HIPAA violations typically have a “statute of limitations” of six years. This means that penalties can be imposed up to six years after the violation is discovered, not necessarily when the violation occurred.