Skip to main content
Patient Protect circular logo mark in purple and white used for site navigationPatient Protect
HIPAA Training

Module 05 · Free · 5:23

Real-World Breach Scenarios & Best Practices

Six real-world scenarios — lost unencrypted laptop, public discussion of patient info, misdirected email, improper record disposal, unauthorized employee access, unlocked workstation — and the specific workforce practices that prevent each one.

Most HIPAA violations happen in ordinary workflow moments that any workforce member would recognize. This module builds recognition through worked examples — the specific ways incidents happen in daily practice — and the concrete workforce practices that prevent each one. The public scenario library below extends the module with six categories of workflow risk and the workforce response for each.

Full series on YouTubeAll 5 free modules →

Regulatory anchors

  • 45 CFR §164.312(a)(2)(iv)
  • 45 CFR §164.310(d)(2)
  • 45 CFR §164.502
  • 45 CFR §164.530(c)

Hosted on the Patient Protect YouTube channel

HIPAA Violation Examples: 6 Real-World Scenarios and How to Respond

Most HIPAA incidents do not happen because of sophisticated attackers. They happen in ordinary workflow moments — an email typed quickly, a shared workstation left unlocked, a device carried out of the office, a text message sent through the wrong channel, a vendor added to the tech stack without review. This module trains the workforce to recognize those moments before they become incidents. The scenarios below are original to this page — not taken from any specific event and not from the training video — organized by the category of the underlying risk. For each: what happened, what HIPAA principle it engages, what the workforce member should do, and how the practice prevents the next one.

Learning objectives

What the workforce should be able to do after this module.

  • Identify real-world situations that may result in HIPAA violations
  • Understand how breaches occur in everyday practice settings
  • Learn how to prevent common HIPAA violations
  • Apply best practices to maintain compliance and protect patient information

Assessment: 5 knowledge-check questions per module, 80% passing standard.

Module outline

Section-by-section walkthrough.

  1. 01

    How this module is structured

    The video walks through specific incident patterns commonly cited in OCR enforcement records and healthcare-workforce audits — each with the underlying HIPAA principle it engages and the practical safeguard that prevents recurrence. The public scenario library below the outline extends the training with additional workflow categories organized by risk area.

  2. 02

    Recognition, not memorization

    The point of scenario-based training is not to memorize a taxonomy of failure. It is to build the reflex to see the risk in the moment — before the email is sent, before the workstation is left, before the vendor sees data. Every scenario in the module and every scenario on this page maps back to one of the three rules covered in Modules 2, 3, and 4.

How to use this library

Each scenario is short by design. The point is recognition — building the reflex to see the risk in the situation before it escalates. Every scenario names the underlying HIPAA principle (Privacy Rule, Security Rule, Breach Notification Rule) so the training connects back to the earlier modules.

None of these scenarios should be treated as legal advice for a specific situation. Real incidents almost always have context these summaries can't reproduce. If a real event at your practice resembles one of these, escalate through your Privacy Officer or Security Officer — the point of having designated people is that they can apply the specifics.

Scenario library

Twelve workflow moments organized by risk category.

Each scenario is original to this page — not from the training video, not from any specific real event. For every one: what happens, the HIPAA issue it raises, the workforce response, and the safeguard that prevents it.

Communication

A staff member replies to an email chain from a patient about their appointment and copies a similarly-named patient by mistake. The reply includes appointment details, provider name, and reason for visit.

What HIPAA issue does this raise?

PHI (appointment + reason for visit + provider) was disclosed to a person who was not authorized to receive it — a potential breach under the Privacy Rule.

What should the workforce member do?

Report the incident immediately to the Privacy Officer. Ask the unintended recipient to delete the message. Do not send additional PHI to correct the error. Document the incident, the notification, and the response.

How could it be prevented?

Verify recipient before sending. Use practice email with autocomplete disabled or with a confirmation step for external addresses. Do not include reason-for-visit or clinical detail in email subject lines. When possible, move sensitive communication into the patient portal or a secure messaging channel that requires patient authentication.

Communication

Two staff members discuss a patient's diagnosis at a coffee shop across the street from the office. Another customer is close enough to overhear.

What HIPAA issue does this raise?

PHI was disclosed in a setting the practice cannot control — reasonable safeguards under the Privacy Rule were not applied.

What should the workforce member do?

