Unintentional HIPAA Violations: 8 Real-World Examples and How to Prevent Them

Unintentional HIPAA violations are accidental uses or disclosures of protected health information (PHI). Common examples are a misdirected email, a lost unencrypted laptop, or a cloud storage bucket left open to the public. They count as violations even though no one intended harm. Under 45 CFR § 164.402, an impermissible use or disclosure of unsecured PHI is presumed to be a reportable breach. A documented four-factor risk assessment can rebut that presumption by showing a low probability that the data was compromised. Intent affects the penalty tier. It does not decide whether a violation occurred.

TL;DR: Quick answer

• An accidental disclosure of unsecured PHI is presumed a breach under 45 CFR § 164.402. A documented four-factor risk assessment can rebut that by showing a low probability of compromise.
• Civil penalties effective January 28, 2026 range from $145 per violation in Tier 1 to $2,190,294 in Tier 4 (45 CFR § 102.3). The annual cap is $2,190,294 per violated provision.
• Breach notification under 45 CFR §§ 164.400-414 requires notifying affected individuals without unreasonable delay and no later than 60 days after discovery.
• Common accidental patterns include misdirected messages, lost unencrypted devices, misconfigured cloud storage, and vendors handling PHI without a Business Associate Agreement (BAA).
• Each scenario below maps to a specific safeguard in 45 CFR §§ 164.308, 164.310, or 164.312 that would have prevented it.

Why does an accident still count as a HIPAA violation?

The HIPAA Privacy and Security Rules regulate outcomes, not motives. When unsecured PHI is used or disclosed in a way the Privacy Rule does not permit, 45 CFR § 164.402 presumes a breach. A covered entity or business associate can rebut that presumption only with a documented risk assessment of at least four factors. The first two are the nature and extent of the PHI involved, and the unauthorized person who received or used it. The other two are whether the PHI was actually acquired or viewed, and how far the risk has been mitigated.

The breach definition also excludes three narrow cases. The closest to this topic is a workforce member's unintentional, good-faith access or use of PHI within the scope of their authority. That kind of slip is not a breach if it leads to no further impermissible use or disclosure.

For unintentional HIPAA violations, intent matters at the penalty stage. Under the tiers adjusted effective January 28, 2026, an unknowing violation (Tier 1) starts at $145 per violation. Willful neglect left uncorrected (Tier 4) starts at $73,011 and can reach $2,190,294. HHS Office for Civil Rights (OCR) applies a 2019 Notice of Enforcement Discretion that keeps annual maximums for Tiers 1 through 3 below the statutory cap. The full tier structure is covered in our guide to HIPAA violation fines and penalties.

Eight common unintentional HIPAA violation scenarios

Each of the eight unintentional HIPAA violations below is paired with the safeguard that helps prevent it.

1. Email or fax sent to the wrong recipient

A front-desk employee autocompletes the wrong address and a referral summary lands in a stranger's inbox. This is an impermissible disclosure the moment it leaves the building. Whether it is reportable turns on the four-factor assessment; an unencrypted message to an unknown third party rarely qualifies for the low-probability exception.

Prevention: Encrypt messages containing ePHI in transit, an addressable specification under 45 CFR § 164.312(e). Disable autocomplete for external domains, use verified recipient lists, and route patient communication through a portal rather than raw email. Our comparison of HIPAA-compliant email encryption services covers the practical options.

2. Lost or stolen unencrypted laptop, phone, or USB drive

Lost and stolen devices make up a small share of large breach reports in 2026. OCR's breach portal lists 592 breaches of 500 or more records reported from January through September 2026 (our count of the portal on October 20, 2026). Only one was listed as a loss and one as a theft. Hacking and IT incidents caused 85% of those reports. The portal shows only breaches of 500 or more people, so smaller breaches do not appear there.

The compliance difference is encryption. PHI encrypted to the standards in HHS guidance is not "unsecured PHI" under § 164.402. Losing a properly encrypted, locked device generally does not trigger notification. Losing an unencrypted one almost always does.

Prevention: Use full-disk encryption on every device that can touch ePHI, per the addressable encryption specification at 45 CFR § 164.312(a)(2)(iv). Keep a device inventory under the device and media controls at § 164.310(d), and have remote wipe ready for lost phones and laptops.

