Up to $2,190,294: U.S. HIPAA Penalties 2026 and Audit Ready Fixes

Organizations that violate HIPAA face civil monetary penalties ranging from $145 to $2,190,294 per calendar year for identical violations under the 2026 inflation adjustment, while individuals who act with intent or personal gain risk federal criminal fines up to $250,000 and up to 10 years in prison. A single breach affecting thousands of records can multiply penalty assessments well beyond the per-violation minimum. The Department of Health and Human Services generally favors negotiated resolution agreements over contested civil monetary penalties.

---

---

Understanding HIPAA Penalty Tiers and 2026 Amounts

HIPAA civil penalties operate on a four-tier structure, with each tier tied to the covered entity's or business associate's level of culpability at the time of the violation. The tiers were established under the HITECH Act and are adjusted annually for inflation under a Department of Health and Human Services rule that tracks a cost-of-living formula set by the Office of Management and Budget. The 2026 Federal Register notice sets the current per-violation ranges and the calendar-year cap that applies to identical provision violations.

Tier 1: Did Not Know. The entity had no reasonable way of knowing the act violated HIPAA, even with reasonable diligence. This is the lowest culpability level and carries the smallest per-violation exposure.

Tier 2: Reasonable Cause. The entity knew, or should have known through reasonable diligence, that the act violated HIPAA, but did not act with willful neglect.

Tier 3: Willful Neglect, Corrected. The violation involved conscious, intentional failure or reckless indifference to compliance obligations, but the entity corrected the problem within the 30-day window HIPAA allows.

Tier 4: Willful Neglect, Not Corrected. The same conscious disregard as Tier 3, except the entity failed to fix the issue within 30 days of discovery. This tier carries the highest exposure by far.

For 2026, the inflation-adjusted per-violation ranges and calendar-year caps published by HHS break down as follows:

• Tier 1 (Did Not Know): $145 minimum per violation, up to roughly $59,973 maximum, with an annual cap of $2,190,294 for identical violations.
• Tier 2 (Reasonable Cause): $1,499 minimum per violation, up to roughly $59,973 maximum, capped at $2,190,294 annually.
• Tier 3 (Willful Neglect, Corrected): $14,993 minimum per violation, up to roughly $59,973 maximum, same $2,190,294 annual cap.
• Tier 4 (Willful Neglect, Not Corrected): $59,973 minimum per violation, with no meaningful ceiling below the $2,190,294 annual cap, meaning a single violation can approach the full-year maximum on its own.

Those figures apply per violation, not per incident. A breach that exposes the protected health information of 10,000 patients through the same underlying failure, such as an unencrypted database left accessible online, can be treated as thousands of separate violations of the same provision. OCR has discretion in how it counts violations, and it typically does count each affected record separately when calculating exposure, which is why the calendar-year cap functions as a practical ceiling rather than the per-violation maximum.

The current four-tier structure and these inflation-adjusted amounts apply to violations occurring after February 18, 2009, the effective date of the HITECH Act amendments to HIPAA's enforcement provisions. Violations that occurred before that date fall under an older, single-tier penalty schedule with a much lower maximum, generally $100 per violation and a $25,000 annual cap. That older schedule almost never comes into play today given statute of limitations constraints, but it matters when reviewing historical enforcement data or older resolution agreements.

Federal Criminal Penalties for HIPAA Violations

Civil penalties fall on the organization. Criminal penalties fall on the person, and they run through an entirely separate legal track.

The Department of Justice, not OCR, prosecutes criminal HIPAA violations. Prosecution requires the government to prove the individual knowingly obtained or disclosed protected health information in violation of HIPAA, and the sentence depends on the defendant's intent:

• Basic knowing violation: Up to $50,000 in fines and up to 1 year in prison.
• Violation under false pretenses: Up to $100,000 in fines and up to 5 years in prison.
• Violation for personal gain or malicious intent: Up to $250,000 in fines and up to 10 years in prison.

These statutory maximums are documented alongside HHS's civil enforcement resources, though the criminal statute itself lives in a different part of the federal code than the civil penalty provisions HHS enforces directly.