Do not continue the conversation. Report the incident through the practice's designated channel — even overheard disclosures can be relevant if the overhearing person is connected to the patient.

How could it be prevented?

Patient discussions happen in the practice or over secure channels — not in restaurants, elevators, ride-share cars, or shared workspaces. If a workforce member needs to consult about a patient outside the office, they use a phone call from a private setting on an approved channel.

Communication

A patient texts the practice's main number to ask about a lab result. A staff member replies from a personal phone with the result.

What HIPAA issue does this raise?

Two problems. The practice's main number and the patient's request go through a governed workflow (or should); replying from a personal device creates PHI on unmanaged hardware without audit trail. The message content — a lab result — is clinical PHI carried on an unsecured, unencrypted channel.

What should the workforce member do?

Report through the practice's channel. Preserve the text thread on the personal device until the Security Officer says otherwise. Do not continue clinical conversations on personal devices.

How could it be prevented?

Approved messaging channel for all patient communication involving PHI. Documented patient consent for the chosen channel. Written policy prohibiting workforce use of personal devices for patient communication, with a specific alternative provided (portal, approved secure messaging app, phone from an approved line).

Access

A workforce member logs into the EHR to look up their own child's medication history, without a direct role in the child's care that day.

What HIPAA issue does this raise?

Accessing PHI without a legitimate work-related purpose is an impermissible use — regardless of the relationship or whether the information is ever shared. Every EHR access should be traceable to a work need.

What should the workforce member do?

The workforce member should self-report to the Privacy Officer. The practice's audit log will show the access; a self-report before the audit review is a different conversation than one after.

How could it be prevented?

Role-based access limits what workforce members can see to what they need for their duties. Access logs are reviewed periodically. Written policy prohibits accessing family, friends, coworkers, or public figures without a work-related reason and specifies the sanction.

Access

Front desk staff share a single EHR login because it is faster and the practice has always done it that way.

What HIPAA issue does this raise?

The Security Rule requires a unique identifier for each user (§164.312(a)(2)(i)). Shared logins defeat the audit trail — the practice cannot answer "who accessed this record" if it becomes relevant.

What should the workforce member do?

Escalate to the Security Officer. Do not create individual logins without going through the practice's onboarding process (workforce agreement, training completion, sanction acknowledgment). Shared accounts remain a Security Rule violation until they are decommissioned.

How could it be prevented?

Individual credentials for every workforce member. Fast switching between users (a workstation configured for the workflow, not a shared login). Automatic logoff configured to keep the switching cost low. Sanction policy applied consistently if shared credentials reappear.

Access

A workforce member's employment ended two weeks ago, but their EHR login is still active because no one from HR notified IT.

What HIPAA issue does this raise?

Access management (§164.308(a)(4)) requires procedures for authorization, establishment, modification, and termination of access. A departure without termination of access is a Security Rule failure — and the exposure grows with every day of inaction.

What should the workforce member do?

Escalate to the Security Officer immediately. Terminate the access. Review the audit log for the two-week period to determine whether the account was used and, if so, what was accessed. Document the response and update the offboarding workflow.

How could it be prevented?

A written offboarding checklist that includes access termination on the last day of employment. HR and IT share the departure notification the same day. Periodic access reviews (quarterly) that flag active accounts for people no longer employed.

Devices

A staff member takes a work laptop home to catch up on charting. The laptop is not encrypted. Overnight it is stolen from their car.

What HIPAA issue does this raise?

Unsecured (unencrypted) ePHI has been exposed to an unauthorized person. Under the Breach Notification Rule, this triggers the notification analysis — encryption is one of the two safeguards that renders PHI "secured."

What should the workforce member do?

Report immediately to the Privacy Officer and Security Officer. File a police report. Assemble the record of what PHI was on the device (patient list, categories, count). Run the four-factor risk assessment and prepare notifications on the 60-day clock.

How could it be prevented?

Full-disk encryption on every device that ever touches ePHI. Written policy prohibiting removal of ePHI from managed devices without approval. Mobile-device-management (MDM) that allows remote wipe if a device is reported lost. Regular attestation from workforce that encryption is enabled.

Devices

A workstation at the front desk is left unlocked while staff step into the back office. A patient in the waiting area walks up to ask a question and glances at the screen, seeing another patient's information.

What HIPAA issue does this raise?

Reasonable safeguards under the Privacy Rule and the workstation-use standard under the Security Rule (§164.310(b)) were not applied. Whether this reaches breach analysis depends on what was actually visible and for how long.

