A practical guide for healthcare employers and their business associates: what counts as a HIPAA violation, common examples involving staff, how penalties are structured, what to do after a breach and how to prevent violations with training and simple controls.
HIPAA applies to covered entities, meaning most healthcare providers that bill electronically, health plans and healthcare clearinghouses, and to their business associates, meaning vendors and contractors that create, receive, maintain or transmit protected health information (PHI) on their behalf. Employees of these organizations must follow their employer’s HIPAA policies. HIPAA generally does not apply to employers simply because they hold employee health information in their role as an employer, such as a doctor’s note in a personnel file, although other laws may protect that information. See what is HIPAA compliance for the basics.
To record clock-ins, breaks and overtime automatically, see EZTime time and attendance software.
PHI is individually identifiable health information held or transmitted by a covered entity or business associate. It includes names, addresses, dates related to a person, phone numbers, email addresses, medical record numbers, photos and other identifiers when linked to health conditions, care or payment. A patient’s name on a schedule at a clinic, an appointment reminder or a billing record can all be PHI. Electronic PHI (ePHI) is subject to the additional safeguards of the Security Rule.
Not every mistake is treated the same way. HIPAA’s civil penalty structure considers the level of culpability, ranging from situations where the organization did not know and could not reasonably have known of the violation, through reasonable cause, to willful neglect that was corrected and willful neglect that was not corrected. Penalties increase with culpability, and amounts are adjusted for inflation each year. Many complaints are resolved through technical assistance or corrective action rather than fines, but serious or repeated failures can lead to significant settlements. Knowingly obtaining or disclosing PHI in violation of HIPAA can also be a federal crime prosecuted by the Department of Justice.
The Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services enforces the Privacy, Security and Breach Notification Rules. OCR investigates complaints from patients and employees, reviews breach reports and conducts compliance reviews. State attorneys general can also bring civil actions for HIPAA violations affecting residents of their state. Individuals cannot sue directly under HIPAA, but state privacy laws may give them other options. Employers should also note that a workforce member can face discipline, including termination, under the organization’s sanctions policy.
Penalty headlines can make HIPAA enforcement sound sudden. HHS describes a more gradual process:
The sanctions requirement is the part most small practices overlook. Write down what happens when an employee snoops or shares information, from retraining to termination, and apply it consistently.
Prevention checklist complete.
Our small business cybersecurity checklist covers many basic technical safeguards.
Tools used to schedule staff, track time or send team messages are usually meant for workforce data, not patient data. Set a clear policy that patient names, conditions and other PHI should not be entered in scheduling notes, timesheets, team chats or general messaging tools unless your compliance team has approved the tool for PHI and a BAA is in place. Use neutral references, such as a room or visit number, where your policy allows.
EZTime is a workforce management tool for scheduling, time tracking and team communication, and is not designed to store patient health information. Healthcare employers use it to manage staff, for example to collect signed policy acknowledgments, including HIPAA training sign-offs, with digital HR forms and e-signatures, track expiry dates on staff documents in the digital employee file and send policy reminders through announcements. See EZTime for healthcare.
Common problems include unauthorized access or disclosure by staff, lost or stolen unencrypted devices, failure to give patients timely access to their records and lack of a proper risk analysis.
Policies vary. Many organizations prohibit employees from using work access to view their own records and require them to use the patient portal or standard request process instead. Follow your employer’s policy.
Yes. Covered entities must have and apply sanctions for workforce members who violate privacy policies, which can include termination depending on severity.
Generally not when you hold it as an employer, for example sick notes in personnel files. Other laws, such as the ADA and state laws, may still require confidentiality.
Affected individuals must be notified without unreasonable delay and no later than 60 days after discovery. Breaches affecting 500 or more people must also be reported to HHS within 60 days; smaller breaches are reported to HHS annually.
A violation is any failure to follow HIPAA’s rules, such as missing training or a policy gap, even if no information was exposed. A breach is an impermissible use or disclosure of unsecured protected health information that compromises it. Every breach involves a violation, but many violations never become breaches.
Inside an organization, report it to the privacy or security officer right away. Patients and others can file a complaint with the HHS Office for Civil Rights. Covered entities must follow the breach notification rules if the incident is a breach.
EZTime handles scheduling, time tracking and staff communication. Keep patient information in your clinical systems, not in staff chat.