When Would Our Organization Be Investigated?

Quick answer: A HIPAA violation is any failure by a covered entity or business associate to comply with the HIPAA Privacy, Security, or Breach Notification Rules. It does not require a hacker or a headline; failing to provide a patient’s records on time, failing to conduct an accurate and thorough risk analysis, or notifying patients of a breach late are each violations on their own. Most OCR investigations begin with a breach report, a complaint, or a compliance review. Breaches affecting 500 or more individuals are publicly posted on the HHS website and, in most cases, investigated by OCR; OCR also investigates breaches affecting fewer than 500 people.

What Counts as a HIPAA Violation

The HHS Office for Civil Rights (OCR) enforces three rules, and failing to meet any requirement under any of them is a violation, whether or not anyone was harmed.

• Privacy Rule: impermissible uses or disclosures of protected health information (PHI), failing to provide patients timely access to their records, or missing privacy policies and procedures.
• Security Rule: no accurate and thorough risk analysis, no risk management plan, or missing administrative, physical, and technical safeguards.
• Breach Notification Rule: late or missing notice to individuals, HHS, or the media, or a business associate failing to notify the covered entities it serves.

These obligations apply to covered entities, meaning health plans, health care clearinghouses, and most health care providers, and directly to their business associates.

A Breach and a Violation Are Not the Same Thing

A breach is an event: an impermissible use or disclosure of unsecured PHI, as defined in 45 C.F.R. § 164.402. A violation is a failure to meet a regulatory requirement. An organization can have a breach while fully compliant, or be out of compliance for years without a breach. In practice, a breach opens the door; OCR then requests documentation for the compliance program, and when that documentation is missing or outdated, the underlying violations become the case.

How OCR Investigations Start

A breach report. Affected individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery. Breaches affecting 500 or more individuals must also be reported to HHS within that same window, and to the media when more than 500 residents of a state or jurisdiction are affected; smaller breaches are reported to HHS annually. In most cases, OCR investigates breaches affecting 500 or more individuals, and it also investigates breaches affecting fewer than 500 people based on its resources and enforcement priorities.

A complaint. Anyone, including a patient, family member, or current or former employee, may file a complaint with OCR, generally within 180 days of learning of the issue. One complaint is enough to start an investigation.

A compliance review. OCR may review an organization on its own initiative, and enforcement initiatives such as its Risk Analysis and Right of Access Initiatives show where that attention is concentrated.

Breaches Affecting 500 or More Individuals Are Posted Publicly by HHS

Under the HITECH Act, HHS maintains a public list of breaches of unsecured PHI affecting 500 or more individuals on the OCR Breach Portal. Each posting identifies the organization, its state, the number of individuals affected, the type of breach, and where the information was located. Patients, journalists, cyber insurers, and plaintiffs’ attorneys can all see it. Because these reports are public and, in most cases, are investigated, the time to have a current risk analysis, risk management plan, and documented policies is before the report is filed, not after.

What Recent OCR Enforcement Cases Show

Shen Smiles, P.C.: One Complaint, No Hacker

On October 8, 2026, OCR announced a $140,000 settlement with a solo Pennsylvania dental practice. A patient complained that she could not obtain her records despite multiple requests; the practice said a workforce member had stolen them. OCR found no right-of-access policies and procedures and a failure to reasonably safeguard PHI. After OCR proposed a civil money penalty, the practice requested a hearing and then settled in August 2026. It was OCR’s 56th Right of Access enforcement action and a reminder that no practice is too small to be investigated.

MMG Fusion, LLC: A Business Associate and an Unreported Incident

On March 5, 2026, OCR announced a settlement with MMG Fusion, a Maryland software company serving as a business associate. A complaint about an unreported incident and PHI posted on the dark web led OCR to find that approximately 15 million individuals’ PHI had been exposed in 2020, with no accurate, thorough risk analysis and no notice to the affected covered entities. Considering MMG’s financial condition, OCR accepted $10,000 and a three-year corrective action plan. An unreported incident does not stay hidden; it often surfaces through a complaint.