What should the workforce member do?

Log the incident. Determine what was visible. Apply the four-factor assessment. If any PHI was actually acquired (a photo, a note, or something the observer could reasonably retain), the analysis progresses further.

How could it be prevented?

Manual workstation lock trained and expected. Automatic logoff configured with a short timer (30 seconds to two minutes depending on the setting). Screen placement that reduces line-of-sight from public areas. Privacy screens on workstations that face open areas.

Physical PHI

A staff member cleans out an old records room and puts a box of paper charts into the regular office dumpster. The dumpster is emptied the next morning.

What HIPAA issue does this raise?

Improper disposal of PHI is an impermissible disclosure. Paper records containing PHI must be destroyed by shredding, burning, pulping, or pulverizing to the point that PHI cannot be reconstructed — or via a business associate contracted for the destruction.

What should the workforce member do?

Report immediately. The dumpster contents are likely unrecoverable, so the practice runs the breach analysis on what was in the box (patients, categories, count). Notifications proceed on the 60-day clock.

How could it be prevented?

Written record-destruction policy. Locked shred bins in every location. Business Associate Agreement with the shredding vendor. Trained expectation that paper PHI never enters the regular waste stream. Records-retention schedule that keeps destruction visible and documented.

Physical PHI

A patient's after-visit summary is left on the counter at the front desk. The next patient checks in and sees it.

What HIPAA issue does this raise?

Physical PHI was visible to an unauthorized person — reasonable safeguards under the Privacy Rule were not applied. Whether this reaches breach analysis depends on what the observing patient actually retained.

What should the workforce member do?

Remove the document. Determine what was visible. Apply the four-factor risk assessment. Document the incident and the practice's response.

How could it be prevented?

Paper handoffs at the counter face-down or in a folder. Immediate filing or shredding after use — no PHI left on shared surfaces. Counter design that separates the check-in area from the waiting area's line of sight. Trained expectation that paper PHI is never abandoned.

Vendors

A doctor signs up for a new online scheduling tool and starts entering patient names and appointment reasons before checking with the office manager. No BAA has been signed.

What HIPAA issue does this raise?

PHI has been disclosed to a vendor without a Business Associate Agreement — an impermissible disclosure under the Privacy Rule. The vendor is now a business associate whether or not the paperwork exists.

What should the workforce member do?

Escalate to the Privacy Officer and Security Officer. Stop the flow of PHI to the vendor immediately. Determine what has already been disclosed. Assess whether the vendor's terms are acceptable — some consumer tools do not offer BAAs at all. Run the breach analysis on the disclosures already made.

How could it be prevented?

Written policy that requires Security Officer review before any new vendor receives PHI. Vetted alternatives available for common workflow needs (scheduling, messaging, forms). Vendor inventory maintained and reviewed on a defensible cadence.

Vendors

A billing service the practice worked with two years ago still has active credentials in the EHR. No one noticed because access reviews were never scheduled.

What HIPAA issue does this raise?

Access management (§164.308(a)(4)) was not maintained for a business associate whose engagement ended. The BAA is likely expired; the credentials are a live pathway for PHI access.

What should the workforce member do?

Escalate. Terminate the access. Review the audit log for the period since the engagement ended — determine whether the credentials were used. Update the vendor offboarding process. If the log shows use, treat as an incident and run the analysis.

How could it be prevented?

A vendor offboarding checklist that includes access termination the day the engagement ends. Quarterly access reviews that flag inactive or unaffiliated accounts. BAAs with clear termination language including credential handover / removal.

AI & new technology

A workforce member pastes de-identified case notes into a consumer AI chatbot to help draft a referral letter. Some of the fields they thought were de-identified still contain the patient's date of birth and zip code.

What HIPAA issue does this raise?

Even with intent to de-identify, residual identifiers can re-identify a patient. Disclosing PHI to a consumer AI service that does not have a BAA is an impermissible disclosure. The AI service's terms typically allow the operator to use the input for training or other purposes — the practice loses control of the data the moment it is submitted.

What should the workforce member do?

Report immediately. Assess what identifiers were in the submitted text. Determine whether the service retains the input. Contact the service provider if a retention change is possible; assume it is not. Run the breach analysis on the disclosed PHI.

How could it be prevented?

