HIPAA Violation Lawsuit 2026: Can You Sue, What Pays, and Which Deadlines Are Open
Quick Answer
- HIPAA itself doesn’t let you sue. Complaints go to OCR, and injury claims run through state law.
- Reported breach settlement payouts are modest: up to $100 to $2,500 for documented losses.
- Earliest open claim deadline found: Highland Health, October 28, 2026. Summit Medical follows on November 4.
A HIPAA violation lawsuit, in the strict sense, doesn’t exist for individuals. The federal law has no private right of action, so you can’t sue under HIPAA alone.
What does exist is a set of other routes. You can file an OCR complaint within 180 days. State-law claims can reach court. Breach class actions pay small claims, and three have deadlines between October 28 and November 12, 2026.
This guide covers fines, payouts, filing steps, and dates. One surprise: HHS applied a year-late inflation increase to HIPAA penalties in January 2026.
The Facts
| Item | Detail |
|---|---|
| Case | No single case. A federal law with no private right to sue, plus several open health data breach class actions |
| Status | Multiple settlements open; OCR enforcement ongoing |
| Fund Size | Not yet confirmed (varies by settlement) |
| Est. Per Person | Up to $100 to $2,500 for documented losses, depending on the settlement |
| Claim Deadline | Highland Health: Oct. 28, 2026. Summit Medical: Nov. 4, 2026. Allen Memorial: Nov. 12, 2026 |
| Administrator | Varies by case (Simpluris is the administrator for Highland Health) |
| Proof Needed | Notice ID for some claims; receipts for documented losses |
Can you sue for a HIPAA violation?
No, HIPAA gives you no private right to sue. A case can’t rest on the federal law alone.
The government enforces it. OCR handles civil penalties. The Justice Department handles crimes. State attorneys general can bring civil actions too.
That doesn’t mean every suit dies at the courthouse door. The Arizona Supreme Court revived a Phoenix man’s pharmacy privacy suit against Costco. The trial court had tossed it, but the claim cited pharmacy regulations, not only HIPAA.
Who can act on a HIPAA violation:
- OCR: investigates complaints, issues civil penalties and resolution agreements
- Justice Department: prosecutes criminal cases
- State attorneys general: bring civil actions for residents
- You: can bring state-law claims or join a class action
Is a HIPAA lawsuit email, text, or letter legit?
It can be, but verify it first. A real notice names the case, the court, a claim deadline, and an administrator.
Scammers count on panic. Don’t click a link inside a text. Search the case name yourself and compare the dates you find.
Real notices carry identifiers. Allen Memorial’s claim form, for example, asks for a LoginID and PIN printed on your mailed notice. Highland Health’s court-appointed administrator, Simpluris, issued a public statement on July 30, 2026.
Quick verification checklist:
- Does the case name match a published settlement?
- Do the deadlines match the official settlement website?
- Does the notice ask you to pay anything? (That’s a red flag.)
- Does the administrator’s mailing address match the official site?
How much is a HIPAA violation lawsuit worth?
For most people, a health data breach settlement pays small amounts, not a windfall. Payouts depend on your documented losses and on how many people file.
Here’s what the open settlements report:
| Settlement | Documented losses | Other benefits reported |
|---|---|---|
| Allen Memorial Hospital (July 2025 attack) | Up to $100 | Data monitoring offered |
| Summit Medical Group (September 2024 breach) | Up to $2,500 | Lost time at $15 per hour, up to three hours |
| Albany Gastroenterology Consultants (November 2024 incident) | Up to $2,500 | Or a one-time cash payment expected around $10 |
Large funds can still shrink on a per-person basis. Geisinger and Nuance’s $5 million settlement covered more than 1.3 million people. Spread evenly, that’s under $4 each before fees.
Individual injury suits are different. No verified average payout exists, because each case turns on proof of harm.
Key Takeaway: HIPAA has no private lawsuit, and the money most people actually receive comes from breach class actions that pay small, claim-based amounts.
How much are HIPAA fines in 2026?
