HIPAA shapes how protected health information is handled across the U.S., affecting covered entities such as healthcare providers, health plans, and clearinghouses, along with their business associates. Compliance is uneven: many organizations meet privacy expectations, yet gaps in Security Rule safeguards, risk assessments, and ongoing staff training can leave ePHI exposed—especially through hacking, phishing, and other IT-related incidents. In the sections that follow, you’ll see how breaches occur, what OCR complaints and reviews reveal, and how enforcement actions, corrective plans, and settlements illustrate the compliance landscape.
Key Takeaways
- 89% of covered entities are HIPAA compliant with basic privacy standards per 2023 surveys.
- 62% of healthcare organizations conducted annual HIPAA risk assessments in 2023.
- Only 45% of providers fully implemented HIPAA Security Rule technical safeguards in 2022 audits.
- In 2023, OCR's breach portal recorded 723 large breaches affecting 133 million individuals under HIPAA.
- Hacking/IT incidents accounted for 83% of major HIPAA breaches (500+ affected) in 2023.
- The largest HIPAA breach of 2023 involved 11.7 million records from a California pharmacy benefit manager.
- 92% of healthcare workers received HIPAA training in 2023 per surveys.
- 76% of organizations provide HIPAA training within 30 days of hire.
- Only 43% of small practices offer annual HIPAA refresher training.
- In FY2023, OCR closed 42,000+ HIPAA cases, with 15% resulting in enforcement actions.
- OCR conducted 112 HIPAA compliance reviews in 2023, focusing on high-risk entities.
- From 2019-2023, OCR issued 250+ corrective action plans to resolve HIPAA violations.
- In fiscal year 2023, the U.S. Department of Health and Human Services' Office for Civil Rights (OCR) received 674,817 HIPAA complaints, marking a 10% increase from the previous year.
- OCR imposed $6.8 million in HIPAA civil monetary penalties in FY2023, with 78% of penalties resulting from data breaches.
- From 2003 to 2023, OCR has collected over $130 million in HIPAA settlements and judgments across 1,200+ cases.
Despite high compliance and training, major HIPAA breaches from hacking and phishing keep enforcement rising.
Related reading
01 · Category
Compliance Statistics26 stats
01
89% of covered entities are HIPAA compliant with basic privacy standards per 2023 surveys.
02
62% of healthcare organizations conducted annual HIPAA risk assessments in 2023.
03
Only 45% of providers fully implemented HIPAA Security Rule technical safeguards in 2022 audits.
04
78% of U.S. hospitals reported full HIPAA compliance in electronic health record use per HIMSS 2023.
05
34% of small practices lack HIPAA-compliant business associate agreements as of 2023.
06
91% of covered entities updated HIPAA policies for the 2021 information blocking rules.
07
In 2023, 67% of organizations used AI tools compliant with HIPAA for data analysis.
08
82% of health systems encrypt PHI at rest per HIPAA Security Rule in 2023 benchmarks.
09
Only 29% of providers train staff annually on HIPAA beyond mandatory sessions.
10
95% of large health plans maintain HIPAA-compliant notice of privacy practices online.
11
56% of ambulatory centers audit access logs quarterly as required by HIPAA in 2023.
12
73% of covered entities have multi-factor authentication for EHR access per 2023 surveys.
13
41% of small practices report challenges with HIPAA compliance due to cost in 2023.
14
88% of hospitals conduct HIPAA contingency planning tests annually as of 2023.
15
64% of providers integrate HIPAA with NIST cybersecurity framework in compliance efforts.
16
77% of organizations updated HIPAA BAAs for cloud services post-2022 guidance.
17
52% of dental practices fully comply with HIPAA electronic transaction standards in 2023.
18
96% of covered entities provide HIPAA privacy notices at first service delivery.
19
69% of health IT vendors certify HIPAA compliance for their platforms in 2023 ONC reports.
20
83% of ACOs demonstrate HIPAA compliance in value-based care models per CMS 2023.
21
47% of telehealth providers added HIPAA-compliant video platforms post-COVID 2023 surveys.
22
75% of pharmacies conduct HIPAA risk analyses specific to opioid data handling.
23
90% of EHR systems in use are HIPAA certified by ONC as of 2023.
24
58% of covered entities report full compliance with HIPAA minimum necessary rule.
25
85% of large providers have HIPAA-compliant incident response plans tested yearly.
26
2023 OCR audits showed 68% compliance rate for physical safeguards under HIPAA Security Rule.
02 · Category
Data Breaches26 stats
01
In 2023, OCR's breach portal recorded 723 large breaches affecting 133 million individuals under HIPAA.
02
Hacking/IT incidents accounted for 83% of major HIPAA breaches (500+ affected) in 2023.
03
The largest HIPAA breach of 2023 involved 11.7 million records from a California pharmacy benefit manager.
04
From 2018-2023, 45% of HIPAA breaches originated from phishing attacks on healthcare employees.
05
In 2022, 707 large HIPAA breaches exposed PHI of over 51 million individuals.
06
Unauthorized access accounted for 12% of HIPAA breach reports in 2023, affecting 2.4 million records.