3. A cloud storage bucket left open to the public

A developer opens an Amazon S3 bucket to the public to move intake-form exports during a migration, then forgets to lock it again. Security researchers and automated scanners look for open buckets, so even a few days of exposure can mean real access by unknown parties. That weighs heavily against a low-probability finding in the four-factor test.

Prevention: New S3 buckets do not allow public access by default, but a policy change can open them. Turn on S3 Block Public Access at the account level, which overrides bucket policies, then encrypt objects at rest and alert on policy changes. Amazon S3 is a HIPAA eligible service, but eligible does not mean compliant. AWS says customers must still configure each service to meet HIPAA. Our breakdown of whether AWS is HIPAA compliant explains what the AWS BAA does and does not cover.

4. Hosting PHI with a provider that never signed a BAA

A clinic launches a website with appointment forms on a generic shared host. No PHI leak has happened, but the arrangement itself violates 45 CFR § 164.308(b) and § 164.504(e). Those rules require a Business Associate Agreement before a vendor creates, receives, maintains, or transmits ePHI on a covered entity's behalf. OCR has settled cases over a missing BAA. In 2017, the Center for Children's Digestive Health paid HHS $31,000 to settle potential Privacy Rule violations. The practice had disclosed PHI to its records storage vendor since 2003, but neither party could produce a signed BAA from before October 12, 2015.

Prevention: Inventory every vendor in the data path (host, form processor, email relay, backup service) and confirm a signed BAA for each. Our HIPAA-compliant hosting guide explains what a hosting BAA should include.

5. PHI in server logs, error reports, and backups

Form submissions logged in plaintext, stack traces that capture request bodies, and debug emails to developers all create unmanaged copies of ePHI. These copies often sit on systems with no access controls, no encryption, and no retention policy, and they are easy to forget during a risk analysis.

Prevention: Scrub request bodies from application logs, mask form fields in error tracking, and encrypt backups. Audit controls under 45 CFR § 164.312(b) require recording activity on systems containing ePHI, which is only possible if you know where those copies live. Our guide to HIPAA audit logs covers what to record and how long to keep it. The controls are detailed in our overview of HIPAA hosting security measures.

6. Tracking pixels and analytics scripts on patient pages

Advertising and analytics pixels on appointment booking or patient portal pages can send identifiers plus health context to third parties such as ad platforms. That context can include the page URL, a condition searched, or an appointment type. OCR addressed this in its online tracking technologies guidance, and multiple health systems have reported breaches and faced class actions over pixel disclosures.

In AHA v. Becerra (N.D. Tex., June 20, 2024), a federal court vacated one part of OCR's tracking guidance. The vacated part treated an IP address plus a visit to a public health information page as PHI by itself. The rest of the guidance still applies. Trackers on patient portals, login pages, booking flows and apps can still expose PHI. No BAA, no permissible disclosure.

Prevention: Remove third-party trackers from any page where users enter or view health information, or replace them with server-side, BAA-covered analytics. Treat tag managers as a change-controlled system, not a marketing free-for-all. The full rules are in our guide to HIPAA tracking technologies.

7. Improper disposal of paper records or storage media

Charts in an unlocked dumpster or a decommissioned server resold with its drives intact are classic accidental disclosures. The device and media controls at 45 CFR § 164.310(d)(2)(i) require policies for the final disposition of ePHI and the hardware it lives on.

Prevention: Use cross-cut shredding for paper, and cryptographic erasure or physical destruction for drives. Get a certificate of destruction from any disposal vendor, who also needs a BAA if they handle PHI.

8. Employee snooping and excess access rights

A staff member looks up a neighbor's record out of curiosity, or an employee keeps full EHR access years after changing roles. Both violate the minimum necessary standard at 45 CFR § 164.502(b) and the access management requirements at § 164.308(a)(4), even when nothing is shared externally. We cover real cases of the consequences for employees who snoop in a separate guide.

Prevention: Use role-based access, quarterly access reviews, and immediate deprovisioning on role change. Add audit log monitoring under § 164.312(b), so snooping is detected, not discovered by accident years later.

What should you do after an accidental disclosure?

