Healthcare Data Breach: Your Rights, Who to Notify, and What You Can Actually Recover

If you received a breach notice from a hospital, clinic, insurer, or other HIPAA-covered entity, the notification itself is required by federal law: the HIPAA Breach Notification Rule (45 CFR §§ 164.400–414) requires covered entities and their business associates to notify affected individuals "without unreasonable delay" and no later than 60 days after discovering a breach of unsecured protected health information. For breaches affecting 500 or more people in a state or jurisdiction, the entity must also notify prominent media outlets and the HHS Secretary immediately; smaller breaches are reported to HHS annually.

What the notice does not give you is a lawsuit under HIPAA itself. Courts have consistently held — and HHS confirms — that HIPAA creates no private right of action; you cannot sue a hospital or insurer directly for "violating HIPAA." What you can do is file a complaint with the HHS Office for Civil Rights (OCR) within 180 days of when you knew about the act or omission (OCR can extend this for good cause). OCR investigates, and for serious or widespread violations can extract corrective action plans and civil monetary penalties — but those penalties go to the U.S. Treasury, not to you.

This gap between "notified" and "compensated" is the central thing to understand: your realistic path to money after a healthcare data breach almost never runs through HIPAA directly. It runs through state law, class action litigation, or — for EU/UK residents — data protection law that does create a direct right to compensation.

Several states fill the gap HIPAA leaves open with their own medical-privacy statutes that do create a private right of action. California's Confidentiality of Medical Information Act (CMIA), Civil Code § 56.36, is the best-known: it lets a patient sue a healthcare provider or plan directly, and allows nominal statutory damages (commonly cited around $1,000 per negligent violation, without needing to prove actual harm) plus actual damages, and up to a higher amount for willful violations, plus attorneys' fees. verify current dollar figures and the exact willful-violation cap against the current statute text before relying on a specific number. A May 2026 California Supreme Court decision clarified the standard for what counts as a compensable CMIA breach in the data-breach context — check current case law if you are relying on this route. Other states have their own, narrower medical-privacy statutes; whether your state gives you an equivalent private right of action is state-specific and needs individual confirmation. verify state-by-state

Separately, many health apps, wearables, and direct-to-consumer services (period trackers, fitness apps, at-home test kits) are not HIPAA-covered entities at all, because they don't sit inside the traditional provider/insurer/clearinghouse relationship HIPAA regulates. The FTC's Health Breach Notification Rule — substantially amended in 2024, with the amendments effective July 29, 2024 — fills part of that gap: it requires vendors of "personal health records" and connected health apps/devices that are not HIPAA-covered to notify affected consumers, the FTC, and (for large breaches) the media, on a similar "without unreasonable delay, no later than 60 days" timeline. Like HIPAA, this FTC rule is enforced by the government, not by an individual lawsuit — the FTC can pursue penalties and injunctive relief, but again does not put money directly in your pocket through the rule itself.

If you are in the EU or UK, GDPR gives you something HIPAA does not: Article 82 creates a direct right to compensation from the controller (the healthcare provider, insurer, or app) for material or non-material damage caused by a breach of the GDPR, including a data breach. The Court of Justice of the EU has clarified there is no minimum-severity threshold — well-founded fear of future misuse of your data can itself count as compensable non-material damage — but you still need to show an actual breach, actual damage, and a causal link; compensation is meant to make you whole, not to punish the controller. You can also complain to your national data protection authority (the ICO in the UK) at no cost, in parallel with or instead of a civil claim.

Not every breach triggers a notification duty. If the exposed data was properly encrypted or otherwise rendered "unsecured" only in a way that meets the HHS/NIST safe-harbor standard, it may not count as a reportable breach under HIPAA at all — you may never receive a notice even though a security incident occurred, because the law treats properly-secured data differently from readable data.

Many entities that feel like "healthcare" companies are not HIPAA-covered entities or business associates — a wellness app that never bills insurance or works with a provider, for instance — so a breach there falls to the FTC rule (if it applies) or general state consumer-protection and data-breach-notification law instead, not HIPAA. Don't assume HIPAA applies just because health information was involved.

Class action settlements arising from a large breach are common but are a different track from an individual OCR complaint or state private-right-of-action claim — check any settlement notice carefully for claim deadlines and whether accepting a settlement payment requires you to release other claims.

An HHS OCR complaint can lead to a meaningful corrective-action plan or penalty against a healthcare organization with a documented pattern of failures, but it is not a mechanism for individual compensation — treat it as a regulatory-pressure tool, not a payout.

State private-right-of-action claims (where they exist, like California's CMIA) can produce real statutory damages without needing to prove financial loss, but availability, dollar amounts, and procedural requirements vary sharply by state and by the specific facts of the breach — this is not a one-size-fits-all right.

Class action settlements from large breaches often pay a modest flat amount (commonly well under a few hundred dollars) unless you can document actual, provable losses like fraud-related costs, in which case some settlements offer a higher documented-loss tier.

GDPR Article 82 claims are genuinely individualized: courts weigh the seriousness of the breach and the reality of your fear or harm, and outcomes vary considerably by country and by the specific facts.