A patient bill of rights violation happens when a hospital, doctor, nursing home, or insurer breaks one of the legally enforceable protections a patient is entitled to — most often privacy under HIPAA, emergency care under EMTALA, informed consent, access to your own medical records, or freedom from abuse and discrimination in a Medicare-funded facility. There is no single federal Patient Bill of Rights statute; instead, a patchwork of federal laws, Medicare regulations, and state statutes creates the rights, and different agencies enforce different pieces. Where you report a violation, and what the penalty looks like, depends entirely on which right was broken.
What Counts as a Violation
Not every disappointing experience with a provider is a legal violation. The rights that carry enforcement teeth come from specific sources:
- HIPAA, for privacy of your health information and your right to get copies of your records.
- EMTALA, for emergency screening and stabilization regardless of ability to pay.
- The Affordable Care Act, for insurance protections like guaranteed coverage, appeals, and emergency care without prior authorization.
- Medicare Conditions of Participation (42 CFR 482.13 for hospitals, 42 CFR Part 483 for nursing homes), for dignity, safety, restraint limits, and participation in care decisions.
- State patient bill of rights statutes, which vary widely in what they cover and whether patients can enforce them in court.
- Common-law informed consent doctrine, enforced through malpractice lawsuits.
A useful reference point: the rights articulated in the 1997 report of the Advisory Commission on Consumer Protection and Quality in the Health Care Industry — informed consent, privacy, the right to refuse treatment, freedom from discrimination, emergency care access, and the right to complain without retaliation.1U.S. Office of Personnel Management. Patients’ Bill of Rights Those principles guide federal health programs, but the enforceable version of each right lives in a specific statute or regulation.
Privacy and Medical Records Violations (HIPAA)
HIPAA is the workhorse of patient rights enforcement. The Department of Health and Human Services Office for Civil Rights has received more than 374,000 complaints since 2003, resolved over 370,000 of them, collected nearly $145 million in civil penalties and settlements, and referred more than 2,400 cases to the Department of Justice for criminal prosecution.2U.S. Department of Health and Human Services. Enforcement Highlights Hospitals, private practices, pharmacies, and group health plans are the most frequently cited entities.
What Triggers a HIPAA Violation
The categories OCR sees most often are impermissible uses and disclosures of protected health information, inadequate safeguards, and failures to give patients timely access to their own records. Real cases show the range:
- A UCLA Health System physician accessed patient records 323 times without authorization and served four months in federal prison.3HIPAA Journal. Common HIPAA Violations
- Montefiore Medical Center paid $4.75 million after a staff member accessed over 12,000 records and sold data to an identity theft ring.
- Memorial Hermann Health System paid $2.4 million for revealing protected health information in a press release.
- New York Presbyterian Hospital paid $2.2 million for filming patients without their consent.
- Luke’s-Roosevelt Hospital Center paid $387,000 for disclosing a patient’s HIV status to their employer.4U.S. Department of Health and Human Services. All Cases
Smaller-scale violations get penalized too: pharmacies leaving patient logs in public view, hospitals leaving detailed voicemails with the wrong family member, and staff discussing a patient’s condition within earshot of others in a waiting room.
Right of Access Cases
If a provider refuses, delays, or overcharges you for a copy of your own medical records, that is one of the most actively enforced violations. OCR launched a dedicated Right of Access initiative in late 2019, and as of January 2026 it has produced more than 50 settlements or penalties.5HIPAA Journal. HIPAA Violation Cases Examples include a $4.3 million penalty against Cignet Health in Maryland, a $200,000 penalty against Oregon Health & Science University after it took more than 16 months and two OCR complaints to produce a patient’s records,6U.S. Department of Health and Human Services. Resolution Agreements and Civil Money Penalties and a $112,500 settlement with Concentra after a patient waited over a year for records.
Two reasons providers commonly cite for withholding records are not valid under HIPAA: an outstanding balance on the account, and the fact that portions of the file were created by outside physicians. OCR has penalized practices for both.
Penalties and What Patients Can and Cannot Do
Civil penalties are tiered by culpability. For violations the entity was unaware of and could not reasonably have known about, fines range from $100 to $50,000 per violation. For willful neglect that is not corrected within 30 days, the penalty is $50,000 per violation, with an annual maximum of $2,190,294 per violation category as of January 2026.7American Medical Association. HIPAA Violations and Enforcement Criminal penalties for obtaining or disclosing health information with intent to sell it or cause harm can reach $250,000 and ten years in prison.
