10 Common HIPAA Compliance Gaps (And How to Address Them)

Author Nicole Statley at Healthcare Compliance Pros

HIPAA compliance gaps are not always obvious. An organization may have policies, employee training, and security tools in place but still overlook an outdated vendor agreement or a patient records request that never reached the right person.

These gaps can develop as organizations add technology, change workflows, or bring on new employees. Finding them early gives healthcare teams an opportunity to make corrections before patient information is exposed or a complaint leads to an investigation.

The focus should be prevention. This guide covers 10 recurring HIPAA compliance gaps, examples of how they appear in everyday operations, and practical steps to address them.

This is not an official federal ranking. A gap also does not automatically establish a HIPAA violation. The circumstances and applicable requirements matter.

Why Addressing HIPAA Gaps Matters in 2026

A compliance program needs more than completed forms. Policies must match actual operations, employees need usable instructions, and identified risks need follow-through.

Unresolved gaps can contribute to unauthorized disclosures, delayed patient access, and disruptions in care. They can also lead to regulatory scrutiny. HHS resolution agreements may require policy revisions, training, corrective actions, and ongoing compliance reporting.

Two updates to keep in mind

As organizations review their programs in 2026, it is important to separate current requirements from proposed changes:

Security Rule changes remain proposed. HHS states that the current HIPAA Security Rule remains in effect during rulemaking. Proposed requirements should not be presented as existing obligations.
Penalties did not receive an additional 2026 inflation adjustment. HHS published adjusted amounts in January 2026 using the 2025 inflation adjustment. Its October 21, 2026 notice confirmed there would be no additional adjustment for 2026.

The 10 Common HIPAA Compliance Gaps

1. Risk analyses that do not cover the full organization

A security risk analysis can miss important information when it focuses only on the electronic health record system.

HHS expects an accurate and thorough assessment of risks to electronic protected health information, or ePHI. That includes information created, received, maintained, or transmitted across the organization's environment.

Example: A practice reviews its EHR but overlooks patient documents stored in shared folders, cloud applications, and mobile devices.

How to address the gap:

Identify where ePHI is stored and how it moves.
Include remote work, vendors, devices, and backups.
Document threats, vulnerabilities, and existing safeguards.
Assign corrective actions and track completion.
Revisit the analysis when systems, operations, or risks change.

An assessment is useful only when the organization also manages the risks it identifies.

2. Missing or incomplete business associate agreements

Organizations sometimes share PHI with a vendor before checking whether a business associate agreement, or BAA, is required.

A standard service contract or confidentiality clause may not satisfy HIPAA. Required BAAs must address matters such as permitted uses, safeguards, and reporting obligations. Certain HIPAA requirements also apply directly to business associates.

Example: A billing company receives patient information while the practice assumes the vendor's standard contract includes all required HIPAA provisions.

How to address the gap:

Maintain a list of vendors that handle PHI.
Determine which relationships require a BAA.
Execute required agreements before sharing PHI.
Check for required provisions and appropriate reporting terms.
Reassess agreements when services or requirements change.

An older agreement is not automatically inadequate. Review its content and whether it still fits the relationship.

3. Unclear disposal procedures for paper and electronic PHI

Disposal can become a weak point when employees do not know what belongs in secure containers or how to handle retired devices.

The risk is not limited to medical charts. Labels, printed schedules, storage drives, and other materials may contain PHI.

Federal enforcement example: New England Dermatology paid $300,640 and agreed to corrective action to resolve an OCR investigation involving improper disposal of PHI.

How to address the gap:

Provide secure containers for paper PHI.
Restrict access to materials awaiting destruction.
Establish procedures for sanitizing or destroying electronic media.
Evaluate disposal vendors and required agreements.
Document disposal activities as appropriate.

Disposal procedures should explain what employees must do, not simply tell them to "dispose securely."

4. Patient access requests without reliable tracking

A records request can be delayed when no one owns the process or knows who provides backup coverage.

Covered entities generally must act on an individual's access request within 30 calendar days. One additional 30-day extension is permitted when the required written explanation and completion date are provided within the initial period.

Example: A request remains in an employee's inbox during an extended absence.

How to address the gap:

Log requests when received.
Assign a responsible employee and backup.
Track deadlines and escalate approaching due dates.
Document permitted extensions.
Review applicable state access requirements.

Treat the federal deadline as an outside limit, not a standard waiting period. Complete requests sooner when possible.

5. Access permissions that no longer match job responsibilities

Employee access can become excessive over time. Staff may change roles, retain old permissions, or continue using shared accounts.

The Security Rule requires access controls and safeguards for systems containing ePHI. It also addresses workforce access and review of system activity.

