HIPAA Compliance: What It Is, Who Must Comply, and Penalties for Non-Compliance

April 25, 2023

HIPAA (Health Insurance Portability and Accountability Act) is a set of regulatory standards introduced in 1996 to protect sensitive patient health information from being disclosed without consent. HIPAA compliance is following these standards to ensure that a patient’s personal health information (PHI) is protected and kept confidential.

HIPAA regulations apply to various healthcare organizations, including doctors, hospitals, clinics, health insurers, and other covered entities. HIPAA compliance is not optional – it is a legal requirement for these entities to safeguard patients’ PHI, and failure to comply can result in severe penalties and fines.

HIPAA regulations provide specific guidelines for handling patients’ PHI, including how it can be stored, transmitted, and accessed. Some of the critical requirements for HIPAA compliance include the following:

  1. Privacy Rule: The HIPAA Privacy Rule outlines how covered entities should handle and protect PHI. This rule requires covered entities to obtain written consent from patients before using or disclosing their PHI and to ensure that only authorized individuals can access the information.
  2. Security Rule: The HIPAA Security Rule outlines the technical and physical safeguards covered entities must put in place to protect electronic PHI (ePHI) from unauthorized access, use, or disclosure. This rule requires covered entities to conduct regular risk assessments to identify and address potential vulnerabilities in their systems and to implement a range of security measures to protect ePHI.
  3. Breach Notification Rule: The HIPAA Rule requires covered entities to notify patients and the Department of Health and Human Services (HHS) in case of a breach of unsecured PHI. This includes any unauthorized access, use, or disclosure of PHI that compromises its confidentiality or privacy.
  4. Omnibus Rule: The HIPAA Omnibus Rule was introduced in 2013 to strengthen and clarify existing HIPAA regulations. This rule expanded the definition of PHI to include more types of information, required covered entities to enter into business associate agreements with third-party vendors that handle PHI, and increased penalties for non-compliance.

Ensuring HIPAA compliance is essential for healthcare organizations to protect their patient’s PHI and avoid costly fines and legal repercussions. Covered entities must implement HIPAA-compliant policies and procedures, conduct regular risk assessments, and train employees on HIPAA regulations to ensure that PHI is always protected.

Here are some common questions about HIPAA compliance:

• Who must comply with HIPAA regulations?

HIPAA regulations apply to covered entities, which include healthcare providers, health plans, and healthcare clearinghouses. Therefore, business associates with PHI access must also comply with HIPAA regulations on behalf of covered entities.

• What is PHI?

PHI stands for Personal Health Information and includes any information that can be used to identify an individual and relates to their health status or healthcare services. This includes medical records, billing information, and other identifying information.

• What are the penalties for non-compliance with HIPAA regulations?

The penalties for non-compliance with HIPAA regulations can be severe, ranging from fines of up to $50,000 per violation to criminal charges and imprisonment in extreme cases. Additionally, non-compliance can damage a healthcare organization’s reputation and erode patient trust.

• What steps can healthcare organizations take to ensure HIPAA compliance?

To ensure HIPAA compliance, healthcare organizations can take several steps, including conducting regular risk assessments, implementing security measures to protect ePHI, training employees on HIPAA regulations, and maintaining documentation of compliance efforts.

• What is the process for reporting a HIPAA violation?

If a healthcare organization discovers a potential HIPAA violation, it must investigate the incident and report it to the Department of Health and Human Services (HHS)

Here are the common HIPAA violation-related trends:

Please visit the OCR Website for more information here.

There is a Solution

Not to be our biggest fans, but Abyde for HIPAA and OSHA Compliance is so revolutionary that we can’t help it.

There’s no software like it, and we feel our obligation as the industry leader is to keep setting the trend. That’s why we’re constantly implementing new features that make our software uniquely better.

https://www.youtube.com/embed/qCeXt6gw7lI?feature=oembedAbyde Compliance Software

  • FROM SOFTWARE TO POLICIES, TRAINING MADE EASY – Our employee training is fun and engaging because nothing is exciting about staring at a computer and learning about policies and laws for hours. If you haven’t noticed yet, easy is a pattern with us; our training is no exception. The training portal is self-guided, so your staff can complete it when and where you prefer. And don’t worry about keeping track of who has completed their assigned training or when the next one is due – our automated notifications will take care of that for you.
  • CUSTOM DYNAMIC GENERATION – There are a lot of details to navigate policies, but we’ve got you covered. Not sure if state law applies to you? We’ve incorporated state specifics into each approach. Couple that with your company profile and SRA, and you get the perfect storm of dynamically generated policies.
  • BUSINESS ASSOCIATE PORTAL – No longer will you need to download, print, sign, scan, and email agreements to your Business Associates (phew – that’s a lot of steps!). With our Business Associate Portal, you can manage the contracts without leaving your Abyde account. We will even throw in some reminders for when your agreements are about to expire – talk about a cherry on top!