One important limit: HIPAA does not give you the right to sue. There is no private cause of action under the statute, so if you were harmed by a privacy breach you generally have to bring claims under state law.5HIPAA Journal. HIPAA Violation Cases
Emergency Care Violations (EMTALA)
The Emergency Medical Treatment and Labor Act requires every Medicare-participating hospital with an emergency department to screen anyone who comes in seeking care and to stabilize any emergency medical condition, regardless of insurance status or ability to pay.8Centers for Medicare and Medicaid Services. Emergency Medical Treatment and Labor Act If the hospital can’t stabilize you, it has to arrange an appropriate transfer, and hospitals with specialized capabilities cannot refuse an incoming transfer. Violations are sometimes called “patient dumping.”
An analysis of HHS Office of Inspector General records from 2002 to 2015 identified 192 settlements, with 40% confirming EMTALA violations. Failure to perform a medical screening exam appeared in 75% of violation cases; failure to stabilize appeared in 42%. Consideration of the patient’s insurance or ability to pay was a factor in 15%.9National Center for Biotechnology Information. EMTALA Roughly 4% to 5% of U.S. hospitals are cited in any given year, and for-profit hospitals are cited at more than double the rate of nonprofits per million emergency visits.
Penalties come as civil monetary penalties imposed by the OIG. Recent settlements show the range:
- Brentwood Behavioral Healthcare of Mississippi paid $350,000 in May 2025 for refusing to accept appropriate transfers.
- West Tennessee Healthcare paid $340,000 in February 2026 for screening and transfer failures.
- Baptist Medical Center South paid $290,000 in February 2025 for screening and stabilization failures.
- Freeman Health System paid $250,000 in December 2024 for failure to provide stabilizing treatment.
- Cordell Memorial Hospital paid $40,000 in January 2026 for failure to provide a medical screening examination.10HHS Office of Inspector General. EMTALA/Patient Dumping Enforcement
Hospitals that settle do not admit liability. Repeated or flagrant violations can result in termination from Medicare and Medicaid. Individual physicians can also be fined up to $50,000 per violation. Unlike HIPAA, EMTALA does give patients a private right of action: if you were harmed by a violation, you can sue the hospital in civil court within two years of the incident.9National Center for Biotechnology Information. EMTALA
Informed Consent Violations
Informed consent means the provider gave you enough information about the diagnosis, proposed treatment, risks, benefits, and alternatives to let you make a real decision. When that disclosure is inadequate and something goes wrong, you may have a malpractice claim.
To win, you generally have to prove four things: that a doctor-patient relationship existed, that the provider failed to disclose material information, that a reasonable patient would have refused the treatment had they known, and that you suffered actual harm as a result. Courts apply one of two disclosure standards: what a reasonably prudent physician would have disclosed, or what a reasonable patient would have wanted to know.11Justia. Informed Consent
A separate and more serious claim is medical battery, which arises when a provider performs a procedure you never authorized at all — operating on the wrong body part, for instance. Battery focuses on the complete absence of consent, not the adequacy of information.
Hospital and Nursing Home Violations Under Medicare
Hospitals that take Medicare have to comply with the Conditions of Participation at 42 CFR 482.13. Those rules require hospitals to inform patients of their rights, let them participate in care decisions, protect privacy, prevent abuse and harassment, restrict restraints and seclusion to cases where less restrictive alternatives have failed, and guarantee visitation without discrimination.12eCFR. 42 CFR 482.13 – Condition of Participation: Patient’s Rights Compliance is checked through unannounced surveys, and hospitals that fail can lose Medicare certification.
Nursing Home Residents
Nursing home residents have their own protected rights under the Nursing Home Reform Act of 1987, codified at 42 CFR Part 483. Residents are entitled to a dignified existence, self-determination, freedom from physical and chemical restraints used for discipline or convenience, a person-centered plan of care, choice of attending physician, and equal access to quality care regardless of how they pay.13eCFR. 42 CFR Part 483 Subpart B The regulations define abuse to include verbal, sexual, physical, and technology-enabled forms, and define neglect as a facility’s failure to provide the goods and services needed to avoid physical harm, pain, or emotional distress.14eCFR. 42 CFR Part 483
CMS runs on-site surveys every 9 to 15 months. When surveyors find a deficiency, they rate its scope (isolated, pattern, or widespread) and severity (from potential for minimal harm up to immediate jeopardy, meaning a situation that has caused or is likely to cause serious injury or death).15Centers for Medicare and Medicaid Services. Nursing Home Enforcement Remedies include civil monetary penalties up to $10,000 per day for immediate jeopardy-level violations, denial of payment for new admissions if the facility fails to reach substantial compliance within three months, and termination from Medicare and Medicaid if noncompliance continues past six months.16eCFR. 42 CFR Part 488 Subpart F – Enforcement of Compliance
Since September 2016, CMS policy requires the immediate imposition of civil monetary penalties, with no opportunity to correct first, for nursing homes cited with harm-level deficiencies in resident behavior, quality of life, or quality of care.17Center for Medicare Advocacy. CMS Increases Mandatory Enforcement to Protect Nursing Home Residents Advocacy groups have argued that state survey agencies still under-code deficiencies: a 2014 analysis of CMS data found that only 0.9% of national nursing home citations were classified as immediate jeopardy and 2.3% as actual harm.