HIPAA civil fines run from $145 to $73,011 per violation in most tiers, with a top annual cap of $2,190,294. These amounts apply to penalties assessed on or after January 28, 2026.
| Tier | Culpability | Per violation | Annual cap (identical provision) |
|---|---|---|---|
| 1 | Did not know | $145 to $73,011 | $2,190,294 |
| 2 | Reasonable cause | $1,461 to $73,011 | $2,190,294 |
| 3 | Willful neglect, corrected in 30 days | $14,602 to $73,011 | $2,190,294 |
| 4 | Willful neglect, not corrected | $73,011 to $2,190,294 | $2,190,294 |
The Tier 1 minimum rose from $141 to $145. The per-violation maximum rose from $71,162 to $73,011. The cap rose from $2,134,831.
The adjustment was due in January 2025. OCR applied it more than a year later.
Since 2019, OCR has applied lower annual caps to Tiers 1 through 3. One industry summary puts the Tier 2 cap near $146,053 under that policy. Check the current HHS table before relying on any figure.
Think of it like a speeding ticket. The fine goes to the state, not to the other driver.
What have recent OCR HIPAA settlements paid?
Recent OCR settlements for ransomware cases ran from $225,000 to $552,500. The newest, announced at the end of July 2026, was with OSF Healthcare System.
| Entity | Amount | Detail |
|---|---|---|
| OSF Healthcare System | $552,500 | Two-year corrective action plan; almost 54,000 people affected |
| Assured Imaging | $375,000 | Almost 245,000 people affected |
| Axia Women’s Health | $320,000 | Almost 38,000 people affected |
| Star Group (self-funded health plan) | $245,000 | More than 9,000 people affected |
| Consociate Health | $225,000 | More than 136,000 people affected |
OCR has now been party to 21 ransomware enforcement actions. A June 2026 report also lists a $450,000 settlement with the Spencer Gifts health plan. On August 27, 2026, OCR announced its 55th right-of-access settlement.
Look at where the money goes. In OCR’s published agreements, the payment goes to HHS. It doesn’t go to the people whose records were exposed.
Reality Check: No one texts you settlement money first, and filing a claim in a legitimate class settlement costs nothing. Third-party “claim helpers” that charge a fee aren’t required. OCR fines don’t pay patients, so any message promising you a share of one deserves suspicion.
What state-law claims can you bring after a HIPAA violation?
You can bring claims like negligence, negligence per se, breach of implied contract, unjust enrichment, and invasion of privacy. HIPAA often serves as evidence of the standard of care.
Kidwell v. Hypertension Nephrology Associates shows the pattern. The plaintiff alleged Security Rule failures and a three-month notification delay. The claims she filed were negligence, negligence per se, breach of implied contract, unjust enrichment, and invasion of privacy. That settlement’s claim deadline was January 20, 2026.
Snooping cases follow a similar path. A family filed suit on July 23, 2026, in Kanawha Circuit Court in West Virginia. They allege a medical administrator accessed their records for years. Those are allegations, not findings.
A licensed attorney in your state can say which claims fit your facts. Time limits differ by state.
Common state-law theories:
- Negligence and negligence per se
- Breach of implied contract
- Unjust enrichment
- Invasion of privacy
How do you file a HIPAA complaint with OCR?
You file through the OCR Complaint Portal, generally within 180 days of when you knew about the violation. Anyone can file.
- Confirm the target is a covered entity or business associate.
- Write down what happened and when you found out.
- Count 180 days from the date you knew.
- Open the OCR Complaint Portal and choose the HIPAA option.
- Enter the organization’s name, address, and phone number.
- Explain how, why, and when the violation happened.
- Upload evidence, or mail the complaint form package.
- If you’re past 180 days, file anyway and explain the delay.
OCR may extend the window for good cause. Don’t assume you’re too late.
Complaints can also cover Part 2, the federal rule protecting substance use disorder records. OCR reviews each complaint and decides whether to act.
How do you file a claim in a health data breach settlement?
You file online or by mail with the settlement administrator, before the claim deadline, using your notice details. Each settlement sets its own rules.
- Find your notice and note the case name.