In Summary

HIPAA (Health Insurance Portability and Accountability Act) is a critical regulatory body that oversees healthcare practices in the United States. Compliance with HIPAA regulations is essential for healthcare practices, as violations can result in hefty fines and legal liabilities. Therefore, it is more beneficial for healthcare practices to use HIPAA compliance software to ensure they follow these regulations correctly.

A HIPAA compliance software like Abyde can help healthcare practices easily manage and track compliance requirements, streamline processes, and reduce the risk of errors and omissions that can lead to non-compliance. By automating risk assessments, employee training, and documentation tasks, healthcare practices can ensure they fully comply with HIPAA regulations and avoid potential fines and violations.

Moreover, HIPAA compliance software can also provide healthcare practices with tools to protect patient’s health information, such as secure messaging, access control, and encryption. These features can help to safeguard sensitive patient data and prevent breaches that can lead to HIPAA violations.

Overall, HIPAA compliance software can provide healthcare practices with peace of mind, knowing they are doing everything possible to protect themselves and their patients from regulatory violations and the associated consequences.

To book a demo with one of our Abyde specialists, click here or call us at (800) 594-0883

RECENT POSTS

Related posts

Ambry Phishing Settlement
Abyde News, Fines, HIPAA

$700K HIPAA Settlement: What the Ambry Genetics Phishing Breach Teaches Every Practice

September 21, 2026 No comments yet

September 21, 2026   The HHS Office for Civil Rights (OCR) has announced its biggest HIPAA settlement of the year, reaching nearly a million dollars.  Ambry, a genetic testing and clinical genomics provider based in Aliso Viejo, California is at the center of this enforcement. A settlement was reached over a 2020 phishing attack that exposed the Protected Health Information (PHI) of more than 225,000 individuals. This settlement is a clear reminder that even large organizations trip up on HIPAA requirements.    What happened In January 2020, an employee email account at Ambry was compromised through a phishing attack.  The breach potentially exposed a wide range of PHI, including names, addresses, dates of birth, Social Security Numbers, financial details, and more. Ambry reported the breach to OCR in March 2020, which kicked off the investigation.    Where OCR found gaps OCR’s investigation identified several HIPAA Security Rule gaps, including: No accurate, thorough risk analysis of risks and vulnerabilities to ePHI No process for cutting off access to ePHI when an employee left or no longer needed access No unique user IDs for tracking who was accessing ePHI systems These are baseline HIPAA requirements that every Covered Entity and Business Associate is expected to have in place.   The settlement terms Ambry paid $700,000 and agreed to a two-year corrective action plan, under which it must: Complete a thorough risk analysis of ePHI confidentiality, integrity, and availability Build and execute a risk management plan addressing what that analysis turns up Review and update Security Rule policies and procedures as needed Implement unique user identification across all ePHI systems Train the whole workforce on those updated policies The takeaway for practices When 90% of healthcare hacks start with a successful phishing attempt, it’s key your team is aware of the role they play to keep data safe. Every practice should ask; Do we know exactly where our ePHI lives and how it moves through our systems? Do we have a current, documented risk analysis? Would we catch it fast if a former employee’s access wasn’t revoked? Looking for the first step of addressing these gaps? Meet with one of our compliance experts to see where you currently stand. 

