HIPAA Violation Consequences for Employees: Real Jail Cases

Last updated: October 15, 2026

Yes, a healthcare worker can go to prison for knowingly misusing patient information. Job discipline, license action and civil lawsuits can also follow. This guide lays out HIPAA violation consequences for employees through real, dated cases, so you can see what happens if a healthcare worker violates HIPAA. It is news because a federal appeals court ruled on April 14, 2026, in the case over Justice Ruth Bader Ginsburg's hospital records. The scope is deliberate, careless or curious misuse, such as snooping, selling, posting or lying to get records. If your mistake was honest, like a fax to the wrong number, start with our guide to an accidental HIPAA violation instead. We are a hosting company, not a law firm, and this is not legal advice. Every case below is listed in Sources with its court or agency record.

TL;DR: Quick answer

• The HHS Office for Civil Rights (OCR) imposes its money penalties on the employer, not the employee (45 CFR 160.402). HIPAA violation consequences for employees mostly come from employers, licensing boards, civil courts and federal prosecutors.

• HIPAA requires "appropriate" documented sanctions for staff who break privacy rules. It does not require firing (45 CFR 164.530(e)).

• Prison requires knowing misuse. The statute allows up to 1, 5 or 10 years by tier. Sentences we found from 2023 to 2025 ran from probation to 5 years, and the longest included fraud or identity theft counts.

• On April 14, 2026, a federal appeals court affirmed the convictions behind a 24-month sentence for obtaining health information and destroying evidence. It ruled that a search screen showing a patient's name, visit dates and services could support the conviction.

• Patients cannot sue under HIPAA itself, but they may be able to sue under state law. An Indiana jury found $1.8 million in damages in a suit against a pharmacy chain and its pharmacist (2013 verdict, affirmed 2014).

• If you see a coworker snooping, you can tell your privacy officer. HIPAA bars retaliation for filing a complaint with HHS or opposing unlawful practices in good faith (45 CFR 160.316).

What happened in the Ruth Bader Ginsburg records case?

A federal appeals court affirmed the convictions on April 14, 2026, in the case over Justice Ginsburg's hospital records. The trial court had imposed 24 months in prison. The Fourth Circuit ruled in a published opinion (United States v. Russell, No. 24-4620).

The defendant did not work for the hospital. He worked for an organ donation nonprofit with access to George Washington University Hospital records. A screenshot of the hospital's patient search screen appeared on 4chan, then Twitter. It showed the Justice's name, "the dates of ten visits" and services including "radiology, oncology, and surgery". The hospital's chief information officer then checked the logs for anyone who had searched last names starting with "Gin". A device the hospital had not issued had searched for the Justice under his username.

On July 31, 2024, a jury convicted him of obtaining individually identifiable health information and of destroying records. It acquitted him of disclosing the information. After he learned his access was disabled on February 10, 2019, he formatted his hard drive two days later. For anyone with chart access, the case is a 2026 lesson in HIPAA violation consequences for employees and outside workers alike.

Four lessons for anyone with chart access

1. A search screen counts. The defense argued that "no actual medical records were accessed". The court said the information "falls well within the heartland of the conduct the statute is aimed at". Dates tied to a patient are among the 18 HIPAA identifiers.

2. You do not need to work for the hospital. A 2009 HITECH Act change covers "a person (including an employee or other individual)" who knowingly obtains a covered entity's health information without authorization.

3. Looking without a legitimate reason cost someone else a job. Federal agents concluded that a hospital employee who searched for the Justice was not the leaker. Still, "the hospital fired" that employee "for inappropriately viewing" the Justice's information.

4. The cover-up added a felony count. The conviction for destroying records (18 U.S.C. 1519) sat next to the obtaining count.

HIPAA violation consequences for employees, at a glance

This table sums up HIPAA violation consequences for employees, with the rule behind each one and a dated example. The Office for Civil Rights (OCR) enforces HIPAA's Privacy, Security and Breach Notification Rules. Its penalties and settlements fall on covered entities and business associates, such as your employer.

