HIPAA penalties: the current numbers, and how they are actually applied

Penalty numbers are the most quoted and most stale facts in HIPAA. The amounts adjust for inflation every year, most sites never update, and half of what you will read elsewhere also ignores a 2019 policy that changes what OCR actually charges. This page states the numbers in force today, with the source and effective date on each one, and it carries a visible last-verified date because these figures have a shelf life by design.

Current basis: the HHS annual inflation adjustment published January 28, 2026 (91 FR 3666), applying to penalties assessed on or after that date for violations occurring on or after November 2, 2015. The adjusted amounts are codified in the penalty table at 45 CFR Part 102.

How a penalty actually happens

Start with the honest context, because the raw numbers mislead without it. Most OCR investigations do not end in a financial penalty. They end in voluntary compliance, technical assistance, or a resolution agreement with a corrective action plan. When money changes hands, it is usually a negotiated settlement, not a formally imposed civil money penalty, and the settlement figure reflects the entity’s size, cooperation, and finances. The March 2026 MMG Fusion settlement was 10,000 dollars, and OCR said in its own press release that it considered the entity’s financial condition.

So the tables below are the legal ceiling and floor, not a price list. What they are is the leverage in every negotiation, and the reason the corrective action plan, years of OCR monitoring, is the real cost of most enforcement.

The four tiers

Civil penalties scale with culpability (45 CFR 160.404(b)(2)), and the tiers are defined at 45 CFR 160.401. Amounts below are the inflation-adjusted figures in force since January 28, 2026 (91 FR 3666).

The caps apply per identical provision per calendar year: violate two different requirements and each carries its own cap. And a single event routinely counts as many violations, because OCR can count per record, per person, or per day of noncompliance.

Two definitions carry the whole table. Willful neglect means conscious, intentional failure or reckless indifference to the obligation to comply (45 CFR 160.401). And notice what separates tier 3 from tier 4: thirty days of correction. The same conduct, corrected fast, changes tiers. The rule pays you, in the most literal way, for fixing things quickly.

The 2019 discretion, which is what OCR actually applies

In April 2019, HHS announced that it had been reading the HITECH Act’s penalty caps wrong, and that pending further rulemaking it would exercise enforcement discretion and apply lower annual caps to the first three tiers (84 FR 18151): 25,000 dollars for tier 1, 100,000 for tier 2, 250,000 for tier 3, with only tier 4 keeping the full statutory cap, all in 2019 dollars and adjusted for inflation since. In today’s terms those discretionary caps sit at roughly 36,500, 146,000, and 365,000 dollars, with tier 4 at the full 2,190,294.

That notice has never been rescinded, and no rulemaking has replaced it; the January 2026 adjustment notice adjusts the codified figures without incorporating it. So the honest statement of current law is layered: the codified cap for every tier is 2,190,294 dollars, and OCR’s stated policy is to charge tiers one through three against the lower discretionary caps. A future administration could withdraw the discretion with a notice. The codified number is the exposure; the discretion is the practice.

What moves the number

Within a tier, 45 CFR 160.408 lists what OCR weighs: the nature and extent of the violation, including how many people were affected and for how long; the nature and extent of the harm, physical, financial, or reputational; the entity’s history of prior compliance, including how it has responded to complaints before; the entity’s financial condition, including size; and such other matters as justice may require. Read that list as a clinic and it converts to advice with unusual directness: respond to complaints, fix what you find, keep the record of both, and the same violation costs less.

“The codified number is the exposure; the discretion is the practice.”

Two more provisions matter. Under 45 CFR 160.410, OCR may not impose a penalty for a violation not due to willful neglect that is corrected within 30 days of when the entity knew or should have known of it. That is an affirmative defense written into the regulation: speed of correction can eliminate a penalty entirely, not just reduce it. And under 45 CFR 160.412, HHS may waive a penalty to the extent it would be excessive relative to the violation.

Criminal penalties, which are a different animal

Civil penalties come from OCR. Criminal liability, under 42 U.S.C. 1320d-6, is prosecuted by the Department of Justice and requires knowingly obtaining or disclosing individually identifiable health information in violation of the statute. Three levels: up to 50,000 dollars and one year in prison for the base offense; up to 100,000 dollars and five years if committed under false pretenses; up to 250,000 dollars and ten years if committed with intent to sell, transfer, or use the information for commercial advantage, personal gain, or malicious harm.

The clinic-relevant fact about criminal HIPAA is who it reaches: individuals, including workforce members. The employee who looks up a neighbor’s child out of curiosity, or sells records, is personally exposed. That fact belongs in your training program, stated plainly, because it is protective in both directions.

The other enforcers

OCR is not alone. State attorneys general have had authority since HITECH to bring civil actions for HIPAA violations affecting their residents (42 U.S.C. 1320d-5(d)), and several use it, sometimes in multistate actions. State health-privacy laws carry their own penalties on top. And for health data outside HIPAA’s reach, the FTC enforces its separate Health Breach Notification Rule. The map has more than one enforcement agency on it, which is one more reason the program, not the statute-by-statute defense, is the thing worth building.

What this means at clinic scale

Three sentences of honest synthesis. OCR scales penalties to the organization, and it does not skip small ones; a 10,000 dollar settlement with a corrective action plan and years of monitoring is the small-entity shape of enforcement, and the monitoring is the expensive part. The tier system and the affirmative defense both pay for the same behavior: knowing your gaps and fixing them fast, which is precisely the behavior a real compliance program produces as a by-product. And every figure on this page changes each January, so if you are reading this anywhere close to a new year, check the last-verified date above, because we mean it.