What Employees and Employers Need to Know About HIPAA Sanction Policies

When it comes to HIPAA law, the sanction policy is one of the most important factors employees must be aware of. Though HIPAA does not mandate exactly how employers discipline their employees in the workplace, Total HIPAA provides suggested guidelines.

In addition to the employer sanctions, there are civil and criminal penalties associated with violating HIPAA law. Those who violate HIPAA may face fines from $100-250,000 per offense (with an annual cap at $1.5 million) and/or a 1-10 year prison sentence. Employers may find it difficult to enforce sanctions on employees who break the rules, but it is important to do so consistently for the wellbeing of the company.

Punishments correspond with the type of violation, and the following factors should be taken into consideration when classifying the level of the violation:

Was the PHI disclosure intentional?

Was the violation a single incident or a pattern of behavior?

Did the offender simply expose information or did they use someone’s PHI for a specific purpose, like personal monetary gain?

There are three levels of infractions, all with recommended disciplinary sanctions:

1. First simple infraction in three years

Most infractions in this category are accidental exposures of PHI. This includes employees sending PHI via unencrypted email or failing to log out of a database, therefore leaving PHI vulnerable. These offenses may seem small, but they could easily cause a breach.

For this type of violation, we recommend writing a letter of reprimand to the employee to notify them of their wrongdoing and warn them of punishments for further infractions. This letter should be stored in their file for 6 years.

2. Second simple infraction or first serious infraction in three years

If an employee makes the same type of mistake described above again after receiving a warning, their infraction is labeled category two. This also includes first-time serious offenses, like logging in to client/patient information of a neighbor or a relative.  

If one of your employees commits a level two infraction, we recommend a written letter of reprimand and one week’s suspension without pay.

The first and second kinds of infractions typically do not receive any publicity, but that does not make them any less important. In fact, business owners are more likely to have to deal with low-level offenses. These types of HIPAA violations may not seem as serious, but they have the potential to cause just as much harm as level three HIPAA violations.

3. Third simple infraction or second serious infraction in 3 years

This type of offense includes employees repeating low-level mistakes for the third time in three years, repeat mid-level infractions, and very serious infractions intended to cause harm to many people. It is important to note that these violations do not necessarily happen in sequential order. An employee may commit an offense so serious that it is automatically classified as level three, even if it is their first infraction.

We advise employers to dismiss employees who commit this type of infraction. If the case is severe enough, the violation may need to be reported to state or federal authorities and they may prosecute the offender.

The following cases are three real-life examples of level three violations from earlier this year:

Linda Sue Kalina, a former patient information coordinator at the University of Pittsburgh Medical Center, was indicted by a federal grand jury for 6 counts of wrongfully obtaining and disclosing PHI. Kalina used her position to gather the PHI of 111 patients with the intent to cause harm. She could face 11 years in prison and/or a $350,000 fine.1

The state of New York suspended a former nurse, Maria Smith-Lightfoot, for taking a list of patients from her previous job at University of Rochester Medical Center to her new workplace Greater Neurology Rochester. This information included patients’ names, dates of birth, addresses, and diagnoses.2

Both Smith-Lightfoot and Greater Rochester Neurology were punished: GRN paid a $15,000 fine and trained all employees on HIPAA rules and regulations. Smith-Lightfoot was suspended from working as a nurse for one year and given a three year probation period following her suspension.

Rita Luthra, a gynecologist in Springfield Massachusetts, gave a pharmaceutical sales representative access to her patients’ records and lied about her actions when HHS investigated her practice. The pharmaceutical company bribed Luthra to work with insurers to cover their product and to prescribe their name-brand drug to her patients.3   

Luthra faces multiple penalties: First, she could go to prison for one year and/or pay a $50,000 fine for the original crime. She could receive an additional five years in prison and/or a $250,000 fine for obstructing the HHS investigation.

Needless to say, there are serious penalties for violating HIPAA. Employers must protect their employees by providing them with the training they need to keep PHI safe.



  1. https://healthitsecurity.com/news
  2. https://healthitsecurity.com/news
  3. https://www.justice.gov