Example: An employee moves from billing to scheduling but keeps access needed only for the previous role.

How to address the gap:

Assign unique user accounts.
Match permissions to current responsibilities.
Review access after transfers and promotions.
Remove access promptly when employment ends.
Review relevant system activity.
Evaluate stronger authentication based on identified risks.

Multifactor authentication can strengthen security. However, organizations should distinguish recommended safeguards and risk-based decisions from requirements in a proposed rule.

6. Breach response plans that do not separate notification deadlines

An organization may have an incident response plan but lack a clear process for determining who must be notified and when.

For breaches requiring individual notification, covered entities must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Sixty days is a maximum, not an automatic waiting period.

HHS reporting follows different schedules:

Breaches affecting 500 or more individuals generally must be reported without unreasonable delay and within 60 days of discovery.
Breaches affecting fewer than 500 individuals must be reported within 60 days after the end of the calendar year in which they were discovered.

How to address the gap:

Escalate suspected incidents immediately.
Record discovery dates.
Evaluate individual, HHS, media, and contractual obligations.
Track each applicable deadline.
Include state-law review in the response process.

7. Security safeguards that have not been tested or maintained

Security tools can create a false sense of confidence when no one checks whether they work.

The Security Rule requires reasonable and appropriate administrative, physical, and technical safeguards. It also addresses security incidents and contingency planning.

Example: A practice has backups but has never tested whether it can restore the information needed to resume operations.

How to address the gap:

Maintain an inventory of systems and devices.
Establish a process for security updates.
Protect backups and test restoration.
Review security alerts and system activity.
Document decisions about encryption and other addressable safeguards.

Under the current rule, "addressable" does not mean optional without evaluation. Organizations must assess the safeguard and document the required decision-making.

8. Training that does not reflect employees' actual work

General training may explain HIPAA terminology without showing employees what to do when a real situation occurs.

Covered entities must train workforce members on relevant privacy policies and procedures. Training obligations include new workforce members and employees affected by material policy changes. The Security Rule also requires a security awareness and training program.

Example: Front-desk employees complete training but do not know how to route a records request or report a misdirected email.

How to address the gap:

Include role-specific examples.
Train new employees within a reasonable period.
Address relevant material policy changes.
Reinforce incident reporting and phishing awareness.
Document completion and follow up on missed training.

Annual refreshers can be useful, but HIPAA does not establish one universal annual training deadline for every topic.

9. Communication tools that have not been evaluated

Email and texting are not automatically prohibited under HIPAA. Problems arise when organizations do not evaluate how PHI is transmitted, accessed, or stored.

HHS permits providers to communicate with patients by email when reasonable safeguards are applied. Electronic communications must also be evaluated under applicable Security Rule requirements.

Example: An employee sends a patient image through a personal messaging account that the organization has not reviewed.

How to address the gap:

Identify approved communication methods.
Evaluate access, storage, and security settings.
Confirm recipients before sending information.
Establish personal-device procedures.
Obtain BAAs from vendors when required.
Create a process for patient requests involving unencrypted communications.

An approved application still needs appropriate configuration and staff instructions.

10. Written policies that no longer match operations

Policies can fall behind when organizations add locations, introduce remote work, or change vendors.

The Privacy Rule requires covered entities to implement appropriate policies and procedures. Required documentation generally must be retained for six years from creation or the date it was last in effect, whichever is later. Security Rule documentation requirements also apply.

Example: Staff work remotely, but the organization's policies address only information handled inside the office.

How to address the gap:

Assign policy owners.
Review policies when operations or requirements change.
Include remote work, vendor oversight, and incident response.
Make current instructions easy to find.
Retain required documentation and prior versions.

The six-year HIPAA documentation requirement is not a universal medical-record retention period.

A Practical HIPAA Gap Review Checklist

Organizations do not need to address every finding at once. Start with active risks and time-sensitive obligations.

Review period	Suggested priorities
This week	Check pending access requests, former-employee accounts, and incident-reporting contacts.
This month	Review BAAs, training records, communication tools, and policy gaps.
Next phase	Update the risk analysis and prioritize corrective actions.
Ongoing	Verify that completed actions resolved the underlying issue.

These are suggested management checkpoints, not federal deadlines.

For each finding, record:

The issue and affected process.
The person responsible.
The target completion date.
Interim safeguards, when needed.
Evidence of correction and follow-up.

HIPAA Gaps and Potential Regulatory Exposure in 2026

A gap assessment is not a penalty determination. Findings need to be evaluated against applicable requirements and the organization's circumstances.

The following indicators are suggested review priorities, not official OCR risk ratings.