Azul Vision Right of Access
Abyde News, Fines, HIPAA

Right of Access Enforcement Hits Eye Care: Inside the Azul Vision Settlement

September 1, 2026 No comments yet

September 1, 2026   The Office for Civil Rights (OCR) announced its 55th settlement under the HIPAA Right of Access Initiative, and this one is a good reminder that “we’ll get to it” is an easy shortcut to a massive financial penalty.   What happened Azul Vision, Inc., a California optometry enterprise healthcare provider, took nearly two years to provide a patient her healthcare records failed to give a patient timely access to her health records. She requested her records in January 2023. She didn’t actually receive them until January 2025, or two years later, and only after OCR opened an investigation following her complaint in April 2023.   The importance of Right of Access The HIPAA Privacy Rule’s Right of Access is straightforward: patients are entitled to their healthcare records within 30 days of a request, with one possible 30-day extension if needed.    The cost Azul Vision agreed to a two-year, OCR-monitored corrective action plan and paid $50,000. The corrective action plan requires the practice to: Review and revise its written policies and procedures for Privacy Rule compliance.  Regularly report to HHS a log of every PHI access request it receives, including when it came in and when it was resolved, Train all workforce members on right of access requirements and the practice’s own procedures.   Practical takeaways Have a documented, assigned process for access requests: not an informal “someone will handle it” arrangement. Track every request against the 30-day (or extended 60-day) clock: If nothing is timestamping requests, nothing is catching the ones that slip. Train staff specifically on right of access: this is a distinct Privacy Rule obligation from general HIPAA awareness, and it’s clearly one OCR is actively enforcing.   The bottom line A single records request that went unanswered turned into a $50,000 penalty, two years of federal monitoring, and a detrimental hit to the organization’s reputation. That’s a steep price for what really comes down to a missing process. If your team can’t answer “what happens the moment a patient asks for their records?” right now, that’s the gap to close before your practice ends up as OCR’s next enforcement case. Want a streamlined way to close your compliance gaps? Meet with an Abyde expert today!

OSF Healthcare HIPAA Settlement
Abyde News, Fines, HIPAA

What OSF Healthcare’s Ransomware Fine Teaches Every Practice About SRAs

August 5, 2026 No comments yet

August 5, 2026 The latest HIPAA fine is another clear reminder that ransomware attacks are, unfortunately, here to stay in the healthcare industry. A settlement involving the OSF Healthcare System was recently announced by the Office for Civil Rights (OCR). As an enterprise healthcare provider in the midwest, the organization serves 174 locations, including 16 hospitals – a prime target for a ransomware attack.    So, what happened?  In April 2021, OSF discovered that they joined the unlucky club of ransomware victims when a malicious actor deployed Nephilim, a ransomware strain made to target larger organizations. Once the ransomware infected OSF systems, the hacker demanded payment or patient Protected Health Information (PHI) would be leaked online. In this attack, sensitive information like financial account information, driver’s license numbers, medical record numbers, and more, were all exposed. Over 53,000 patient records were exposed in this attack.  When ransomware attacks in healthcare have soared 278% in recent years, it’s more of a when then an if your organization doesn’t have the right safeguards in place.  While the breach was discovered in April, OSF healthcare reported the breach to the OCR in October. The OCR took it from there, digging into what precautions (or lack thereof) let this happen.  What did the OCR discover? If you’ve read any of our other fine breakdowns, you already know where this is going: another missing Security Risk Analysis (SRA).  The SRA is a required document every HIPAA-regulated entity (ie: every practice and their Business Associates that handle patient information) needs to complete. The SRA is a thorough review of the physical, technical, and administrative safeguards in place to prevent PHI ending up in the wrong hands. While the OCR didn’t specify exactly how the ransomware got into OSF’s system, a technical safeguard vulnerability was very likely the entry point. A proactive SRA could have flagged that gap before it turned into a major breach. In addition to missing this required documentation, OSF also took too long to report the breach to the OCR and notify affected patients. This is a direct violation of the Breach Notification Rule, which requires organizations to notify patients within 60 days of a discovered breach. Moreover, since the breach impacted more than 500 patients, OSF was also required to report this breach to the OCR within 2 months as well. Time is of the essence in every component of a breach, from securing systems to ensuring affected parties are aware to protect themselves and an over five month delay was unacceptable in the eyes of the OCR.    What was the result?  OSF’s settlement tops the list as the largest fine of the year, coming in at $552,250, plus government monitoring for the next two years.  It’s very important to note that this breach occurred in 2021, meaning that over five years were spent from the initial breach, to investigations, to the public press releases. Also, the average cost of a healthcare breach is over 7 million dollars –  from implementing secure systems, notifying patients, legal fees, and more. The Takeaway While the settlement payment and Corrective Action Plan (CAP) are just the cherries on top, this experience was a tremendous cost of time, money, and resources, highlighting the importance of making sure everything is secure before a situation occurs.  So, when was the last time you looked at your SRA? It’s time to seriously analyze your current compliance posture. Ransomware groups don’t check whether you’re a small dental office or a 16-hospital health system before they attack, they check whether the door was left open. Time and again, OCR’s findings come back to the same root cause: organizations can’t secure what they haven’t even identified as a problem. Looking to review your current compliance standings? Meet with our team of experts for a complimentary educational consultation.