Blog

Why HIPAA compliance matters (and what happens when it's ignored)

September 30, 2026 · 25 min read

A lot of the businesses we build MadeTo for handle health information without thinking of themselves as “healthcare.” A compounding pharmacy knows it is. A custom orthotics shop billing Medicare knows it is. But a personalized supplement brand that asks customers about their allergies, medications and goals before it formulates anything is holding health data too, and so is the dental lab working from a dentist’s prescription, and the shop making compression garments to a patient’s measurements.

This post is about why the rules around that data matter. Not in the abstract “compliance is important” sense, but in the sense of what has actually happened to real businesses, most of them a lot smaller than a hospital, when a single control was missing. We went to the official sources first (the HHS Office for Civil Rights, the Federal Register, the statute itself, the FTC) and then to the court records, settlements and news coverage of the cases. Sources are linked throughout and collected at the end.

One caveat before we start: we’re a software company, not your lawyer. Whether and how HIPAA applies to you depends on specifics, and this post is a map, not legal advice.

The short version

• The fine is rarely the worst part. Since 2003, HHS’s Office for Civil Rights has collected only about $144 million across roughly 150 HIPAA settlements and penalties. The businesses that were destroyed by a breach were mostly destroyed by what came after it: ransomware that wiped their records, customers who left, notification costs, state lawsuits, and bankruptcy.
• The numbers keep going up. By our count of HHS’s public breach portal, 2025 set a record with 804 reported breaches of 500 or more health records, more than two a day. More than 80% of them were hacking incidents, not lost laptops.
• Vendors are in the blast radius. Since 2013, the companies that store or process health data for healthcare providers are directly liable under HIPAA. In 2023 through 2025, breaches reported by those vendors accounted for most of the people affected.
• “Not covered by HIPAA” doesn’t mean “not regulated.” A direct-to-consumer health brand that never bills insurance can still end up in front of the FTC or a state attorney general, and in Washington State, in front of a court where its own customers are the plaintiffs.
• Small businesses get hit. Solo dentists, a single-location compounding pharmacy and a two-doctor hearing practice all appear in the stories below.

What HIPAA actually is

HIPAA is a 1996 federal law, but the part most people mean when they say “HIPAA compliance” is a set of rules HHS wrote under it, collected in 45 CFR Parts 160 and 164. There are four of them:

• The Privacy Rule says who can use or share protected health information (PHI) and what rights patients have over it, like getting a copy of their records.
• The Security Rule requires administrative, physical and technical safeguards for electronic health information, starting with an honest assessment of where your risks actually are.
• The Breach Notification Rule says who you have to tell when something goes wrong, and how fast.
• The Enforcement Rule covers investigations and penalties.

HIPAA doesn’t apply to everyone who touches health data. It applies to covered entities (health plans, healthcare clearinghouses, and healthcare providers who send health information electronically for standard transactions such as insurance claims) and to their business associates, the vendors that create, receive, store or transmit PHI on their behalf.

That second group matters a lot. The 2009 HITECH Act and HHS’s 2013 Omnibus Rule made business associates directly liable for complying with the Security Rule, which means a software vendor, a billing company or an IT contractor can be investigated and fined on its own. HHS’s cloud computing guidance is blunt about it: a cloud provider storing health data is a business associate even if everything it stores is encrypted and it doesn’t hold the key. The only exception, for “conduits” like the postal service, covers transmission, never storage.

One more thing worth knowing: there is no official HIPAA certification. HHS doesn’t recognize private “HIPAA certified” badges, and they don’t take anything off your legal obligations. When a vendor says it’s “HIPAA certified,” it’s telling you something about its marketing, not about the law.

Does HIPAA apply to you?

For made-to-order health businesses, the answer usually turns on how you get paid, not on what you make. HIPAA’s definition of healthcare includes selling a drug, device or other item under a prescription, but a provider only becomes a covered entity when it transmits health information electronically in connection with a standard transaction, such as a claim. CMS puts it simply: providers who submit HIPAA transactions, like claims, electronically are covered, and it publishes a decision tool for checking.

That means two shops making the same custom orthotic can be in completely different positions: the one billing insurance is covered, the one selling for cash isn’t. Roughly:

Where HIPAA stops, the FTC and the states start

If you’re a cash-pay, direct-to-consumer brand, HIPAA probably doesn’t apply to you. That’s where many of our own first customers sit, and it’s the part of this topic that gets missed most often.

The FTC’s Health Breach Notification Rule covers companies outside HIPAA that hold personal health records, including apps and services that pull health data from more than one source. Since amendments that took effect in July 2024, a “breach” includes sharing data without authorization, for example through advertising pixels, not just getting hacked. Penalties run up to $53,088 per violation.