The civil tiers your employer faces are in our guide to HIPAA violation fines and penalties. The OCR settlements we reviewed do not shield anyone from prosecution. The Yakima Valley and Montefiore agreements say the HHS release "does not extend to" actions under 42 U.S.C. 1320d-6. HHS says OCR works with the Department of Justice "to refer possible criminal violations of HIPAA".

How snooping gets caught

Snooping can leave a trail. The Security Rule requires HIPAA-covered employers to regularly review activity records, "such as audit logs, access reports, and security incident tracking reports" (45 CFR 164.308(a)(1)(ii)(D)). It also requires audit logging controls that "record and examine activity" (164.312(b)).

In two cases we found, HIPAA violation consequences for employees followed a check of the hospital's own access records. In the Ginsburg case, the hospital's chief information officer reviewed patient search logs. DOJ says a Bronx hospital business clerk was terminated in 2020 after an internal systems audit found improper access. He pleaded guilty on Aug 6, 2025, to fraud conspiracy and wrongful disclosure of health information.

Groups get caught too. At Yakima Valley Memorial Hospital, 23 security guards accessed 419 patients' records without a job-related purpose, according to HHS. The hospital agreed to pay OCR $240,000 (Jun 15, 2023).

Curiosity is not an accident. In HHS's 2009 example, a receptionist who looks through files "to learn of a friend's treatment" falls outside the good-faith exception. Our list of unintentional HIPAA violations shows the safeguards that limit excess access.

Will you lose your job? Sanctions are required, firing is not

You might, but HIPAA leaves the choice of sanction to your employer. Of the HIPAA violation consequences for employees covered here, only workplace sanctions are required by the Privacy and Security Rules.

Section 164.530(e)(1) says a covered entity "must have and apply appropriate sanctions" against workforce members who break its privacy policies. It "must document the sanctions that are applied, if any", and keep that record six years. The Security Rule adds a matching sanction policy, one of the required administrative, physical and technical safeguards. "Workforce" includes volunteers and trainees, "whether or not they are paid" (45 CFR 160.103).

HIPAA violation penalties for employees start inside the workplace, and real outcomes vary.

• Firing. The hospital in the Ginsburg case fired an employee who inappropriately viewed the Justice's information. The Bronx hospital fired its clerk in 2020.

• A warning and retraining. A pharmacist in a 2014 Indiana case received "a written warning" and had to retake HIPAA training.

• A suit against the employer for not acting. Massachusetts's attorney general alleged UMass Memorial entities failed to discipline two employees in a timely manner. The entities agreed to pay $230,000 under a consent judgment (announced Sep 20, 2018).

If yours was an honest mistake, our accidental HIPAA violation guide covers what happens next.

Can you lose your license over a HIPAA violation?

Yes. For licensed staff, HIPAA violation consequences for employees can reach the license itself. On January 15, 2025, the Oregon State Board of Nursing reprimanded an RN's license, with conditions. The order says she opened 14 patients' records "without a business reason to do so". She also had to complete HIPAA and confidentiality education within 30 days.

The National Council of State Boards of Nursing (NCSBN) says a nursing board may investigate improper disclosures on social media, depending on state law. Its 2024 guide says proven violations may bring a reprimand or sanction, a fine, or temporary or permanent loss of licensure.

Physicians face boards too. The ER resident in the Iowa case below wrote to the Iowa Board of Medicine in June 2023. In his plea, he admitted that a statement in that letter was false.

Can a patient sue you personally for a HIPAA violation?

Not under HIPAA, but state law claims may be available. A Kentucky appeals court wrote in 2025 that "there is no private cause of action under HIPAA, either express or implied". State courts still hear privacy claims, so a civil suit can be among the HIPAA violation consequences for employees.

• Walgreen Co. v. Hinchy (Ind. Ct. App. 2014). An on-shift pharmacist looked up the prescriptions of her boyfriend's ex-partner. A 2013 jury found $1.8 million in damages, with 80% assessed jointly against Walgreen and the pharmacist.

