Last verified: October 2026, against 45 CFR 160.404 and 102.3 and HHS's Federal Register notices of January 28 and October 21, 2026. General information, not legal advice — confirm with your compliance officer or attorney.
HIPAA fines are civil money penalties that HHS's Office for Civil Rights (OCR) can impose when a practice or its vendor violates the HIPAA rules. They are set in four tiers by how culpable the organization was, adjusted for inflation most years, and capped per calendar year. Most of the stale numbers you'll find elsewhere predate the latest adjustment, so the figures below come straight from the regulation and HHS's Federal Register notices.
In short: HIPAA fines run from $145 per violation when a practice didn't know and couldn't reasonably have known, up to $2,190,294 per year for identical violations due to uncorrected willful neglect. These are the 2025 amounts, which HHS says remain in effect for 2026. Criminal penalties and state lawsuits are separate.
Who issues HIPAA penalties
OCR enforces the Privacy, Security and Breach Notification Rules under authority the HHS Secretary delegated in 2000 and, for the Security Rule, in 2009 (opens in a new tab). Under 45 CFR 160.402 (opens in a new tab), the Secretary "will impose a civil money penalty upon a covered entity or business associate" that violates a rule, subject to the affirmative defenses. A practice is also liable for the acts of its agents, including workforce members and business associates acting within the scope of the agency.
Penalties are one route among several. Criminal cases go to federal prosecutors, and state attorneys general can sue in their own right. Everything starts with information your practice holds about patients, which what is PHI defines.
The four civil penalty tiers
The tiers in 160.404(b)(2) (opens in a new tab) apply to violations on or after February 18, 2009. The regulation prints the original HITECH Act amounts and says the adjusted amounts "appear at 45 CFR part 102." Current figures are in 45 CFR 102.3 (opens in a new tab), last amended by the 2025 adjustment (opens in a new tab) published January 28, 2026.
| Tier | Culpability | Per violation (2025 amounts) | Calendar-year cap, identical violations |
|---|---|---|---|
| 1 | Did not know and, with reasonable diligence, would not have known | $145 to $73,011 | $2,190,294 |
| 2 | Reasonable cause, not willful neglect | $1,461 to $73,011 | $2,190,294 |
| 3 | Willful neglect, corrected within 30 days | $14,602 to $73,011 | $2,190,294 |
| 4 | Willful neglect, not corrected within 30 days | $73,011 to $2,190,294 | $2,190,294 |
Three provisions shape the real-world number:
- Lower annual caps by enforcement discretion. In an April 2019 notice (opens in a new tab), HHS said it would apply annual limits of $25,000, $100,000, $250,000 and $1.5 million for tiers 1 to 4 respectively, before inflation adjustment. The notice says this discretion "is effective indefinitely."
- Continuing violations count daily. Under 160.406, "a separate violation occurs each day" a practice remains out of compliance, which is how a single missing risk analysis can add up.
- The 30-day cure. Under 160.410(c) (opens in a new tab), no penalty may be imposed for a violation that wasn't due to willful neglect and was corrected within 30 days of when you knew, or should have known, about it.
Within a tier, 160.408 (opens in a new tab) requires OCR to weigh five factors: the nature and extent of the violation, the harm it caused, your compliance history, your financial condition (including "the size of the covered entity"), and "such other matters as justice may require." Since Public Law 116-321 (opens in a new tab), enacted January 5, 2021, HHS must also consider whether you had "recognized security practices" in place "for not less than the previous 12 months," such as NIST guidance or the practices developed under section 405(d) of the Cybersecurity Act of 2015. The law says it gives HHS no authority to increase fines for not having them.
Why the dollar amounts change every year
Federal law requires agencies to adjust civil penalties for inflation each year, and 160.404 says the HIPAA amounts "will be updated annually and published at 45 CFR part 102." The 2025 adjustment multiplied the 2024 amounts by 1.02598, based on the October 2024 consumer price index.
2026 is an exception. On October 21, 2026, HHS published a notice (opens in a new tab) that "there will be no Civil Monetary Penalty (CMP) inflation adjustment for 2026," because the October 2025 price data could not be produced during the federal funding lapse from October 1 to November 12, 2025. HHS will keep using the 2025 amounts. When you see a HIPAA fine table, check the year in its header before relying on it.
