to encrypt, you must implement and document an equivalent safeguard. That said, the 2025 proposed rule would make encryption mandatory, and unencrypted devices are a leading cause of reportable breaches, so treating it as required is the safer posture.
How often should we do a HIPAA risk analysis? At least annually, and again after any significant change to your systems, vendors, or operations. A one-time or outdated analysis is exactly what OCR cites most often.
Do small practices really get penalized? Yes. Recent Risk Analysis Initiative settlements include small providers and business associates, with amounts in the tens to hundreds of thousands of dollars. Practice size doesn't exempt you.
When do the new HIPAA Security Rule requirements take effect? The January 2025 proposal is not yet final, and the update isn't expected until around 2027. The requirements it describes, MFA, encryption, asset inventories, and 72-hour recovery, are worth adopting early regardless.
Stories and Helpful Content