• Acosta v. Byrum (N.C. Ct. App. 2006). A patient alleged that an office manager used the practice owner's access code to pull her psychiatric records and share details with others. The court reversed the dismissal of her claim against the owner, a doctor. She could use HIPAA and hospital rules "to establish the standard of care".

• Ledford v. UofL Health-Louisville, Inc. (Ky. Ct. App. Jan 31, 2025). A worker admitted for psychiatric care at the hospital where he worked alleged that co-workers, including his supervisor, accessed and printed his records. The court reversed a dismissal. These are allegations only.

• Byrne v. Avery Center (Conn. 2014). Connecticut's Supreme Court found HIPAA and its rules were not "intended to preempt tort actions under state law" over unauthorized release of medical records.

The 2006 and 2014 rulings are established law, not news. State attorneys general can also sue "any person" who violates HIPAA's rules (42 U.S.C. 1320d-5(d)). Damages run up to $100 per violation and $25,000 a year per identical requirement. We found no 2024 to 2026 state attorney general HIPAA suit against an individual worker. Patient suits against hospitals go beyond HIPAA violation consequences for employees and are a topic for a future article.

Can you go to jail for a HIPAA violation?

Yes, but only for knowing misuse. Among HIPAA violation consequences for employees, prison can only come from a criminal case. Under 42 U.S.C. 1320d-6, it is a crime to knowingly obtain or disclose individually identifiable health information in violation of HIPAA's rules. The statute sets three tiers.

• Base tier: up to $50,000, up to 1 year in prison, or both.

• False pretenses: up to $100,000, up to 5 years, or both.

• Top tier: up to $250,000, up to 10 years, or both. This tier covers intent to sell, transfer or use the data for "commercial advantage, personal gain, or malicious harm".

General federal sentencing law can allow higher fines (18 U.S.C. 3571). The 1-year tier is a Class A misdemeanor, while the 5-year and 10-year tiers are felonies (18 U.S.C. 3559). DOJ's Office of Legal Counsel said in 2005 that "knowingly" means knowing the facts, not knowing the conduct broke HIPAA. None of the criminal cases we found involved an honest mistake.

In three money cases in the table, prosecutors also charged wire fraud conspiracy or aggravated identity theft. Aggravated identity theft adds a mandatory two-year prison term (18 U.S.C. 1028A). The table shows how HIPAA violation consequences for employees and others with access played out in federal court.

DOJ's press release archive shows no release with "HIPAA" in its title dated after March 20, 2025 (checked October 15, 2026). Title searches can miss HIPAA cases, such as the 2025 travel nurse case.

Substance use disorder records covered by 42 CFR Part 2 now carry HIPAA's civil and criminal penalties (42 U.S.C. 290dd-2(f)).

Callers who lie to get patient data

In a July 13, 2026 release, DOJ said two people were convicted at trial of wire fraud and aggravated identity theft. One posed as VA staff by phone to get ICU patients' names and emergency contacts from hospitals. It was not a HIPAA case. Still, HIPAA requires a covered entity to verify an unknown requester's identity and authority before most disclosures (45 CFR 164.514(h)(1)).

What your employer pays in 2026

HIPAA violation consequences for employees can become the employer's bill too. From January 1 to October 15, 2026, OCR announced 11 HIPAA settlements totaling $3,170,250. Nine cited a risk analysis failure, the subject of our HIPAA risk analysis guide. For the wider picture, see our healthcare data breach statistics.

• Ambry Genetics, Sep 17, 2026: $700,000. One employee's email account was phished. OCR cited potential failures to set access-termination procedures and to assign unique user IDs.

• Shen Smiles, Oct 8, 2026: $140,000. The dental practice said a workforce member stole the records. OCR found no right-of-access policies, and the agreement notes no formal Privacy Rule training.

• Montefiore, Feb 6, 2024: $4,750,000. An employee accessed 12,517 patients' information and sold some to an identity theft ring.

