Unauthorized Patient Chart Access: HIPAA Penalties and Prevention

By Awais Afzal, Healthcare Operations & Data Analyst · Published February 23, 2026 · Updated October 14, 2026

Unauthorized patient chart access, opening a record without a job reason, can bring civil HIPAA penalties for the practice, a presumed breach that must be assessed, required staff sanctions and, for a knowing violation, criminal exposure for the individual. Access controls and regular audit-log review are how practices catch it.

Most practices picture a hacker when they think about a privacy incident. The more common worry for a manager is closer to home: a coworker looks up a neighbor, a relative or a celebrity patient out of curiosity. The patient may never know, but the record of that view can become evidence.

What counts as unauthorized patient chart access

Unauthorized access means opening a patient’s record when your job does not require it. The HIPAA breach definition covers the acquisition, access, use or disclosure of protected health information in a way the Privacy Rule does not allow, and it names access explicitly. See the definition at 45 CFR 164.402.

In plain terms, think of a practice manager who reviews the access report on a Monday and sees a front-desk employee opened the chart of her own neighbor, who was never scheduled. The patient never complained. The view is still a problem, because the record shows access without a work reason.

Typical examples we would flag in a policy: a look-up of a family member or coworker, a check on a public figure who is a patient, opening a former partner’s chart, and a billing user browsing charts outside the claims assigned to them. A user who reaches a chart by accident and closes it is a different case, and the breach rules treat good-faith, unintentional access within someone’s role differently (more on that below).

What can happen after unauthorized patient chart access

The consequences fall on two different parties: the practice (a covered entity or business associate) and the individual who looked. Keeping them separate makes the response clearer.

For the practice

• A breach assessment. Under 45 CFR 164.402, an impermissible access or use is presumed to be a breach unless an exclusion applies or you can show a low probability that the information was compromised through a documented risk assessment.
• An OCR inquiry. OCR enforces the Privacy and Security Rules mainly by investigating complaints, and most cases are resolved through voluntary compliance, corrective action or a resolution agreement. If a matter is not resolved satisfactorily, OCR may impose civil money penalties (per HHS).
• A Security Rule review. If a snooping event comes to OCR’s attention, expect questions about your access controls, audit logs, sanction policy and training, which are the standards listed later in this post.

For the individual

• Workplace sanctions. The Security Rule requires covered entities to apply appropriate sanctions against workforce members who fail to comply with security policies (45 CFR 164.308(a)(1)(ii)(C)). The rule does not say what the sanction must be. Your policy does.
• Criminal exposure. Section 1177 of the Social Security Act, codified at 42 USC 1320d-6, makes it an offense to knowingly obtain individually identifiable health information in violation of the rules, and it applies to “a person (including an employee or other individual)” (SSA text).
• Referral. The HHS enforcement page says OCR may refer a complaint to the Department of Justice when the conduct could violate HIPAA’s criminal provision (HHS).

Other consequences, such as action by a state licensing board, a civil claim under state law or reputation damage, depend on your state and the facts. We do not quantify them here because we did not verify a primary source for any figure. Ask your attorney what applies where you practice.

How civil HIPAA penalties are tiered

Civil penalties scale with culpability, not with the type of snooping. The enforcement regulation at 45 CFR 160.404 sets four tiers, and says the dollar amounts are adjusted for inflation each year under 45 CFR part 102.

Source: HHS, 45 CFR 160.404 (eCFR). Dollar amounts are adjusted annually under 45 CFR part 102, so this table leaves them out; check the current figures before quoting any.

Two things matter for a practice manager. First, the “knew or should have known” language is why log review matters: if the logs showed an inappropriate view and no one looked, it is harder to argue you did not know. Second, the prompt-correction tiers reward practices that act quickly once a problem is found.

The criminal provision: when snooping becomes a crime

HIPAA’s criminal provision applies to individuals who knowingly obtain or disclose health information in violation of the rules. The statute lists three levels, with fines and prison terms that rise with the intent.

Source: Social Security Administration, Social Security Act section 1177. Each level allows a fine, imprisonment or both.

