HIPAA violation intake

Legal information only. HIPAA claims depend on detailed facts about who disclosed information and in what capacity. This screener identifies potential issues only. A healthcare privacy attorney reviews your specific situation. See our full disclaimer.

HIPAA violation intake screener

Your HIPAA violation analysis

Get a free medical privacy claim review

HIPAA itself doesn't allow private lawsuits, but violations often support separate state law claims. A healthcare privacy attorney reviews your situation at no cost.

What does HIPAA actually cover, and what doesn't it cover?

HIPAA applies specifically to "covered entities" - healthcare providers, health plans, and healthcare clearinghouses - along with their "business associates" who handle health data on their behalf. It restricts how these entities can use and disclose your protected health information without your authorization. Critically, HIPAA does not create a private right to sue; enforcement happens through complaints to the Department of Health and Human Services, which can investigate and impose penalties on the violating organization.

A common misconception is that HIPAA covers any disclosure of health information by anyone - it doesn't. An employer discussing your medical leave, a school nurse, or a friend who happens to work at your doctor's office generally aren't bound by HIPAA in that capacity, even though the disclosure may still feel like a privacy violation and could support a different legal claim. If a HIPAA violation happened in connection with a medical error, our medical malpractice screener covers that separate but sometimes related issue, and if the violation involved a government-run healthcare facility, a Section 1983 claim might also be worth exploring alongside a HIPAA complaint.

If HIPAA doesn't allow lawsuits, what can you actually do?

You can file a complaint with the HHS Office for Civil Rights, which investigates and can impose significant penalties on the violating organization, though this doesn't result in compensation paid directly to you. Many states also have their own medical privacy laws that do allow private lawsuits, and a HIPAA violation can sometimes support related legal theories like negligence, breach of confidentiality, or emotional distress claims under state law, depending on the specific facts and jurisdiction.

What counts as protected health information?

Any information that identifies you and relates to your past, present, or future physical or mental health condition, healthcare you received, or payment for healthcare. This includes obvious things like diagnoses and treatment records, but also less obvious identifiers like your name combined with an appointment date, since the combination can reveal that you received care for something specific.

How long do you have to file a HIPAA complaint?

Complaints to the HHS Office for Civil Rights generally must be filed within 180 days of when you knew or should have known about the violation, though extensions are sometimes granted for good cause. Any separate state law claim would follow that state's own statute of limitations, which is typically longer but varies significantly, so both timelines are worth tracking if you're pursuing multiple paths.

Frequently asked questions about HIPAA violations

Not under HIPAA itself, since the law does not create a private right of action - only HHS can enforce it directly. However, many states have their own medical privacy or confidentiality laws that do allow private lawsuits, and the same underlying facts that violate HIPAA can often support a state law claim, so a "no" under HIPAA isn't necessarily a dead end.

Generally no - most employers are not HIPAA covered entities in their role as an employer, even though they may receive medical information through FMLA paperwork, workers comp claims, or disability accommodation requests. That said, other laws like the ADA and various state privacy laws impose separate confidentiality obligations on employers handling this kind of information.

HHS reviews the complaint and, if it has merit, can investigate the covered entity, which may lead to corrective action requirements, technical assistance, or in more serious cases, financial penalties. The process can take months, and importantly, any penalty imposed goes to the government rather than to you as compensation, which is why pursuing a parallel state law claim matters if you're seeking personal compensation.

Not automatically, but breaches often reveal underlying HIPAA compliance failures, like inadequate security safeguards, that do constitute violations. Covered entities are also required to notify affected individuals and, for larger breaches, HHS and sometimes the media, within specific timeframes - failing to provide this required notification is itself a separate potential violation.

Generally not without your authorization, except in specific circumstances like emergencies, when you're incapacitated, or when a family member is a designated personal representative. Parents generally can access a minor child's records, though this can become more limited as the minor approaches adulthood or in certain sensitive health categories depending on state law.