• BayCare, May 28, 2025: $800,000. A patient complained that an unknown person contacted her with photos of her printed records. OCR cited potential failures in access authorization and in reviewing system activity records.

• Cadia, Sep 30, 2025: $182,000. Its "success story" program posted 150 patients' information online without valid, written HIPAA authorization. Marketers should read HIPAA compliance for marketing agencies.

Settlements such as Ambry's and Yakima Valley's also add a two-year corrective action plan (CAP). The Montefiore agreement says it is not an admission of liability.

Two class settlements over website tracking won final approval in 2026, and each topped OCR's year-to-date total. Kaiser's $47.5 million settlement won final approval on July 14, 2026. Allina's $12.5 million settlement followed on September 24, 2026. Orders in both cases say the settlement is not an admission of wrongdoing. OCR has announced no tracking-technology penalty. See HIPAA tracking technologies for what is allowed.

What to do if you see a coworker snooping

Report it to your privacy or security officer under your facility's policy. Opening the record yourself to "check" can itself be unauthorized access. A breach counts as discovered once any workforce member other than the person committing it knows, or should reasonably know (45 CFR 164.404(a)(2)). Any required patient notice is due without unreasonable delay and no later than 60 calendar days after discovery.

HIPAA violation consequences for employees fall on the person who snooped, and the rules give some protection to people who report. Section 160.316 bars retaliation for filing a HIPAA complaint with HHS or for opposing an unlawful practice in good faith. Section 164.502(j)(1) lets staff who believe in good faith that their employer acted unlawfully share patient information with a health oversight agency or their attorney.

How practices keep this from happening

Practices can reduce the misuse that leads to HIPAA violation consequences for employees with controls the rules already require.

• Training for every workforce member (164.530(b)(1)). See workforce security training.

• Unique user IDs (164.312(a)(2)(i), Required), so the system can identify and track each user.

• Access cut off at departure (164.308(a)(3)(ii)(C), Addressable).

• Regular audit-log review (164.308(a)(1)(ii)(D), Required).

• Automatic logoff (164.312(a)(2)(iii), Addressable). See HIPAA automatic logoff.

• No shared logins. In the 2006 North Carolina case, a patient sued the doctor she accused of letting his office manager use his access code. Our guide to HIPAA MFA requirements covers personal sign-ins.

Some of these controls live on servers. If your patient portal, intake forms or a self-hosted EHR run on servers you manage, those servers need logs someone can review. Our managed healthcare hosting includes six-year audit logging and encryption at rest and in transit on single-tenant AWS, from $229 a month. Our business associate agreement covers the servers and services we run, so a cloud EHR's chart-access logs still come from that EHR vendor. We sell this hosting, so weigh our view with that in mind.

Frequently asked questions

Can you go to jail for looking at a patient's chart out of curiosity?

It is legally possible: the base tier covers knowingly obtaining health information without authorization and allows up to 1 year. In the cases we found, every prison term also involved false pretenses, selling data, fraud or a cover-up. Two medical assistants who obtained a patient's information each got 2 years' probation in 2025. Firing and a nursing board reprimand are other HIPAA violation consequences for employees in the cases we found.

How long can you go to jail for a HIPAA violation?

The statute allows up to 1 year, or up to 5 years for false pretenses. Intent to sell, transfer or use the data for commercial advantage, personal gain or malicious harm allows up to 10 years. The longest recent sentence we found was 5 years, in 2025. A travel nurse got 3 years on a HIPAA count, plus 2 for drug fraud. In 2023, a medical facility employee got 54 months, including an identity theft count.

Is a HIPAA violation a felony?

Only knowing misuse is a HIPAA crime, and its grade depends on the tier. The 1-year base tier is a Class A misdemeanor. The false-pretenses tier (5 years) is a Class D felony. The 10-year tier for selling, personal gain or malicious harm is a Class C felony.

Can a nurse lose her license for a HIPAA violation?

Yes. In January 2025, the Oregon State Board of Nursing reprimanded an RN who opened 14 patients' records without a business reason. NCSBN's social media guide lists a reprimand, a fine, or temporary or permanent loss of licensure as possible outcomes.