States have gone further. Washington’s My Health My Data Act, in force since 2024, has no minimum business size, reaches out-of-state businesses serving Washington residents, counts information inferred from purchases as health data, and requires separate opt-in consent to collect it and to share it. Violations count as violations of the state’s Consumer Protection Act, which means consumers can sue. Nevada and Connecticut have passed their own consumer health data laws. In practice, an order line that reads “formulation for thyroid support” can be regulated health data even though no doctor or insurer was ever involved.

What it costs, on paper

HHS adjusts HIPAA’s civil penalties for inflation every year. The current amounts took effect on January 28, 2026:

The regulation caps penalties at $2,190,294 per year for each provision violated, and a single incident often violates several. Since 2019, HHS has applied lower annual caps to the three less serious tiers as a matter of enforcement discretion.

Then there’s the criminal side. Under 42 U.S.C. 1320d-6, knowingly obtaining or disclosing health information in violation of HIPAA carries up to $50,000 and a year in prison; doing it under false pretenses, up to $100,000 and five years; doing it to sell the data or for personal gain or malicious harm, up to $250,000 and ten years. That applies to individual employees, not just their employers.

State attorneys general can also bring HIPAA cases themselves, and they increasingly pair them with their own state consumer protection and data security laws, which have bigger teeth.

And if you do have a breach, the clock starts: affected individuals must be notified without unreasonable delay and within 60 days of discovery. Breaches affecting 500 or more people also go to HHS within those 60 days, and to the media if more than 500 residents of one state are affected. Vendors must tell their healthcare clients within the same window. HHS then posts every one of those large breaches on a public website, with the business’s name on it.

What it costs in real life

That penalty table is the part everyone quotes, and it’s the least useful part. OCR’s actual fines are often five figures. The breach costs are something else: in IBM’s annual study, healthcare has been the most expensive industry for a data breach every year for more than a decade, with an average of $6.64 million per breach in its 2026 report. A small business won’t see a bill that size, but it also won’t have the balance sheet to absorb even a fraction of it.

The trend isn’t helping. Our tally of HHS’s breach portal (every breach of 500 or more records, by the year it was reported):

The 2024 figure is dominated by one breach, which is where the stories start.

The horror stories

One login without two-factor authentication: Change Healthcare, 2024

Change Healthcare processes a huge share of American insurance claims and pharmacy transactions. In February 2024, attackers logged into a Citrix remote-access portal with stolen credentials. The portal, as UnitedHealth’s CEO told the Senate, didn’t have multi-factor authentication turned on, despite company policy.

What followed is the largest health data breach in US history: 192.7 million people. UnitedHealth paid a $22 million ransom, reported $3.09 billion in 2024 costs from the attack, and advanced more than $9 billion in loans to providers whose payments had stopped. Pharmacies and practices that had never heard of Change Healthcare couldn’t process prescriptions or get paid for weeks. Nebraska’s attorney general is suing under state law.

The lesson for a ten-person business isn’t about scale. It’s that one missing checkbox on one login page was enough.

A $6,500 ransom that closed a hearing practice

In 2019, ransomware hit Brookside ENT and Hearing Center in Battle Creek, Michigan. It deleted and overwrote every medical record, bill and appointment, and the backups with them. The attackers asked for $6,500. The practice’s two physicians refused to pay, decided to retire early, and closed the practice on April 30, 2019.

That same year, Wood Ranch Medical in Simi Valley, California lost its records and backup drives to a ransomware attack and closed permanently in December, notifying 5,835 patients.

Neither practice was fined, as far as we could find. They didn’t need to be. The missing control was a backup the attackers couldn’t reach.

The vendor that went bankrupt: AMCA

The American Medical Collection Agency collected unpaid bills for labs including Quest Diagnostics and LabCorp. For roughly eight months in 2018 and 2019, attackers sat inside its payment system. When it came out, its biggest clients dropped it, it spent millions mailing breach notices, and it filed for Chapter 11 bankruptcy in June 2019. Forty-one state attorneys general later imposed a $21 million penalty, suspended only because AMCA couldn’t pay it.

The liability didn’t stop at the vendor. LabCorp reached a $35 million class action settlement over AMCA’s breach, and on September 24, 2026, 44 attorneys general settled with LabCorp for about $2.3 million, calling data security “a non-delegable duty.” In plain terms: if your vendor loses your customers’ data, it’s still your problem.

A compounding pharmacy and an open container

Cornell Prescription Pharmacy was a single-location pharmacy in Denver specializing in compounded medications. Unshredded paperwork with the health information of 1,610 patients was found in an unlocked, open container on its premises. OCR found the pharmacy had no written policies and had never trained its staff. It paid $125,000.