The word knowingly does the work here. A mistaken click is not the same as a deliberate look-up. This is a legal question, so when a case looks deliberate, involve counsel before you contact anyone outside the practice. Whether to refer a matter is a decision for your attorney, not a policy line to improvise.

A real OCR case: when access review is missing

The clearest lesson from OCR is that unreviewed access creates the exposure. In February 2017, HHS announced that Memorial Healthcare System agreed to pay $5.5 million to settle potential violations of the Privacy and Security Rules, per the HHS announcement.

• The protected health information of 115,143 individuals had been impermissibly accessed by employees and disclosed to affiliated physician office staff.
• A former employee of an affiliated physician office used login credentials to access the system daily from April 2011 to April 2012 without detection, affecting 80,000 individuals.
• OCR said the system had workforce access policies but had not implemented procedures to review, modify or terminate users’ access rights, and had not regularly reviewed records of activity despite identifying that risk in risk analyses from 2007 to 2012.

OCR’s statement in the announcement was direct: access to ePHI must be provided only to authorized users, and organizations must implement audit controls and review audit logs regularly. The case involved a hospital system, not a small practice. The controls are the same ones a five-provider clinic is expected to run at its own scale.

What the Security Rule expects: access control and audit logs

The Security Rule asks for five things that matter most for snooping: limit who can open what, identify each user, record activity, review the record, and apply sanctions. The table maps each to the rule text.

Source: HHS, 45 CFR 164.308 and 164.312 (eCFR). Status is as labeled in the regulation; automatic logoff and encryption are separate addressable items under 164.312(a)(2).

Do not read “addressable” as “optional” without checking 45 CFR 164.306(d) with your security officer or counsel. The practical point is simpler: a login shared by three people defeats the unique user rule, and a log nobody reads defeats the activity review rule.

Does a snooping incident count as a breach?

Usually you must assume it is a breach until you document otherwise. Under the breach definition, an impermissible access is presumed to be a breach unless an exclusion applies or a risk assessment shows a low probability of compromise.

The rule lists three exclusions. One covers unintentional access by a workforce member acting in good faith within their authority, as long as it does not lead to further impermissible use or disclosure. A deliberate look at a neighbor’s chart does not fit the words “unintentional” and “good faith” in any natural reading, though your counsel should make that call for a real case.

If no exclusion applies, the rule’s risk assessment weighs at least four factors: the nature and extent of the information, who accessed it, whether it was actually viewed or acquired, and how far the risk has been reduced. Notification timelines and content sit in the neighboring sections of the rule. We did not verify them for this post, so confirm them with counsel before you rely on any deadline.

A response sequence for managers

When you suspect snooping, preserve the record first and decide second. This is our operating sequence, not a legal requirement, so adapt it with your counsel.

1. Preserve the audit log entries and note the date and time you found them (the “knew or should have known” clock matters).
2. Limit the user’s access while you review, if your policy allows it.
3. Ask what the work reason was. Record the answer in the file.
4. Run and document the breach risk assessment against the four factors.
5. Apply your written sanction policy the same way you would for anyone in that role.
6. Decide with counsel whether notification or any outside report is needed.
7. Fix the gap that let it happen: a shared login, a role that was too broad, or logs nobody reviewed.

Smaller practices often hand part of this work to others. If you use remote front-desk help, confirm the people you use work under a virtual medical assistant program that issues each person a unique login and a Business Associate Agreement before they touch a chart. The same goes for any billing vendor.

Preventing it: roles, logs, training and tools

Prevention is mostly design: the fewer charts a person can open, the fewer they can misuse. A role that only needs scheduling does not need clinical notes. Start with access by job, then check it against the administrative safeguards for authorization and termination.

• Map each job to the screens and charts it truly needs, and remove the rest.
• Give every person a unique login and never share one.
• Turn on audit logging in your EHR or practice system and name one owner for reviewing it.
• Schedule the review (weekly or monthly, your call) and keep a note that it happened.
• Run training for all staff, including managers, and repeat it. Add a plain statement that curiosity is not a work reason.
• End a user’s access on the day they leave or change roles.