Can you be sued personally for snooping in patient records?

Not under HIPAA, which has no private right of action. State law claims may be available. In an Indiana case affirmed in 2014, a jury assessed 80% of $1.8 million in damages jointly against Walgreen and its pharmacist.

Who pays the fine when an employee violates HIPAA?

The employer. Under 45 CFR 160.402, OCR imposes civil money penalties on covered entities and business associates, not on their staff. HIPAA violation consequences for employees can include sanctions, possible license action, lawsuits and, for knowing misuse, prosecution.

Do HIPAA violation consequences for employees include personal fines?

They can, but not from OCR. The HIPAA statute sets criminal fines of up to $50,000, $100,000 or $250,000 by tier, and sentencing law can allow more. In the Tennessee hospital case, three former employees were fined $1,000 to $3,000.

If a coworker uses your open login to look up a patient, are you both responsible?

The coworker who looked accessed the record knowingly. Leaving a session open can break workstation and logoff policies, so both of you can face sanctions. Only knowing misuse, such as knowingly obtaining or disclosing records, fits the federal crime.

Do substance use disorder records carry the same penalties?

Yes, for Part 2 records. 42 U.S.C. 290dd-2(f) applies HIPAA's civil and criminal penalties to Part 2 violations. OCR has accepted Part 2 complaints and breach reports since February 16, 2026.

Do HIPAA violation consequences for employees apply to volunteers and students?

Yes. HIPAA's "workforce" includes volunteers and trainees, "whether or not they are paid", so sanction policies cover them. The criminal statute reaches "a person (including an employee or other individual)".

Recap: HIPAA violation consequences for employees

In short, HIPAA violation consequences for employees depend on what the person did and knew. OCR's penalties fall on the employer, employers apply sanctions, and licensing boards can discipline licensed staff. Patients may be able to sue under state law, and knowing misuse can bring prison. If your practice website, portal or self-hosted EHR needs servers with six-year audit logging, request a quote for your practice.

This article is general information about HIPAA violation consequences for employees, not legal advice. It describes court records, agency actions and regulations we checked through October 15, 2026. Outcomes depend on facts and state law. Ask your privacy officer or a qualified attorney about your situation. We sell HIPAA compliant hosting. Reviewed October 2026.

Sources

• U.S. Code: 42 U.S.C. 1320d-6, 1320d-5 and 290dd-2.

• U.S. Code: 18 U.S.C. 1028A, 3559 and 3571.

• 45 CFR 160.103, 160.316 and 160.402.

• 45 CFR 164.308, 164.312 and 164.404.

• 45 CFR 164.502, 164.514 and 164.530.

• DOJ: OLC opinion (2005) and title search for HIPAA.

• HHS: 74 FR 42740 (2009), enforcement process and Part 2 enforcement.

• Ginsburg case: 4th Cir. opinion, conviction release and sentencing release.

• DOJ: S.D. Cal., W.D. Tenn. pleas and W.D. Tenn. sentences.

• DOJ: N.D. Iowa plea, N.D. Iowa sentence and D. Neb.

• DOJ: W.D.N.Y., S.D.N.Y. and S.D. Fla.

• DOJ: W.D. Wash., N.D. Ind. and S.D. W.Va.

• Court dockets: S.D. Fla. No. 1:26-cr-20198 and S.D.N.Y. No. 1:25-cr-136.

• Court opinions: Hinchy, Acosta and Ledford (citing Faber v. Ciox Health and quoting Byrne).

• Connecticut Supreme Court: Byrne v. Avery Center (2014).

• Licensing: Oregon nursing board orders and NCSBN guide.

• Massachusetts AG: UMass Memorial.

• HHS: Yakima Valley, Montefiore and BayCare.

• HHS: Cadia, Ambry and Shen Smiles.

• HHS: Shen Smiles agreement and resolution agreements list and Yakima Valley press release (archived).

• Kaiser settlement: approval order and judgment.

• Allina settlement: approval order and motion with terms.