- Locate the official settlement website through a search.
- Confirm you fit the class definition.
- Write down the opt-out and claim deadlines.
- Gather receipts for any documented losses.
- Submit online, or mail a printed form.
- Save your confirmation.
- Decide whether to stay in or opt out.
Proof matters. It’s like returning an item without a receipt: you may get less, or nothing. Allen Memorial requires the LoginID and PIN from your notice for online claims.
Opting out has consequences. Highland Health’s statement says those who exclude themselves get no settlement benefits. They keep the right to pursue their own claims.
What evidence should you keep after a HIPAA violation?
Keep every date, notice, receipt, and response. Documentation is what turns a vague complaint into a usable one.
Record the date you discovered the problem. Note who you contacted and what they said back. Save the breach notice envelope and any letters.
For breach settlements, track costs tied to the incident. That can include credit freeze fees, replacement card costs, and fraud losses. Summit Medical allows a claim for up to three hours of lost time at $15 per hour.
Evidence checklist:
- Breach notice or privacy complaint response
- Dates you learned of the problem
- Receipts for out-of-pocket costs
- A log of time spent fixing the problem
- Names of anyone you spoke with
Key Takeaway: Whether you file with OCR or claim in a class settlement, the person with dated records and receipts is in the strongest position.
Can you go to jail for a HIPAA violation?
Yes, but only in criminal cases brought by the Justice Department, and only for knowing misuse of health information. Most HIPAA violations are never prosecuted.
| Offense | Maximum fine | Maximum prison |
|---|---|---|
| Knowingly obtaining or disclosing health information | $50,000 | 1 year |
| Doing so under false pretenses | $100,000 | 5 years |
| Intent to sell, transfer, or use for commercial gain or malicious harm | $250,000 | 10 years |
OCR can refer possible criminal cases to the Justice Department. The conduct usually involves intent, such as selling records or snooping for profit.
Ordinary mistakes don’t land here. A misdirected fax is a civil matter. Selling a celebrity’s chart is a crime.
Can your state attorney general sue over a HIPAA violation?
Yes. Since the HITECH Act, state attorneys general can bring civil actions on behalf of residents.
Reported statutory damages are up to $100 per violation, with a $25,000 annual cap per identical provision. Attorneys general may also pursue separate state-law claims.
You can contact your state attorney general’s office to report a problem. They aren’t your lawyer, and they don’t owe you a payout. Any recovery usually goes to the state.
Which health data breach settlements have open deadlines right now?
Three have open claim windows as of October 14, 2026: Highland Health, Summit Medical, and Allen Memorial. Check each official site before filing.
| Settlement | Opt-out / objection | Claim deadline | Final approval hearing |
|---|---|---|---|
| Highland Health Systems (July 2023 breach) | Sept. 28, 2026 (passed) | Oct. 28, 2026 | Nov. 30, 2026 |
| Summit Medical Group (Sept. 2024 breach) | Oct. 20, 2026 | Nov. 4, 2026 | Nov. 19, 2026 |
| Allen Memorial Hospital (July 2025 attack) | Oct. 13, 2026 (passed) | Nov. 12, 2026 | Dec. 7, 2026 |
Albany Gastroenterology’s opt-out deadline was August 21, 2026. Its claim deadline is not yet confirmed here.
Summit’s settlement caps cash claims at $500,000 in total. Amounts depend on claims filed. Highland’s benefit details are not yet confirmed in our sources, so check the official site.
Key Takeaway: Highland closes first on October 28, so check your mail for notices and verify them now.
Is the HIPAA Security Rule overhaul final yet?
No. The overhaul is still a proposal, and HHS has pushed final action to at least July 2027.
OCR published the proposal in the Federal Register on January 6, 2025. Final action had been targeted for May 2026. The rulemaking has since moved to long-term actions.
The current Security Rule stays in force and enforceable. If the overhaul is finalized as proposed, one law firm notes entities would get 240 days to comply.
A separate Privacy Rule update was slated for August 2026. We haven’t confirmed that it’s final. Like a delayed tax refund, the date keeps sliding, and nobody can say when it lands.
