Common HIPAA Privacy Violations by Healthcare Staff and How to Prevent Them

Table of Contents

• Why Privacy Violations Start with Everyday Staff Habits
• What a Privacy Violation Can Cost
• Violation 1: Unauthorized Access and Credential Sharing
• Violation 2: Casual Conversation and Oversharing
• Violation 3: Unsecured Messaging and Texting
• Violation 4: Misdirected Email and Faxes
• Violation 5: Improper Handling of Physical Records
• Violation 6: Telehealth Privacy Lapses
• Turning Prevention into Everyday Practice
• HIPAA Training Resources

Why Privacy Violations Start with Everyday Staff Habits

Most HIPAA privacy violations don't involve hackers. They happen when well-meaning staff take shortcuts: sharing a login to save time, discussing a patient in the hallway, texting a lab result from a personal phone, or leaving a chart on a counter. Front desk staff, billing teams, clinicians, and administrative personnel all handle protected health information (PHI) every day, across more channels than ever, including email, messaging apps, personal devices, telehealth platforms, and cloud systems.

This guide walks through six of the most common privacy violations by healthcare staff and the practical steps that prevent each one. Use it to shape your training scenarios and your policies.

For the training requirements themselves, see our quick guide to HIPAA compliance training requirements for employers. For building a staff training program, see our guide to HIPAA privacy training for healthcare staff.

Action for you now: List which staff roles have direct access to PHI in your facility and which of the six scenarios below each role is most likely to encounter.

What a Privacy Violation Can Cost

The HHS Office for Civil Rights (OCR) enforces HIPAA through complaint investigations, compliance reviews, resolution agreements, and civil money penalties. Penalties are assessed per violation in four tiers based on culpability. For penalties assessed in 2026, amounts range from $145 to $73,011 per violation, with a calendar-year cap of $2,190,294 for identical violations in the most serious tier.

Penalties are only part of the cost. Breaches can trigger notification to affected individuals, legal review, forensic investigation, and remediation, along with lost patient trust and negative press. OCR resolutions often include multi-year corrective action plans that require policy changes, training, and monitoring.

Staff training is one of the most cost-effective ways to reduce that risk, because so many violations come down to individual behavior.

Violation 1: Unauthorized Access and Credential Sharing

Staff sometimes share login credentials to speed up workflow or help a colleague, or look up a record they have no work reason to see, such as a coworker's, neighbor's, or celebrity patient's chart. Shared credentials make it impossible to tie access to an individual and undermine the Security Rule's requirement for unique user identification.

Prevention:

• Require unique credentials for every user, and prohibit sharing them.
• Set role-based access so staff see only the PHI they need (the minimum necessary standard).
• Review audit logs for access outside a user's department, patients, or normal hours.
• Train staff that "just looking" at a record without a work reason is a violation.

Violation 2: Casual Conversation and Oversharing

Patient information leaks through hallway conversations, elevator chatter, break rooms, and parking lots. Staff may not realize that discussing a patient's diagnosis or treatment, even with good intentions, can be an impermissible disclosure. Open floor plans and shared waiting areas make this especially common.

Prevention:

• Discuss patients only with those who need to know, in private areas, and at a lowered voice where privacy is limited.
• Avoid using patient names in public spaces when possible.
• Remind staff that privacy rules apply everywhere, including outside work and on social media.

Violation 3: Unsecured Messaging and Texting

Sending clinical information through personal text messages, unapproved apps, or group chats exposes PHI to interception and loss, especially when devices are shared, lost, or stolen.

Prevention:

• Adopt an approved secure messaging platform and a clear policy on what can be sent and how.
• Prohibit PHI on personal devices unless the device is enrolled in your organization's security controls.
• Train staff on what to do if a device containing PHI is lost or stolen.

Violation 4: Misdirected Email and Faxes

Sending patient information to the wrong email address or fax number remains one of the most common preventable incidents. It often happens during busy periods, through email auto-complete, or with outdated contact lists.

Prevention:

• Require a double-check of the recipient before sending PHI.
• Turn off or limit auto-complete for external addresses, and use encryption for email containing PHI.
• Keep fax numbers current and use cover sheets with a confidentiality notice.
• Train staff to report a misdirected message immediately so it can be assessed under the Breach Notification Rule.

Violation 5: Improper Handling of Physical Records

Unlocked file cabinets, charts left at nurses' stations, printouts on unattended printers, and records tossed in regular trash all create exposure. Staff often focus on electronic security and overlook paper.

Prevention:

• Secure paper records when not in use and clear workspaces at the end of each shift.
• Retrieve printouts promptly and position screens and documents away from public view.
• Dispose of PHI through shredding or a secure disposal service, never regular trash.

Violation 6: Telehealth Privacy Lapses

Remote visits expand where PHI travels. Staff may use unapproved video platforms, hold sessions where others can overhear, or skip verifying patient identity before discussing sensitive information.

Prevention:

• Use only the telehealth platforms your organization has approved, with a business associate agreement in place where required.
• Conduct sessions from private locations, using headphones where others are nearby.
• Verify patient identity at the start of each visit and follow your policy on recording.

Action for you now: Ask staff confidentially which of these scenarios they run into most often and which rules confuse them, and use their answers to choose training scenarios.

Turning Prevention into Everyday Practice

Training alone doesn't change behavior. Privacy habits stick when leadership models them, systems make the right choice easy, and accountability is consistent.

Lead visibly. When leaders complete HIPAA training and follow privacy practices themselves, staff understand that privacy matters.

Train before access. New staff should complete HIPAA training before they access PHI, as part of onboarding rather than a paperwork formality. A short quiz and signed acknowledgment reinforce the expectation.

Make reporting easy. Staff must know exactly how to report a privacy concern to the privacy official without fear of retaliation, and reports should be handled promptly.

Recognize good catches. Highlight staff who prevented a potential breach. Make privacy vigilance a valued competency.

Apply sanctions consistently. HIPAA requires covered entities to have and apply sanctions for workforce members who violate privacy policies. Consistent, proportionate responses show that the rules are real.

Reinforce regularly. Monthly privacy tips, periodic security reminders, and scenario reviews keep privacy top of mind between formal training sessions.

HIPAA Training Resources

National Safety Compliance offers the HIPAA Privacy & Security Rules Training program in English and Spanish, available as streaming (30 days or 1 year), DVD, USB, or an MP4 license. The training program kit includes streaming access plus a PowerPoint presentation, a quiz, and an attendance log. The employer adds its own policies and the violation scenarios most relevant to its staff.

Reinforce training with HIPAA Privacy & Security Awareness Training Booklets and the HIPAA Notice of Privacy Act and HIPAA Prevention is the Only Cure posters.

The All Access Pass is a one-year subscription to 50+ safety training courses in English and Spanish, including HIPAA, licensed to one trainer or supervisor who can use it to train your entire organization. It includes all updates and new releases during the subscription period.