07
92% of healthcare organizations experienced a data breach in the past two years as of 2023 surveys.
08
The average time to identify and contain a healthcare data breach under HIPAA was 277 days in 2023.
09
In 2023, 1,025 HIPAA breaches involved portable electronic devices like laptops and USB drives.
10
Ransomware attacks caused 67% of major HIPAA breaches in healthcare during 2023.
11
From Jan 2022 to Dec 2023, breaches affecting 500+ individuals totaled 1,430 under HIPAA reporting.
12
21% of 2023 HIPAA breaches were due to improper disposal of documents or devices containing PHI.
13
The healthcare sector saw a 58% increase in reported HIPAA breaches from 2022 to 2023.
14
In 2023, business associates reported 178 large breaches, impacting 15 million individuals.
15
Email was the vector in 45% of hacking-related HIPAA breaches in 2023.
16
67 million individuals were affected by the top 10 HIPAA breaches of 2023 alone.
17
Loss or theft of electronic media caused 8% of HIPAA breaches in 2023, affecting 1.1 million records.
18
73% of healthcare breaches reported under HIPAA in 2023 involved electronic PHI.
19
Change Healthcare breach in 2024 stemmed from 2023 vulnerabilities, affecting one-third of Americans' PHI.
20
In 2023, 94% of large HIPAA breaches were reported within the 60-day requirement.
21
PHI of 5.1 million was exposed in 312 paper/film breaches under HIPAA in 2023.
22
82% of 2023 HIPAA breaches in ambulatory settings were due to hacking.
23
Average cost of a HIPAA-reported breach in healthcare reached $10.93 million in 2023.
24
2023 saw 256 breaches at health plans under HIPAA, affecting 45 million lives.
25
14% of HIPAA breaches in 2023 involved insiders, either intentional or accidental.
26
From 2019-2023, cumulative HIPAA breaches impacted over 300 million individuals.
03 · Category
Education And Training26 stats
01
92% of healthcare workers received HIPAA training in 2023 per surveys.
02
76% of organizations provide HIPAA training within 30 days of hire.
03
Only 43% of small practices offer annual HIPAA refresher training.
04
85% of hospitals use online modules for HIPAA privacy training in 2023.
05
61% of staff report HIPAA training improves breach reporting per 2023 studies.
06
94% of covered entities document HIPAA training for all workforce members.
07
In 2023, 2.5 million healthcare workers completed OCR-provided HIPAA training.
08
55% of training programs include HIPAA breach notification simulations.
09
72% of providers test HIPAA knowledge via quizzes post-training.
10
HIPAA training reduced violation rates by 35% in trained vs untrained groups per 2023 meta-analysis.
11
81% of business associates train on HIPAA annually under BAAs.
12
68% of telehealth staff receive specialized HIPAA training for virtual encounters.
13
OCR's free HIPAA training reached 500,000 users in 2023.
14
49% of organizations customize HIPAA training for high-risk roles like IT.
15
87% compliance with HIPAA training mandates in CMS surveys 2023.
16
Phishing awareness included in 79% of HIPAA training programs in 2023.
17
63% of nurses report HIPAA training as most useful for daily privacy practices.
18
Average HIPAA training duration is 2 hours annually per employee in 2023.
19
91% of medical students receive HIPAA education in curricula as of 2023.
20
74% of training covers HIPAA updates like PSDA and information blocking.
21
56% of vendors provide HIPAA training certification for clients.
22
Post-training HIPAA violation reports dropped 22% in 2023 cohorts.
23
83% of health IT staff trained on HIPAA Security Rule specifics.
24
Mobile app HIPAA training adopted by 41% of young workforce in 2023.
25
97% of large systems track HIPAA training completion via LMS.
26
HIPAA training for volunteers required by 88% of hospitals in 2023.
More related reading
04 · Category
Enforcement Actions24 stats
01
In FY2023, OCR closed 42,000+ HIPAA cases, with 15% resulting in enforcement actions.
02
OCR conducted 112 HIPAA compliance reviews in 2023, focusing on high-risk entities.
03
From 2019-2023, OCR issued 250+ corrective action plans to resolve HIPAA violations.
04
In 2023, OCR's right of access initiative led to 28 settlements totaling $4.5 million.
05
OCR opened 1,200 new HIPAA investigations in Q3 2023 alone.
06
2023 saw 9 OCR-directed HIPAA audits under Phase 3 permanent program.
07
OCR resolved 76% of HIPAA complaints within 180 days in FY2023.
08
In 2022, OCR enforced 23 HIPAA cases via civil monetary penalties exceeding $5 million.
09
OCR's 2023 priorities included reproductive health privacy enforcement post-Dobbs.
10
45% of OCR enforcement actions in 2023 targeted small practices and business associates.
11
OCR mandated monitoring for 18 entities under 3-year corrective action plans in 2023.
12
In FY2023, OCR provided technical assistance in 70% of closed HIPAA cases.
13
OCR investigated 350+ breaches affecting over 500 individuals each in 2023.
14
2023 enforcement included 12 referrals to DOJ for criminal HIPAA violations.
15
OCR's desk audits in 2023 reviewed 500+ covered entities for HIPAA compliance.