DOJ tends to pursue criminal cases when the facts show deliberate wrongdoing rather than negligence. Classic triggers include a hospital employee selling patient records to identity thieves, a former staff member accessing a celebrity's chart out of curiosity or malice, or a business associate employee stealing insurance information for financial fraud. Simple carelessness, a missed risk analysis, an unencrypted laptop, a misdirected fax, almost never rises to criminal prosecution. Those cases stay in OCR's civil track.

The procedural split matters. OCR investigations aim at a resolution agreement, a civil monetary penalty, or a corrective action plan, and the standard of proof is civil. DOJ criminal cases require proof beyond a reasonable doubt, involve grand juries or plea negotiations, and can result in a criminal record and incarceration regardless of what happens on the civil side. An organization can settle with OCR while an individual employee still faces separate federal criminal charges for the same underlying incident.

How OCR and DOJ Decide the Size of a Penalty

Penalty amounts are not arbitrary. HIPAA's enforcement provisions direct OCR to weigh a specific set of statutory factors before settling on a civil monetary penalty, and the same logic shapes how far OCR is willing to negotiate in a resolution agreement.

1. The nature and extent of the violation, including the number of individuals affected and the type of protected health information involved.
2. The nature and extent of the harm caused, covering physical harm, financial harm, and reputational harm to the affected individuals.
3. The entity's history of prior compliance, including any earlier violations, indications of noncompliance, or previous OCR corrective action.
4. The financial condition of the covered entity or business associate, which can affect the entity's ability to pay and, in some cases, the entity's ongoing ability to comply.
5. Other matters as justice may require, a catch-all that lets OCR consider cooperation, good faith, and mitigating circumstances.

Cooperation carries real weight. An organization that self-reports quickly, preserves evidence, and works transparently with investigators tends to fare better than one that stonewalls or minimizes. Correcting a willful neglect violation inside the 30-day window can shift the assessment from Tier 4 down to Tier 3, which cuts the potential per-violation floor dramatically.

Pro Tip: Document your remediation timeline in writing from day one of discovering a potential violation. OCR investigators weigh a clear, dated record of containment and correction far more heavily than a verbal account reconstructed months later.

This is also why most HIPAA enforcement ends in a resolution agreement rather than a contested civil monetary penalty. A CMP is a one-time punishment. A resolution agreement lets OCR require a corrective action plan, often with 1 to 3 years of independent monitoring and periodic reporting. This gives the agency ongoing leverage to force systemic change that a fine alone cannot guarantee. For OCR, a settlement with teeth beats a check that gets cashed and forgotten.

How OCR Investigations and State Enforcement Actually Work

An OCR case typically starts with an intake, either a breach report the entity itself submitted, a patient complaint, or a media report that catches investigators' attention. From there, the process generally follows a predictable arc.

• Intake and initial review: OCR screens the complaint or breach report to determine whether it falls within HIPAA's jurisdiction and warrants investigation.
• Formal investigation: OCR requests documentation, policies, risk analyses, training records, and business associate agreements, and may interview staff.
• Findings and negotiation: If OCR finds a violation, it typically opens negotiations toward a resolution agreement before considering a formal civil monetary penalty.
• Resolution agreement or CMP: Most cases end in a negotiated settlement with a corrective action plan; a smaller number proceed to a contested CMP when negotiations fail.
• Monitoring period: Settlements commonly include 1 to 3 years of OCR oversight, with periodic compliance reports and sometimes independent assessments.

Evidence requests during this process can be extensive. OCR routinely asks for risk analyses going back several years, incident response logs, encryption records, and every business associate agreement tied to the systems involved in the breach. Entities that already keep these artifacts in an audit-ready state move through investigation faster than those scrambling to reconstruct records after the fact.

State attorneys general add a separate, often underestimated layer of risk. Since 2009, state AGs have had authority to bring civil actions on behalf of state residents for HIPAA violations, seeking damages and penalties independent of whatever OCR decides to do federally. A single breach can trigger a federal resolution agreement and one or more state actions simultaneously, each with its own timeline, document requests, and settlement terms. Entities that plan their incident response around OCR alone are often unprepared for a parallel state inquiry that arrives months later.

Notable HIPAA Settlements and What They Reveal

Enforcement data tells a consistent story: a handful of failure modes account for a disproportionate share of penalty dollars. Reviewing recent settlement patterns tracked by HIPAA Journal alongside the HHS OCR resolution agreements index surfaces a few recurring themes rather than isolated incidents.