It wasn’t the first pharmacy undone by its trash. CVS paid $2.25 million in 2009 and Rite Aid paid $1 million after TV news crews found labeled pill bottles and prescription records in open dumpsters.

The dentists who replied to their reviews

Replying to a bad online review is an instinct almost every small business owner has. For a healthcare provider, confirming someone was a patient and then arguing about their treatment in public is a disclosure of health information.

A Dallas dental practice, Elite Dental Associates, paid $10,000 in 2019 after its Yelp replies included patients’ names and treatment details. New Vision Dental paid $23,000 in 2022 for the same thing, and New Jersey’s Manasa Health Center paid $30,000 in 2023.

Ignoring a customer can be just as costly as arguing with one. Gums Dental Care, a solo practice in Maryland, took three years to give a patient a copy of their records and was hit with a $70,000 penalty in 2024. Patients have a legal right to their records, and OCR has brought more than 50 cases on that point alone.

X-rays traded for silver, with no contract in place

Raleigh Orthopaedic Clinic in North Carolina handed about 17,300 patients’ x-ray films to a company that offered to digitize them in exchange for the silver it could recover from the film. There was no business associate agreement, the contract HIPAA requires before a vendor gets access to patient data. The clinic paid $750,000.

It’s the least technical story on this list and one of the most expensive. The problem wasn’t a hacker, it was a missing piece of paper.

Eight inboxes at a direct-to-patient supplier

Solara Medical Supplies ships diabetes supplies like continuous glucose monitors and insulin pumps directly to patients. A phishing attack compromised eight employee email accounts, exposing information on 114,007 people, including some Social Security numbers and payment card details. In January 2025, Solara paid $3 million, the largest OCR settlement of the year.

A company that ships health products to people’s doors is exactly the shape of business MadeTo is built for, which is why this one stuck with us.

A laptop left in a car

CardioNet, a heart monitoring company, had a laptop with 1,391 patients’ information stolen from an employee’s car. The laptop wasn’t encrypted, and OCR found the company’s security policies were still in draft form. CardioNet paid $2.5 million in 2017. Encryption matters for a second reason here: a lost device that’s properly encrypted generally isn’t a reportable breach at all.

The employees who sold patient data

HIPAA’s criminal provisions are aimed at people, and the people who get prosecuted are usually insiders with legitimate access. A Tampa General Hospital employee, Shanakia Benton, was sentenced to three years in federal prison after patient data she took was used to file false tax returns. At Methodist Hospital in Memphis, five employees pleaded guilty to criminal HIPAA violations in 2023 after selling lists of accident victims to someone who passed them on to personal injury lawyers.

Even when nobody is prosecuted, insider snooping costs money. A Walgreens pharmacist looked up the prescription history of her husband’s ex-girlfriend and shared it. The result was a $1.44 million jury verdict against Walgreens under Indiana negligence law, upheld on appeal in 2014, despite HIPAA itself not letting individuals sue.

Ad pixels and postcards: the FTC cases

For direct-to-consumer health companies, the FTC has been the enforcer to watch, and its cases are mostly about marketing tools, not hackers.

• GoodRx paid $1.5 million in 2023, the first penalty ever under the Health Breach Notification Rule, for sharing users’ health information with Facebook, Google and others.
• BetterHelp paid $7.8 million the same year for sharing health data for advertising.
• Cerebral, a telehealth company, settled in 2024 after its tracking pixels sent names, prescriptions and insurance information on nearly 3.2 million people to LinkedIn, Snapchat and TikTok. The FTC also cited postcards Cerebral mailed that could reveal patients’ diagnoses to anyone who saw them. The order banned it from using or disclosing sensitive health data for advertising.

That postcard detail is worth sitting with if you ship health products. What’s printed on the outside of a package, from the return address to the product name on a label, is visible to everyone who handles it.

$5,000, and two years of federal monitoring

Recent OCR cases often come with surprisingly small checks. Vision Upright MRI, a small imaging provider, left a server of medical images exposed to the internet, affecting more than 21,000 people, and had never done a risk analysis. It paid $5,000 in 2025.

The check is the easy part. Settlements like this one come with a corrective action plan, typically two years of OCR monitoring, with policies to write, reports to file and a federal agency reviewing your work. In 2025, 16 of OCR’s 21 enforcement actions cited a failure to do a proper risk analysis, and OCR has run a dedicated enforcement initiative on exactly that since late 2024.

