Most OCR investigations start with a patient complaint. OCR is the federal office that enforces HIPAA. Others start with a breach report, a tip from a current or former employee, or, rarely, a random audit. Once a case opens, a big factor is whether you can show a real effort to follow HIPAA. One example is a finished risk assessment.
How HIPAA Violations Lead to Enforcement Action
The HHS Office for Civil Rights (OCR) is the federal office that enforces HIPAA. In September 2024, OCR settled with Cascade Eye and Skin Centers for $250,000. The case followed a ransomware attack, which is malware that locks up your files. The attackers reached a server holding about 291,000 files of electronic patient health information (ePHI). OCR found the practice had not done a full, accurate risk assessment, and was not keeping enough watch on activity in its computer systems. Those gaps turned a preventable incident into a six-figure penalty.
That settlement is not unusual. When OCR opens an investigation, they already have a reason to think something went wrong. The question shifts from “did a violation happen?” to “how bad is it, and did you try to prevent it?”
What Triggers an OCR Investigation?
Most OCR investigations do not start with a government audit team showing up unannounced. OCR can conduct spot audits on their own, but they do not employ that approach as much these days. They do not actually want a “gotcha” situation.
Instead, investigations typically begin with one of four triggers:
- Patient complaints filed directly with OCR. This is the most common trigger. Any patient can file a complaint through the HHS website. You can learn more about how to respond to a HIPAA complaint if one is filed against your practice.
- Breach reports. Any breach affecting 500 or more individuals must be reported to OCR within 60 days of finding it. OCR reviews these reports, so a large breach puts you on its radar. Hundreds of large healthcare breaches are reported each year, so OCR has a steady stream of cases.
- Whistleblower complaints. Current or former employees who report violations to OCR are protected under federal law. HIPAA says a practice cannot punish anyone who files a complaint (45 CFR 160.316).
- Random audits. OCR has the authority to conduct random audits, but these are rare and account for a small fraction of enforcement actions.
If OCR does come knocking, you will usually get a letter asking for information, or a warning that tells you where you are falling short. If the problem does not get fixed, OCR can take stronger action.
The Most Common Violations in Small Practices
The violations that sink small and mid-sized practices are rarely exotic. They are the basics, like having written policies. Trouble comes when the daily rush prevents you from getting around to DOCUMENTING your well-intended procedures.
Password sharing is one of the most persistent problems. Staff share login credentials for convenience, but shared passwords destroy audit trails and make it impossible to track who accessed what record and when.
No audit logs is another common gap. Without logs showing who accessed patient records, a practice has no way to demonstrate compliance during an investigation, or detect unauthorized access before it becomes a breach.
Technical safeguards (the tech side of protecting patient data, set out in 45 CFR 164.312) are another common gap. Encryption, access controls, automatic logoff, and transmission security are areas where many practices fall short. A risk assessment guide to avoid fines can help identify these gaps before OCR does.
Warnings, Corrective Action Plans, and Fines
Not every HIPAA violation results in a fine. OCR uses a tiered enforcement model that weighs the severity of the violation against the effort a covered entity (a provider, health plan, or clearinghouse that HIPAA covers) made to comply.
The first step is often a warning or technical assistance letter. For organizations making a real, good-faith effort to follow HIPAA, this often amounts to a slap on the wrist.
If the violation is more serious, OCR may impose a corrective action plan (CAP): a set of steps you must follow on the government’s timeline, not yours. A CAP runs for a set number of years. It includes monitoring, reporting, and specific steps to fix the problems.
A fine is one step higher on the scale of severity. Penalty amounts under 45 CFR 160.404 are organized into four tiers:
| Tier | Level of fault | Per Violation | Annual Cap |
|---|---|---|---|
| 1 | Did not know | $145 to $73,011 | $2,190,294 |
| 2 | Reasonable cause | $1,461 to $73,011 | $2,190,294 |
| 3 | Willful neglect, corrected within 30 days | $14,602 to $73,011 | $2,190,294 |
| 4 | Willful neglect, not corrected | $73,011 to $2,190,294 | $2,190,294 |
These are the current amounts, adjusted for inflation (45 CFR 102.3). HHS updates them for inflation each year. Read more about HIPAA penalty amounts for 2026. The gap between Tier 1 and Tier 4 is the difference between an honest mistake and willful neglect. Willful neglect means you knowingly ignored the rules, or did not care whether you followed them.
How Due Diligence Protects You
A big factor in how OCR handles a violation is whether the organization was making a genuine effort to comply before the incident occurred.
A completed risk assessment is one of the first things OCR looks for. In the Cascade Eye settlement, the absence of a risk assessment was a central finding. It signals to investigators that the practice never even attempted to identify its vulnerabilities.
Beyond the risk assessment, due diligence means written policies, documented training, access controls, audit logs, and a breach response plan (among other things), all maintained and updated regularly. None of these need to be perfect. They need to exist, be followed, and be documented.
Practices that can show an active compliance program are more likely to get technical assistance (help and guidance from OCR) than a six-figure fine. The penalty tier depends on three things: what you knew, whether you ignored the rules, and how fast you fixed the problem. When OCR sets the amount, it must weigh your past record of following HIPAA (45 CFR 160.408). It must also consider whether you had recognized security practices in place for the past 12 months (Public Law 116-321).
The goal is to show that the violation was an exception and not a symptom of systemic neglect.
Our case studies show what building a compliance program looks like at real practices.
FAQs
Can a patient file a HIPAA complaint directly? Yes. Any person can file a complaint with OCR through the HHS website or by mail. Complaints must be filed within 180 days of when the person knew or should have known about the violation, though OCR can waive this deadline for good cause.
How long does an OCR investigation take? There is no fixed timeline. Simple complaints may be resolved in a few months. Investigations involving large breaches or systemic violations can take years, particularly if they result in a resolution agreement or corrective action plan.
Can employees be personally fined for HIPAA violations? OCR’s civil penalties target covered entities and business associates, but the Department of Justice can pursue criminal charges against individuals. Criminal penalties have three levels under 42 U.S.C. 1320d-6. The basic level is up to $50,000 and one year in prison. If the offense is done under false pretenses, meaning by lying or deceiving, it is up to $100,000 and five years. If the offense is done with intent to sell or use PHI (protected health information) for personal gain or to cause harm, it is up to $250,000 and ten years.
Does having a compliance program guarantee you will not be fined? No. A compliance program does not make a practice immune to penalties. However, it lowers the odds of large fines. The penalty tier depends on three things: what you knew, whether you ignored the rules, and how fast you fixed the problem. When OCR sets the amount, it also weighs your past record of following HIPAA (45 CFR 160.408).
Sources
- 45 CFR 160.404: Amount of a civil money penalty
- OCR Enforcement Results by Year
- How to File a HIPAA Complaint
- Cascade Eye and Skin Centers Settlement
One Guy Consulting offers affordable HIPAA compliance packages for practices of all sizes. Learn more about One Guy Consulting
Related reading: OCR Program Guide for Audits