Written policy defining which AI services are approved for practice use and which are prohibited. Approved services are those that sign BAAs, do not use input for model training, and provide contractual assurance about data handling. Training on what "de-identified" actually requires under §164.514 — it is a specific standard, not an intuition. Guardrail tooling (like HIPAA Shield) that flags PHI patterns before they hit a browser paste.

In practice

The recognition skill this module builds

The scenarios above cover six categories, but the pattern is the same across all of them: a normal workflow moment where a small decision determines whether the practice has an incident. The workforce skill is noticing the decision before it is made.

  • About to send an email with a patient attachment.

    Verify the recipient. Confirm you have the right file. Check whether the subject line reveals PHI. Confirm the recipient has a legitimate need for the information you are sending.

  • About to open a patient chart.

    Confirm you have a work-related reason. If you don't, don't open it. Every access is logged.

  • About to leave a workstation.

    Lock it. Not later — before you turn away.

  • About to enter patient information into a new tool.

    Confirm the tool is approved. If it's new, escalate before the first entry. "I'll check later" is where incidents start.

Sample knowledge check

A representative question from this module.

Sample question · 5 per module in the live series

A staff member takes their work laptop home to catch up on charting. The laptop contains patient records but is not encrypted. Overnight, the laptop is stolen from their car. Which statement about this situation under HIPAA is true?

  1. A.It is not a breach because the theft was not the practice's fault.
  2. B.It is not a breach unless the practice can confirm the thief actually opened the records.
  3. C.It is a breach because the device contained unsecured (unencrypted) ePHI that could be accessed by an unauthorized individual.
  4. D.It is only a breach if the laptop is not recovered within 60 days.
Show explanation

Correct answer: C. Unsecured PHI is patient information that has not been encrypted (or properly disposed of). An unencrypted laptop with patient records that is stolen exposes unsecured ePHI to an unauthorized individual — which triggers breach analysis and notification obligations under the Breach Notification Rule.

Common questions

Follow-up questions this module tends to raise.

Is every one of these scenarios automatically a breach?

No — that is exactly the point of Module 4's incident-versus-breach analysis. Several of these could resolve through the four-factor risk assessment or one of the three exceptions, depending on the specifics. The workforce action is the same regardless: report immediately and let the analysis run.

What if I made a mistake but nothing bad seems to have happened?

Report it anyway. The four-factor risk assessment and the exceptions rely on documented facts — including the fact that nothing further happened. A quick, honest report gives the practice the information to run the analysis correctly. A delayed report or a non-report is what turns a manageable incident into an enforcement finding.

Do I need to know which specific rule was violated?

No. Recognizing that something might be an incident is the workforce skill. Applying the specific rule is the Privacy Officer or Security Officer's job. What helps them: report what happened, when, who was involved, and what you observed — not your legal conclusion.

What about the AI scenarios — are we saying no AI in healthcare?

No. There are HIPAA-compliant ways to use AI in healthcare — inference infrastructure the covered entity or business associate controls, with signed BAAs and documented data-handling terms. The scenario is not about AI in general; it is about consumer AI services that do not have those terms in place. That is the boundary workforce members need to recognize.

Primary sources and further reading

Where the content on this page comes from.

Continue learning

Where to go next.

Previous module · 7:56

HIPAA Breach Notification Rule Training

You’ve completed the free modules

Continue with the full Foundations series

Related Patient Protect resources

HIPAA violations examples

Documented enforcement cases that show how the scenario categories above have played out in real settlements.

Free Risk Assessment

See how your practice's current standing maps against the risks the scenarios above surface.

HIPAA compliance checklist

The operational task list that turns scenario recognition into a documented compliance program.

Return to the Fundamentals

Start the free training series over, or send it to a new hire on their first day.

Up to 50independent practices receive one year of complete HIPAA Foundations training — free.

Selected offices receive all 19 modules, 95 knowledge checks, administrator tracking, and QR-verifiable Certificates of Completion for up to 25 personnel. No hidden conversion. No public review required. Applications close November 30.

See the initiative

Module 05 of the HIPAA Foundations series

Every learner. Every module. One office price.

When you are ready to train the whole practice, the complete 19-module HIPAA Foundations series unlocks for up to 25 personnel at $39/office/month — with per-learner assessment scores, verifiable Certificates of Completion, and workforce-wide tracking.

Start your free trial — from $39/mo

Free tools stay free — no account needed. The 14-day platform trial asks for a card for identity verification; no charge before day 14, cancel any time.