• Contain and document. Stop the exposure, preserve evidence, and record the timeline. Documentation must be retained for six years under 45 CFR §§ 164.316(b)(2)(i) and 164.530(j)(2).
• Run the four-factor assessment. Apply § 164.402 to determine whether the presumption of breach is rebutted, and write the analysis down.
• Notify on time if required. Affected individuals must be notified without unreasonable delay and within 60 days of discovery (§ 164.404). Breaches affecting 500 or more people require notice to HHS at the same time as the individual notices (§ 164.408). If more than 500 residents of a state or jurisdiction are affected, also notify prominent media outlets there within 60 days of discovery (§ 164.406). Smaller breaches are logged and reported to HHS within 60 days after the calendar year ends.
• Fix the root cause. Update the risk analysis required by § 164.308(a)(1)(ii)(A) and the corresponding safeguard, then retrain the people involved.

If one of these unintentional HIPAA violations just happened to you, the first-24-hours decision path is in our guide to an accidental HIPAA violation.

Frequently asked questions

Is an accidental HIPAA violation still a violation?

Yes. HIPAA liability does not depend on intent, so unintentional HIPAA violations still count. An unknowing violation falls in Tier 1 ($145 to $73,011 per violation as of January 28, 2026), while willful neglect falls in Tiers 3 and 4.

Is every accidental disclosure a reportable breach?

No. Under 45 CFR § 164.402, a disclosure of unsecured PHI is presumed a breach. A documented four-factor risk assessment can show a low probability of compromise. The rule also excludes three narrow cases, such as a workforce member's good-faith, unintentional access within their authority. Disclosures of properly encrypted PHI are not "unsecured" and generally are not reportable.

How long do you have to report a HIPAA breach?

Affected individuals must be notified without unreasonable delay and within 60 days of discovery. Breaches affecting 500 or more individuals also require notice to HHS at the same time. If more than 500 residents of a state or jurisdiction are affected, prominent media outlets there must be notified too. Smaller breaches are reported to HHS annually (45 CFR §§ 164.404-408).

Can a small accidental breach still draw an OCR penalty?

Yes, particularly when it reveals a missing safeguard such as no risk analysis or no BAA. Prompt correction within 30 days is a defense for violations not involving willful neglect. Missing risk analyses remain an OCR focus: its 14th Risk Analysis Initiative action came in June 2026.

Where to go from here

Five of the eight unintentional HIPAA violations above involve the web and hosting layer: open buckets, missing BAAs, leaky logs, tracking pixels, unencrypted transit. Most of these gaps surface in a basic HIPAA website audit. Hosting built for ePHI covers part of that surface: the hosting BAA and encryption in transit and at rest. What your site writes to logs, and any pixels or plugins you add, stay your responsibility.

We offer managed HIPAA-compliant WordPress hosting from $229 a month on single-tenant AWS. The BAA is signed within 24 hours of signup, before patient data moves, and covers the servers and services we run. Every plan includes encryption at rest and in transit, six-year audit logging, and tested encrypted backups. That is our service, so weigh the recommendation accordingly. For the underlying requirements, start with our guide to HIPAA's administrative, physical, and technical safeguards.

This article is general information, not legal advice. Consult qualified counsel and base your safeguards on a documented risk analysis specific to your organization. Reviewed October 2026.

Sources

• 45 CFR § 164.402, breach definition and four-factor assessment (eCFR)
• 45 CFR § 164.312, technical safeguards (eCFR)
• 45 CFR § 164.308, administrative safeguards (eCFR)
• 45 CFR § 102.3, adjusted civil money penalty amounts (eCFR)
• HHS, Breach Notification Rule
• HHS OCR, Use of Online Tracking Technologies guidance
• 45 CFR § 164.406, notification to the media (Cornell LII)
• HHS OCR breach portal (counted October 20, 2026)
• HHS OCR, Center for Children's Digestive Health settlement (April 20, 2017)
• HHS OCR, Spencer Gifts health plan settlement, 14th Risk Analysis Initiative action (June 18, 2026)
• AHA v. Becerra, No. 4:23-cv-01110 (N.D. Tex.), docket
• AWS, HIPAA Eligible Services Reference
• AWS, Blocking public access to your Amazon S3 storage