Get certified in HIPAA for Leaders for just $49.95.
To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video
Since HIPAA's enforcement began, penalties have become more common. The amount depends on the seriousness of the violation and the organization's level of responsibility, and can range from around ten thousand dollars to millions. As of mid-2026, the largest HIPAA settlement on record is the 2018 Anthem case at $16 million, which followed the largest health data breach in history. It is important for covered entities to have policies and procedures in place, which we call the Book of Evidence. Not only is this Book of Evidence a requirement, but the Book of Evidence will protect their businesses in case of a breach or violation or an audit. PRIVACY OFFICER JENNY: Oh, hey Mary. I was walking by earlier and noticed some sticky notes on your computer screen with passwords on them. Is there a reason why the passwords are there? OFFICE MANAGER MARY: Oh, it is so hard for me to remember all of my passwords, that I just like to have them readily available. PRIVACY OFFICER JENNY: Oh, I can totally understand that. I can never remember my passwords, either. But we do want to be mindful that we are violating any of our HIPAA security policies. Can we set up with something to ensure that we keep everything secured. OFFICE MANAGER MARY: Yup! That would be great! PRIVACY OFFICER JENNY: Alright, thank you! OFFICE MANAGER MARY: Thank you! In this scene, Privacy Officer Jenny handled the password violation well! You are required to have a password to access PHI and it must be secure and complex. A common place a password may be hidden is right under the keyboard and is one of the first places that someone might look to find a password to get into the computer.
In this lesson, we'll cover HIPAA violations and penalties, how penalty amounts are calculated, the role of a Book of Evidence, and a practical example of addressing workstation security risks.
Since HIPAA enforcement began, penalties have become increasingly common. Penalty amounts depend directly on the seriousness of the violation and the organization's level of responsibility, ranging from around ten thousand dollars to millions of dollars.
As of mid-2026, the largest HIPAA settlement on record remains the 2018 Anthem case at $16 million, which followed the largest healthcare data breach in history.
Pro Tip #1: The Book of Evidence: It is critical for covered entities to maintain written policies and procedures, known as a Book of Evidence. Not only is this a legal requirement under HIPAA, but it protects your organization in the event of a breach, violation, or audit.
As demonstrated in the office scenario, managing passwords properly is an essential part of complying with HIPAA security policies. Displaying passwords on sticky notes attached to computer monitors or placing them under keyboards creates an immediate security risk.
You are required by law to use a password to access PHI, and passwords must be secure and complex. Avoid placing password notes around your workstation or under your keyboard, as these are the very first places unauthorized individuals look when attempting to gain system access.
Pro Tip #2: Addressing Compliance Issues: Privacy officers and team leaders should address security violations promptly and constructively, helping staff implement secure alternatives to keep all systems protected.