State Patient Bill of Rights Laws
Because Congress never passed a comprehensive federal patient bill of rights, states have filled in unevenly. As of a 2009 study, 23 states had enacted their own patient bill of rights statutes, but their strength and enforceability varies sharply.18National Center for Biotechnology Information. Patients’ Bill of Rights Study The most important practical question is whether the statute lets you sue: only four states — Arizona, Massachusetts, Maine, and Texas — provide a private right of action allowing patients to bring lawsuits directly under their patient bill of rights statutes.
New York
New York’s framework, codified under Public Health Law § 2803(1)(g) and 10 NYCRR § 405.7, establishes 21 specific rights: nondiscrimination, informed consent, refusal of treatment, access to medical records (review at no charge, copies for a reasonable fee that can’t be denied for inability to pay), privacy, participation in discharge planning, and the right to complain without retaliation.19New York State Department of Health. Patient’s Rights Hospitals must also provide interpreter services within 20 minutes for inpatient and outpatient settings and within 10 minutes in the emergency department.20NY Health Access. Hospital Patients’ Bill of Rights Complaints go to the state Department of Health at 1-800-804-5447 or through its online form.21New York State Department of Health. Patient’s Bill of Rights – Additional Information
Florida
Florida’s Patient’s Bill of Rights and Responsibilities is codified at Florida Statute 381.026 and covers dignity, privacy, informed consent, access to diagnosis and treatment information, and financial disclosure. One notable provision bars healthcare providers from discriminating against patients based on their legal right to own firearms.22Florida Legislature. F.S. 381.026 Complaints go to the provider, the facility, or the licensing agency — typically the Agency for Health Care Administration or the Department of Health.
Florida’s statute has a significant limit: it explicitly says it “shall not be used for any purpose in any civil or administrative action and neither expands nor limits any rights or remedies provided under any other law.” You cannot sue based on a violation of the Florida statute alone.
California
California requires facilities to adopt written patient rights policies and post them prominently in English, Spanish, and any other language prevalent in the area.23Cornell Law Institute. Cal. Code Regs. Tit. 22, § 97520.15 Protections cover informed consent, refusal of treatment, privacy, billing transparency, and nondiscrimination. Mental health patient rights are governed under the Welfare and Institutions Code and Title 9, with advocacy through the California Office of Patients’ Rights, operated by Disability Rights California.24California Department of State Hospitals. Patients’ Rights California’s Attorney General also pursues affirmative litigation; in October 2025 the office secured a $40 million settlement with Health Net over misleading provider directories.25California Attorney General. Healthcare Rights and Access
How to Report a Violation
The right place to file depends on what happened.
Privacy or records access (HIPAA): File with the HHS Office for Civil Rights. This is the correct agency for snooping, improper disclosures, denials of your records, and unreasonable delays or fees for copies.26MedlinePlus. Patient Rights
Emergency care refusal or patient dumping (EMTALA): CMS investigates the complaint and refers penalty cases to the HHS Office of Inspector General.27HHS Office of Inspector General. EMTALA You can also file a civil lawsuit against the hospital within two years.
Surprise medical bills: Use the CMS No Surprises Help Desk at 1-800-985-3059 or the online complaint form. CMS reviews the complaint, may investigate or refer it to a state enforcement authority, and will follow up within 60 days if it needs more information.28Centers for Medicare and Medicaid Services. Submit a Complaint
Hospital or facility safety and quality: If the facility is Joint Commission accredited, report to the Joint Commission at 1-800-994-6610 or through its online submission form.29Joint Commission. Report a Patient Safety Event
Nursing home abuse or neglect, and state-level patient rights: Go to your state health department. In New York, that’s the Department of Health; in Florida, the Agency for Health Care Administration or the Department of Health; in California, the Department of Public Health, with the Attorney General’s office handling discrimination claims. Many hospitals also have internal patient advocates who can resolve grievances before they escalate.
Informed consent or battery: These are civil claims. Consult a medical malpractice attorney; there is no federal agency that handles them.
One boundary worth naming: HIPAA itself does not let you sue. A HIPAA complaint can produce fines against the provider and force corrective action, but any personal recovery for a privacy breach has to come through a separate state-law claim.