Gap category	Priority indicator	Potential concern if unresolved
Incomplete risk analysis or safeguards	🔴 High	Unidentified or unmanaged risks to ePHI
Missing required BAA	🔴 High	PHI handling without required contractual protections
Insecure disposal or communications	🔴 High	Unauthorized access or disclosure
Unreliable access-request process	🟠 Time-sensitive	Delayed patient access
Unclear breach reporting process	🔴 Deadline-critical	Missed notification obligations
Outdated training or policies	🟠 Foundational	Inconsistent practices and repeated errors

HIPAA does not assign a fixed fine to each gap. Under the schedule published in January 2026, civil penalties begin at $145 per violation in the lowest culpability tier. Higher amounts and annual limits depend on the applicable tier, circumstances, and enforcement discretion. No additional 2026 inflation adjustment was applied.

How Healthcare Compliance Pros Can Help

Healthcare Compliance Pros can support organizations with risk assessments, employee training, policy development, audits, and remediation planning.

The goal is to connect those services to daily operations:

Turn assessment findings into assigned corrective actions.
Match training to employee responsibilities.
Align policies with current workflows.
Maintain documentation showing progress.
Follow up to confirm improvements are working.

A focused gap review can help an organization understand where it stands and build a manageable plan for improvement.

This article provides general compliance information, not legal advice. Consult qualified counsel for complex incidents, reporting decisions, and questions involving federal and state requirements.

Frequently Asked Questions About HIPAA Compliance Gaps

Is a HIPAA gap the same as a HIPAA violation?

No. "Gap" describes an identified weakness or potential shortfall, not a formal legal finding. Some gaps may reflect noncompliance, while others identify opportunities to strengthen practices. The applicable requirement and facts determine the distinction.

Does HIPAA require an annual risk assessment?

The current Security Rule does not set one universal annual schedule. Organizations need an accurate, thorough risk analysis and appropriate ongoing review. An annual review can be useful, but significant changes may require attention sooner.

Can a HIPAA gap exist without a breach?

Yes. Missing required documentation, inadequate safeguards, or an incomplete risk analysis may raise compliance concerns even when no disclosure has been identified. A breach and a compliance deficiency are different issues.

Is every privacy incident reportable?

No. Organizations must evaluate the event under the Breach Notification Rule. An impermissible use or disclosure is generally presumed to be a breach unless an exception applies or a documented assessment demonstrates a low probability that PHI was compromised.

Do small practices need to review these gaps?

Yes. The Security Rule allows flexibility based on factors such as size, complexity, capabilities, and risk. Small size does not eliminate applicable compliance obligations.

Should state requirements be included in a HIPAA gap review?

Yes. Include a separate review of applicable state requirements rather than assuming HIPAA resolves every question. Consult qualified counsel when privacy, access, retention, or notification requirements overlap.

Sources

HHS, Guidance on Risk Analysis. Explains the scope of a security risk analysis and the importance of ongoing evaluation.hhs
HHS, Summary of the HIPAA Security Rule. Covers administrative, physical, and technical safeguards, access controls, training, contingency planning, and documentation.hhs
HHS, Business Associates. Explains business associate relationships and agreement requirements.hhs
HHS, Covered Entities and Business Associates. Describes which organizations are subject to HIPAA.hhs
HHS, New England Dermatology settlement. Provides the enforcement example involving improper disposal of PHI.hhs
HHS, Timeliness of Responses to Individuals' Requests for Access. Explains the 30-day access deadline and permitted extension.hhs
HHS, Breach Notification Rule. Explains breach assessment and individual, media, and business associate notification requirements.hhs
HHS, Submitting Notice of a Breach to the Secretary. Explains HHS reporting schedules for breaches affecting fewer than 500 individuals and those affecting 500 or more.hhs
eCFR, 45 CFR § 164.530, Administrative Requirements. Covers Privacy Rule training, policies, procedures, and documentation retention.ecfr
HHS, Email Communications with Patients. Explains the use of email with reasonable safeguards.hhs
HHS, HIPAA Security Rule Notice of Proposed Rulemaking. Distinguishes proposed changes from the current Security Rule.hhs
Federal Register, Annual Civil Monetary Penalties Inflation Adjustment, January 28, 2026. Provides the adjusted civil monetary penalty schedule.federalregister
Federal Register, No Adjustment to HHS Civil Monetary Penalty Amounts for 2026, October 21, 2026. Confirms no additional 2026 inflation adjustment.federalregister
Federal Register, Notification of Enforcement Discretion Regarding HIPAA Civil Money Penalties. Explains HHS's policy concerning cumulative annual penalty limits for certain culpability tiers.federalregister
HHS, Resolution Agreements. Provides federal settlement agreements and associated corrective action requirements.