Four Ransomware Settlements: The Same Core Finding

On April 23, 2026, OCR announced four ransomware settlements affecting more than 427,000 individuals and totaling $1,165,000, each with two years of OCR monitoring:

• Axia Women’s Health: 37,989 individuals; no accurate and thorough risk analysis; $320,000.
• Assured Imaging: 244,813 individuals; impermissible disclosure, no accurate and thorough risk analysis, and late notification to individuals; $375,000.
• Consociate Health, a business associate: about 136,539 individuals after a phishing attack; no accurate and thorough risk analysis; $225,000.
• Star Group, L.P. Health Benefits Plan, an employer’s self-funded plan: about 9,316 individuals; impermissible disclosure and no accurate and thorough risk analysis; $245,000.

The attack started each investigation, but the risk analysis failure is what OCR cited in every case. Late notification, as with Assured Imaging, is a separate violation stacked on top.

The Pattern Behind the Cases

OCR is not penalizing organizations for being attacked or for receiving complaints; it is penalizing what the investigation reveals: a lack of accurate, thorough risk analysis, no risk management plan, missing policies and procedures, and late or missing breach notification.

How to Be Ready Before OCR Asks

• Complete or update a risk analysis covering every system, vendor, and location where ePHI is created, flows, and leaves.
• Document a risk management plan with an owner and target date for each identified risk.
• Adopt and follow right of access procedures so every records request is answered within 30 days.
• Confirm every vendor touching PHI has a signed business associate agreement requiring timely incident notice.
• Rehearse breach response so notifications meet regulatory deadlines, and keep role-specific training records current.

Frequently Asked Questions

What is considered a HIPAA violation?

Any failure by a covered entity or business associate to comply with the HIPAA Privacy, Security, or Breach Notification Rules, such as an impermissible disclosure of PHI, no accurate and thorough risk analysis, denying timely record access, or late breach notification.

Is every data breach a HIPAA violation?

No. A breach is an event; a violation is a failure to meet a requirement. Breach investigations frequently uncover violations, most often an inadequate risk analysis. Violations can exist without a breach.

What triggers a HIPAA investigation by OCR?

Most investigations begin with a breach report, a complaint, or a compliance review. A single complaint is enough to open one.

Does OCR investigate every HIPAA breach?

Not every breach. In most cases, OCR investigates breaches affecting 500 or more individuals, and it also investigates breaches affecting fewer than 500 people based on its resources and enforcement priorities.

Are HIPAA breaches made public?

Breaches affecting 500 or more individuals are publicly posted on the HHS OCR Breach Portal. Smaller breaches are reported to HHS annually and are not listed publicly.

Can a small practice be investigated and penalized?

Yes. In October 2026, OCR announced a $140,000 settlement with a solo dental practice, following one patient’s complaint about access to her records.

Not Sure How Your Organization Would Hold Up If OCR Came Calling? Colington Consulting Can Help You Find Out

Every case above began with something ordinary: a records request, a complaint, or a breach report. The outcome hinged on what each organization could produce when OCR asked. Colington Consulting’s lead consultant has personally conducted more than 1,000 HIPAA risk assessments, and we work directly with covered entities and business associates to build a documented, defensible compliance program that OCR expects to see before an investigation even begins. Our extensive experience includes working with organizations under OCR investigation.

Get a free HIPAA Risk Review. We will show you where your organization stands today, what an OCR data request would likely uncover, and where to focus first.

Schedule Your Free HIPAA Risk Review →

Sources

U.S. Department of Health and Human Services, Office for Civil Rights, “HHS’ Office for Civil Rights Settles HIPAA Privacy Rule Investigation with Dr. Linda L. Shen d/b/a Shen Smiles, P.C.,” October 8, 2026.

U.S. Department of Health and Human Services, Office for Civil Rights, “HHS’ Office for Civil Rights Settles HIPAA Investigation of MMG Fusion, LLC Breach Affecting 15 Million Individuals,” March 5, 2026.

U.S. Department of Health and Human Services, Office for Civil Rights, “HHS’ Office for Civil Rights Settles Four HIPAA Security Rule Ransomware Investigations,” April 23, 2026.

U.S. Department of Health and Human Services, Office for Civil Rights, HIPAA Breach Portal, ocrportal.hhs.gov.

HITECH Act, § 13402, 42 U.S.C. § 17932, Notification in the Case of Breach.

45 C.F.R. §§ 164.400 through 164.414, Breach Notification Rule; 45 C.F.R. §§ 160.306 and 160.308, Complaints and Compliance Reviews.

45 C.F.R. § 164.308(a)(1), Security Management Process; 45 C.F.R. § 164.524, Right of Access.