• Right of Access failures. OCR's dedicated Right of Access initiative has produced a steady stream of settlements against providers who took months, rather than the required 30 days, to hand over patients' own medical records. The lesson: patient access delays are treated as violations in their own right, independent of any breach.
• Missing or outdated risk analyses. A large share of major settlements cite a risk analysis that was never performed, performed once and never updated, or too narrow in scope to cover all systems touching protected health information. The lesson: a stale risk analysis is functionally the same as no risk analysis in OCR's eyes.
• Ransomware and unpatched systems. Multiple settlements followed ransomware attacks that succeeded because of unpatched software or absent network segmentation. The lesson: OCR increasingly treats poor cybersecurity hygiene as a compliance failure, not just an IT problem.
• Weak business associate oversight. Several cases trace back to a vendor or contractor mishandling data with no proper business associate agreement in place or no oversight of that agreement's terms. The lesson: liability follows the data, even when a third party caused the exposure.

The financial range across these cases spans widely, from settlements in the low hundreds of thousands of dollars for smaller practices to multi-million-dollar resolution agreements for large health systems and insurers, reflecting the sheer difference in record counts and organizational resources involved.

Reducing Penalty Exposure After a Potential Violation

What an organization does in the first 72 hours after discovering a potential violation often shapes the entire outcome of any later OCR investigation.

1. Contain the exposure immediately. Isolate affected systems, revoke compromised credentials, and stop further data loss before anything else.
2. Preserve evidence before you fix anything. Log timestamps, screenshots, and system states; overwriting evidence during remediation can hurt you later if OCR asks how the incident unfolded.
3. Track the notification clock. Breach notification to affected individuals is expected within a timely window after discovery; missing that may lead to additional penalties.
4. Assign clear ownership. Designate who leads the investigation, who talks to counsel, and who communicates with OCR if it comes to that.
5. Fix the root cause inside 30 days when willful neglect is possible. Correcting the issue within that window can move the violation from Tier 4 down to Tier 3, a meaningful difference in exposure.

Behind every one of these steps sits a set of safeguards OCR expects to already be in place: a current risk analysis covering every system that touches protected health information, role-based access controls, encryption of data at rest and in transit, and signed business associate agreements with every vendor that handles patient data. Entities that can produce these artifacts on demand, rather than reconstructing them under pressure, consistently see better outcomes in negotiations.

Pro Tip: Keep a running folder of training completion records, access logs, and vendor agreements updated in real time, not assembled after an incident. OCR investigators notice the difference between continuous compliance and after-the-fact paperwork.

This is precisely the gap Ciphrix's AI agents are built to close. The platform automates the creation of audit-ready policies, ongoing risk assessments, and evidence collection for HIPAA alongside other frameworks like ISO 27001 and SOC 2, so the documentation OCR asks for during an investigation already exists in organized, timestamped form rather than being assembled under deadline pressure.

Where These Figures and Rules Come From

The Final Enforcement Rule established the tier structure and factors OCR uses to set penalties, while the HITECH Act created the four-tier culpability framework that replaced the older single-tier schedule. The 2026 Federal Register inflation notice sets the exact dollar figures currently in force, and those numbers are revised annually, so always check the effective date on any penalty table before citing it. The HHS OCR resolution agreements index publishes every settlement OCR has entered into, complete with the underlying facts and corrective action requirements.

Sources

• HHS Annual Civil Monetary Penalties Inflation Adjustment, 91 Fed. Reg. 3665 (Jan. 28, 2026)
• Resolution agreements and civil monetary penalties | HHS OCR
• Peer-reviewed analysis of OCR enforcement trends (PMC/NCBI)

Organizations that want to move past manual spreadsheets and scattered evidence folders can see how Ciphrix's HIPAA compliance platform automates policy generation, risk assessments, and audit-ready evidence collection, turning the documentation OCR expects into a standing asset rather than a scramble.

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

Recommended

• HIPAA Risk Analysis: An Audit-Ready Guide for 2026
• 10 HIPAA Violation Examples, Fines & How to Avoid Them in 2026
• 8 Best Software for HIPAA Compliance and Audit Readiness in 2026
• HIPAA Compliance Fundamentals for Engineering Teams