What the stories have in common

Almost none of these started with a sophisticated attack on a well-defended system. They started with something ordinary:

• One login without two-factor authentication (Change Healthcare).
• Backups the attackers could reach (Brookside, Wood Ranch).
• A phishing email (Solara, and Anthem’s $16 million settlement before it).
• Paperwork in the trash (Cornell, CVS, Rite Aid).
• A reply to a review (the dental practices).
• A vendor without a contract (Raleigh Orthopaedic).
• An unencrypted laptop (CardioNet).
• A marketing pixel (GoodRx, BetterHelp, Cerebral).
• No risk analysis, the finding in almost every recent OCR case.

Most of those are cheap to fix. None of them are cheap once they’ve happened.

What you can do about it

Whether you’re a covered entity, a vendor, or a direct-to-consumer brand outside HIPAA, the same basics cover most of the ground:

1. Do a risk analysis, and write it down. Figure out where health data lives in your business, who can reach it and what could go wrong. HHS and ONC publish a free Security Risk Assessment Tool aimed at small practices.
2. Turn on two-factor authentication everywhere, starting with email, remote access and anything with admin rights.
3. Keep backups attackers can’t reach: offline, or immutable, and tested.
4. Get a business associate agreement from every vendor that touches patient data if you’re a covered entity, and check that your vendors have them with their own vendors. If you’re outside HIPAA, you still want contracts that limit what vendors can do with your customers’ data.
5. Stop running orders through personal email, text messages and shared spreadsheets. Give everyone their own login. Shared logins make it impossible to know who saw what.
6. Encrypt laptops and phones.
7. Shred paper, and think about your trash. Labeled bottles and printed orders are health records.
8. Never discuss a customer’s health or purchase in a public reply, no matter how unfair the review.
9. Answer records requests promptly if you’re a covered entity.
10. Keep ad and analytics pixels off pages where people enter health information, including order forms, intake questionnaires and account pages.
11. Look at your packaging from the outside. Neutral return addresses and labels don’t announce anyone’s condition.
12. Write a breach response plan before you need one, so the 60-day clock doesn’t start while you’re still figuring out who to call.

None of that requires a compliance department. Most of it is a week of focused work and a few habits.

What’s coming

HHS proposed a major overhaul of the HIPAA Security Rule in January 2025. It would make encryption and multi-factor authentication mandatory rather than “addressable,” require an inventory of every system that touches health data, require the ability to restore systems within 72 hours, and require healthcare organizations to get written confirmation of their vendors’ safeguards every year. As of September 2026 it’s still a proposal. The federal regulatory agenda targets a final rule in July 2027, and industry groups have pushed back. But it shows clearly where regulators think the baseline should be, and most of what it would require is already showing up as findings in enforcement cases today.

How we think about this at MadeTo

MadeTo holds orders, and for a lot of the businesses we’re building it for, an order carries health information: a formulation built from an intake questionnaire, a prescription, a set of measurements. So compliance isn’t a feature we can add later; it has to be how the product works from the start. What’s already built:

• Every business’s data is walled off at the database level, not just in application code, so a bug in one query can’t expose another customer’s records.
• Sensitive fields are encrypted, and access to them is controlled by role.
• Changes to sensitive records are recorded, and so are views of them, so “who saw this, and who changed it?” has an answer.
• Two-factor authentication is required for every account.
• Our own public site runs cookieless analytics and no advertising pixels.

HIPAA’s requirements for business associates are the baseline we build against, and the FTC and state rules for direct-to-consumer health brands shape how we handle consent and data sharing for businesses outside HIPAA. We won’t tell you MadeTo is “HIPAA certified,” because no such thing exists. We’d rather show you how it works.

If you run a made-to-order business that handles health information and this is the kind of thing that keeps you up at night, join the waitlist below. We’d like to hear what you’re dealing with.

Sources

Primary sources:

• 45 CFR 160.103, definitions of covered entity and business associate and 45 CFR 164.504, business associate contract requirements
• 42 U.S.C. 1320d-5, civil penalties and state attorney general enforcement and 42 U.S.C. 1320d-6, criminal penalties
• HHS civil monetary penalty inflation adjustment, January 28, 2026 (91 FR 3665)
• HHS notice of enforcement discretion on penalty caps, April 2019
• HIPAA Security Rule proposed rule, January 2025 and its regulatory agenda entry
• HHS Breach Notification Rule, cloud computing guidance and breach portal (breach counts above are our own tally of the portal’s full export as of September 30, 2026)
• CMS covered entity guidance
• FTC Health Breach Notification Rule guidance
• Washington Attorney General on the My Health My Data Act
• UnitedHealth Group 2024 annual report (Form 10-K)

Case sources are linked in each story above: HHS resolution agreements and press releases, Department of Justice and FTC press releases, state attorney general releases, and news coverage from Becker’s Hospital Review, HIPAA Journal, KrebsOnSecurity, CBS News and The Record.