Settlements and corrective action plans
An OCR investigation that finds problems doesn't have to end in a formal penalty. Under 160.312 (opens in a new tab), OCR may resolve noncompliance "by informal means," which "may include demonstrated compliance or a completed corrective action plan or other agreement." Cases that aren't closed that way can end in a resolution agreement, a negotiated settlement that can include a payment and a corrective action plan. Read any proposed agreement with counsel before signing.
HHS describes the trend in its January 2025 Security Rule proposal (opens in a new tab): in 2023, OCR entered into seven resolution agreements after investigations indicated potential Security Rule violations, "almost half of the total resolution agreements OCR entered into that year." In one, a regulated entity didn't detect a network intrusion for 20 months, and OCR found evidence it had failed to conduct a risk analysis. For more patterns, see HIPAA violation examples.
Criminal penalties
42 U.S.C. 1320d-6 (opens in a new tab) makes it a federal crime to knowingly, and in violation of HIPAA, use a unique health identifier, obtain identifiable health information, or disclose it to another person. It explicitly reaches a person who obtains or discloses a covered entity's information "without authorization," such as an employee. The statute sets three tiers:
- Base offense: fine of not more than $50,000, up to 1 year in prison, or both.
- Under false pretenses: not more than $100,000, up to 5 years, or both.
- With intent to sell, transfer or use the information for commercial advantage, personal gain or malicious harm: up to $250,000, up to 10 years, or both.
These are prosecuted in federal court, not by OCR.
State attorneys general and other exposure
The HITECH Act let state attorneys general enforce HIPAA too. Under 42 U.S.C. 1320d-5(d) (opens in a new tab), an attorney general may sue for an injunction or for damages of up to $100 per violation, capped at $25,000 per calendar year for identical violations, plus costs and attorney fees.
Other exposure sits outside HIPAA entirely: state privacy and breach laws, consumer-protection claims, licensing boards, and the cost of the breach itself, including notifications, forensics and lost patients. For a small practice, those costs can arrive before any federal penalty does.
What lowers a practice's risk
The same five habits show up in the tiers, the factors and the 30-day cure:
- A documented risk analysis, updated when systems change. Start with our HIPAA risk assessment walkthrough.
- A signed BAA for every vendor that handles PHI. See BAAs with vendors.
- Training with records, plus a sanctions policy you actually apply.
- Encryption of laptops, phones, email and stored form submissions, which can keep a lost device from becoming a reportable breach.
- Fast, documented breach response, so you stay inside the 30-day cure and the 60-day notice clock. See breach notification.
The compliance checklist puts all five on one page. On the marketing side, Medfy stores patient information in separate, encrypted HIPAA databases in the US or Canada and signs a BAA with every practice before any patient data flows; see Medfy's HIPAA safeguards. A free marketing audit flags website risks such as pixels on patient forms.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Frequently asked questions
How much is a HIPAA fine for a small practice?
There is no set amount. Under the 2025 figures still in force, civil penalties run from $145 per violation in the lowest tier to $2,190,294 per calendar year for identical violations, and OCR must weigh your size, finances, harm caused and compliance history. A case can also close with a corrective action plan instead of a penalty. For your own exposure, ask your compliance officer or attorney.
Can individual employees be fined for HIPAA violations?
Civil money penalties are imposed on covered entities and business associates, not on individual staff. Individuals can face criminal charges, though: the HIPAA statute makes it a federal crime to knowingly obtain or disclose identifiable health information in violation of the rules, and it covers employees who access a covered entity's records without authorization. Practices must also apply their own sanctions to staff who break policy.
Do HIPAA penalties apply to business associates?
Yes. The penalty regulations apply to covered entities and business associates alike, and the same four culpability tiers and amounts apply to both. A business associate is also liable for violations by its own agents, including subcontractors. Your practice stays liable for its own failures, such as letting a vendor handle PHI without a signed BAA. Review vendor contracts with your compliance officer or attorney.
Can patients sue for HIPAA violations?
The HIPAA statute gives enforcement to HHS and to state attorneys general, who can sue on residents' behalf; it doesn't set up a damages claim for individual patients. Patients can file a complaint with OCR, generally within 180 days. Separate lawsuits under state privacy, negligence or consumer-protection laws are possible, and HIPAA standards may come up in them. Ask an attorney about your state.