Hallway and elevator conversations
Two staff members discussing a patient's diagnosis in an elevator or cafeteria where others can overhear. Even without names, enough detail can identify the individual.
Back to Start LearningStart Learning · Scenarios & case studies
Scenarios & Case Studies
Everyday situations that turn into HIPAA problems, paired with real federal enforcement actions that show what happens next.
Common scenarios
Small moments, repeated every day in real organizations — each one an impermissible use or disclosure of PHI.
Social media posts
Posting a photo from a treatment room, or sharing a story about a patient's case, without written authorization. Removing the patient's name is not enough if the person is identifiable.
Curiosity access
A staff member looking up the record of a celebrity, a neighbor, or a coworker out of personal interest rather than for a work reason. Even if nothing is shared, the access itself is an impermissible use.
Wrong fax, wrong email
Sending records to an incorrect fax number or mistyping an email address and disclosing PHI to someone outside the organization.
More than the minimum necessary
Sending an entire medical record to an insurer when a single page or a summary would answer the question being asked.
Improper disposal
Placing paper records, labels, or prescription bottles in an ordinary trash bin instead of shredding or securely destroying them.
Family and friends
Discussing a patient's care with a relative who is not involved in that patient's treatment, without the patient's agreement or the opportunity to object.
Unsecured devices and files
Leaving an unlocked laptop, an unencrypted flash drive, or a clipboard of patient information where it can be lost or viewed by the public.
Case studies
Real HHS OCR enforcement actions, with the facts, the outcome, and the lesson each one leaves behind.
1
$100,000 Settlement — Improper Storage and Disposal of Records (Filefax, Inc.)
What happened
Filefax, Inc., a Northbrook, Illinois company that advertised storage, maintenance, and delivery of medical records for covered entities, left protected health information in an unlocked, open container on its premises where it was accessible to the public. The records were then taken to a shredding facility but were never actually shredded. OCR's investigation found that Filefax had failed to implement appropriate safeguards for the PHI it handled.
Who investigated
HHS Office for Civil Rights (OCR), which opened a compliance review after being notified by a local news outlet.
Consequences
A receiver appointed to liquidate Filefax's assets agreed to pay $100,000 out of the receivership estate to OCR and to enter into a corrective action plan — even though the company had already shut its doors.
What this demonstrates
PHI left unsecured + records never actually destroyed → OCR compliance review → settlement and corrective action plan, even after the business closed
2
$2.4 Million Settlement — Patient's Name in a Press Release (Memorial Hermann Health System)
What happened
After an incident involving a patient, Memorial Hermann Health System issued a press release whose title included the patient's name, disclosing that the individual was a patient and had presented a fraudulent identification. The release was approved by senior management and published without the patient's authorization. OCR found the disclosure impermissible and also identified gaps in documenting the disclosure and in training the workforce.
Who investigated
HHS Office for Civil Rights (OCR), acting on a complaint.
Consequences
Memorial Hermann agreed to pay $2.4 million and to adopt a comprehensive corrective action plan, including a two-year monitoring period and mandated staff training.
What this demonstrates
Unauthorized disclosure to the media + documentation and training gaps → $2.4M settlement + corrective action plan
3
$2.2 Million Settlement — Filming Patients Without Authorization (New York-Presbyterian Hospital)
What happened
The New York and Presbyterian Hospital allowed a television production crew to film inside its facilities for a network series. OCR found that the hospital permitted the crew to film two patients — one who was dying and another in significant distress — without obtaining written authorization from the patients or their representatives, even after a medical professional asked the crew to stop.
Who investigated
HHS Office for Civil Rights (OCR), following media reports and its own investigation.
Consequences
NYP agreed to pay $2.2 million and to implement a corrective action plan that included two years of monitoring and comprehensive staff training.
What this demonstrates
Media access to patients without written authorization → impermissible disclosure → $2.2M settlement + corrective action plan