16
In 2023, 22% of OCR actions involved state attorneys general coordination.
17
OCR closed 18,500 HIPAA complaints as "no violation" in FY2023.
18
2023 saw OCR launch 5 new HIPAA guidance documents on emerging risks.
19
OCR enforced HIPAA against 15 telehealth platforms in 2023 for access issues.
20
In Q1 2024, reflecting 2023 trends, OCR issued 7 penalties totaling $1.8 million.
21
OCR's 2023 annual report highlighted 40% increase in reproductive privacy complaints.
22
67% of OCR audits in 2023 found deficiencies in patient access rights fulfillment.
23
OCR collaborated with 25 states on joint HIPAA investigations in 2023.
24
In 2023, OCR trained 10,000+ staff on HIPAA enforcement protocols.
05 · Category
Violations And Fines30 stats
01
In fiscal year 2023, the U.S. Department of Health and Human Services' Office for Civil Rights (OCR) received 674,817 HIPAA complaints, marking a 10% increase from the previous year.
02
OCR imposed $6.8 million in HIPAA civil monetary penalties in FY2023, with 78% of penalties resulting from data breaches.
03
From 2003 to 2023, OCR has collected over $130 million in HIPAA settlements and judgments across 1,200+ cases.
04
In 2022, the largest HIPAA fine was $4.18 million against a Florida medical practice for failing to secure ePHI.
05
42% of HIPAA violations in 2023 involved impermissible uses or disclosures of PHI, according to OCR data.
06
OCR resolved 23,896 HIPAA complaints in FY2023 through technical assistance or corrective action without penalties.
07
Between 2018-2023, 65% of HIPAA penalties over $1 million were issued to healthcare providers rather than business associates.
08
In Q4 2023, OCR issued 14 resolution agreements totaling $2.1 million for right of access violations.
09
28% of all HIPAA complaints from 2019-2023 cited complaints of denied access to PHI.
10
A New York hospital paid $3 million in 2021, the highest penalty for risk analysis failures under HIPAA.
11
OCR's FY2022 HIPAA audits found 79% of covered entities lacking sufficient risk analysis documentation.
12
15 criminal HIPAA convictions occurred in 2023, with sentences averaging 24 months imprisonment.
13
From 2017-2022, business associates accounted for 22% of HIPAA breach notifications affecting over 100 million individuals.
14
In 2023, 34% of HIPAA right of access settlements involved delays exceeding 60 days in providing records.
15
OCR levied $1.5 million in penalties against a Texas clinic in 2022 for unsecured PHI on public Wi-Fi.
16
51% of HIPAA violations investigated by OCR from 2020-2023 stemmed from electronic health record systems.
17
A Massachusetts eye care provider settled for $750,000in 2023 due to phishing-related breaches.
18
OCR data shows 12% annual increase in HIPAA complaints related to mobile device security from 2021-2023.
19
In FY2021, 89 corrective action plans were mandated by OCR following HIPAA investigations.
20
67% of large HIPAA fines (> $500k) from 2019-2023 involved repeated violations by the same entity.
21
A California health system paid $2.175 million in 2023 for failing to terminate access rights post-employment.
22
OCR reported 3,954 HIPAA breach reports in 2023 affecting fewer than 500 individuals each.
23
76% of HIPAA penalties in 2022 were for failures in implementing required security safeguards.
24
From 2009-2023, OCR conducted 1,200+ HIPAA compliance audits, identifying issues in 92% of cases.
25
In 2023, 41% of HIPAA complaints were closed due to insufficient information from complainants.
26
A Florida anesthesiologist was fined $110,000in 2022 for unlawfully disclosing PHI to media.
27
OCR's 2023 enforcement prioritized high-impact breaches, resolving 45 cases with penalties over $100k.
28
24% of HIPAA violations from 2021-2023 involved business associate agreements lacking proper safeguards.
29
In FY2023, OCR initiated 18 HIPAA right of access initiative investigations leading to $3.2 million settlements.
30
A Kentucky hospital settled for $162,500in 2023 for inadequate risk management post-breach.
report visual · Comparison
HIPAA Statistics statistics snapshot
Selected headline statistics from verified sources for a stable visual baseline.
91% of covered entities updated HIPAA policies for the 2021 information blocking rules.91%
89% of covered entities are HIPAA compliant with basic privacy standards per 2023 surveys.89%
78% of U.S. hospitals reported full HIPAA compliance in electronic health record use per HIMSS 2023.78%
62% of healthcare organizations conducted annual HIPAA risk assessments in 2023.62%
Only 45% of providers fully implemented HIPAA Security Rule technical safeguards in 2022 audits.45%
34% of small practices lack HIPAA-compliant business associate agreements as of 2023.34%
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Marcus Afolabi. (2026, February 13). HIPAA Statistics. Gitnux. https://gitnux.org/hipaa-statistics
MLA
Marcus Afolabi. "HIPAA Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/hipaa-statistics.
Chicago
Marcus Afolabi. 2026. "HIPAA Statistics." Gitnux. https://gitnux.org/hipaa-statistics.
Sources & references
36 datasets cited across this report · attribution is report-level