What changed in HIPAA in 2026?
Several things changed, but the biggest rewrite hasn’t happened yet. Here’s what’s confirmed:
- January 28, 2026: Inflation-adjusted penalty amounts took effect, with a $2,190,294 annual cap.
- February 16, 2026: HHS began civil enforcement of 42 CFR Part 2, the substance use disorder confidentiality rule. A Notice of Privacy Practices update was due the same day.
- Spring 2026: The Security Rule target date passed with no final rule.
- August 27, 2026: OCR announced its 55th right-of-access settlement.
- Late July 2026: OCR’s OSF settlement became its 21st ransomware action.
Enforcement hasn’t slowed. OCR also announced a March 5, 2026 settlement with business associate MMG Fusion. It announced an April 23, 2026 settlement with a self-funded employer health plan.
The pattern is clear. OCR settlements lean toward Security Rule and breach notification cases.
What counts as a HIPAA violation?
A HIPAA violation is any failure by a covered entity or business associate to follow the Privacy, Security, or Breach Notification Rules. The most common is unauthorized access to records.
Examples include:
- Snooping in a patient’s chart without a work reason
- Disclosing information without authorization
- Skipping a required risk analysis
- Missing a business associate agreement
- Delaying breach notices
- Refusing a patient access to their own records
OCR’s recent cases show the range. Its right-of-access initiative has produced 55 settlements. Ransomware cases usually cite risk analysis and security failures.
A violation isn’t automatically a lawsuit. It’s a legal finding by OCR, a court, or an agreement.
Who has to follow HIPAA?
Covered entities and business associates must follow HIPAA. That means health plans, clearinghouses, most providers that bill electronically, and vendors handling their data.
Business associates include software firms and administrators. MMG Fusion, a Maryland software company, settled as a business associate. Consociate Health did too, as a third-party administrator.
Employers aren’t automatically covered, but their health plans can be. OCR’s April 23, 2026 settlement involved a self-funded employer-sponsored plan. Star Group’s plan settled for $245,000.
If you’re unsure whether an organization is covered, file your OCR complaint anyway. OCR says to go ahead when you’re not sure.
Key Takeaway: If you can’t tell whether HIPAA applies, OCR’s own advice is to file the complaint and let it decide.
What happens next?
October 20, 2026: Summit Medical’s exclusion and objection deadline.
October 28, 2026: Highland Health claims close.
November 4, 2026: Summit Medical claims close.
November 12, 2026: Allen Memorial claims close.
November 19, November 30, and December 7, 2026: Final approval hearings for Summit, Highland, and Allen.
Frequently Asked Questions
Can I sue my doctor for violating HIPAA?
You can’t sue under HIPAA itself.
You may be able to bring a state-law claim, such as negligence or invasion of privacy.
Ask a licensed attorney in your state which claims fit.
How long do I have to file a HIPAA complaint?
Generally, you have 180 days from when you knew about the violation.
OCR may extend the deadline for good cause.
If you’re past 180 days, file anyway and explain why.
What is the maximum fine for a HIPAA violation in 2026?
The top annual cap is $2,190,294 per identical provision.
Tier 4 violations can run up to $2,190,294 per violation.
OCR applies lower caps to Tiers 1 through 3 under a 2019 policy.
Do I get money when OCR fines a hospital?
No. In OCR’s published agreements, the payment goes to HHS.
Patients don’t receive a share.
Can I get paid for a healthcare data breach?
You may qualify if you’re in a settlement class.
Reported payouts are up to $100 to $2,500 for documented losses.
Amounts depend on your proof and on the settlement terms.
Can I opt out of a data breach settlement and sue on my own?
You can opt out by the deadline.
Opting out means no settlement benefits.
You keep the right to pursue your own claims.
Is the HIPAA Security Rule update in effect?
No. It’s still only a proposal.
HHS has pushed final action to at least July 2027.
Check the official settlement website for any notice you received. Calendar the deadline, and gather receipts and your notice details now.
Highland Health’s claim deadline is October 28, 2026.