Sensitive charts deserve a closer look than average. In our view, practices in specialties like behavioral health should review who opens those charts more often, because the harm from a curious look is higher for the patient. That is our recommendation, not a rule.

Tools help when they are built around roles and records. A practice management system that tracks claims by stage can limit each staff member to the work assigned to them and keep an audit log of who opened what, which supports the review step in the loop above. It does not replace your policy, your training or the human who reads the log.

For the broader program, our HIPAA compliance checklist for medical practices and the guide to HIPAA guidelines for the front desk cover the rest. If your concern is billing staff and vendors, see HIPAA compliance in medical billing. Our post on the 2025 HIPAA Security Rule and revenue cycle management looks at the Security Rule from the billing side, and the front desk’s role in the revenue cycle is in how front-desk staff affect the revenue cycle.

Our recommendations

1. Write the sanction policy before you need it. The Security Rule requires a sanction policy, and applying it evenly is easier when it is written down. Name the steps for a first and a repeat finding.
2. Assign a named log reviewer. The rule requires regular review of activity records. We suggest one person and one calendar date each month, with a short sign-off.
3. Remove shared logins this quarter. Unique user identification is the base of every audit trail. If two people use one login, you cannot say who opened a chart.
4. Cut roles down to what the job needs. Review each role’s access once a year and every time someone changes jobs. Remove access on the day it stops being needed.
5. Put 'curiosity is not a work reason' in training. Say it plainly and have staff acknowledge it. Include managers and vendors.
6. Test your breach assessment form. Practice the four-factor assessment on a made-up case so you are not learning it during a real one.

Bottom line

Unauthorized patient chart access creates exposure for both the practice and the person who looked, and the controls that reduce it are in the Security Rule: unique logins, access by role, audit logs that someone reads, and a sanction policy you apply. If billing or revenue cycle work is part of your exposure, see our medical billing services or contact us and we will tell you how we handle access to patient data under a Business Associate Agreement.

Frequently asked questions

Is it a HIPAA violation to look at a coworker's or relative's chart?

If you have no work reason to open it, it is impermissible access, and the breach rule names access explicitly. Being related to the patient or having permission from the patient informally does not change the work-reason test. Check your policy and ask your compliance officer if the situation is unclear.

Can an employee go to jail for accessing a patient chart?

The statute allows prison only for knowing violations. The base offense carries up to one year, false pretenses up to five years, and intent to sell or cause harm up to ten. Most cases do not reach that point, and charging decisions belong to the Department of Justice. Ask counsel about any real case.

Do we have to report an employee who snooped?

Not automatically to law enforcement. You must assess whether the incident is a breach and follow the notification rules if it is. Whether to report beyond that is a legal question for your attorney. OCR may refer matters to DOJ, but your first step is the documented breach assessment.

Do audit logs have to be reviewed, or only kept?

Both. The Security Rule requires audit controls that record and examine activity, and a required procedure to regularly review records of information system activity such as audit logs and access reports. Keeping logs nobody reads is the gap OCR pointed to in the Memorial Healthcare System resolution.

What should a sanction policy include?

The rule only says to apply appropriate sanctions to workforce members who fail to comply. A useful policy lists the types of violations, the range of consequences, who decides, how you document it and that it applies equally to managers. Have counsel review it before you adopt it.

Does a small practice need all of this?

The rules apply to covered entities of any size. The way you meet them can be scaled to your size and systems. A small practice might use one reviewer, role-based access and a monthly log check. Document what you chose and why.

Sources

1. 45 CFR 164.308 Administrative safeguards — HHS via eCFR (current)
2. 45 CFR 164.312 Technical safeguards — HHS via eCFR (current)
3. 45 CFR 164.402 Definitions (breach) — HHS via eCFR (current)
4. 45 CFR 160.404 Amount of a civil money penalty — HHS via eCFR (current)
5. Social Security Act section 1177, Wrongful disclosure of individually identifiable health information — Social Security Administration (current)
6. How OCR enforces the HIPAA Privacy and Security Rules — HHS Office for Civil Rights (current)
7. $5.5 million HIPAA settlement shines light on the importance of audit controls — HHS Office for Civil Rights (2017)