HIPAA Increased Penalty Amounts in 2026

HHS raised HIPAA fines about 2.6% for inflation on January 28, 2026. In Tiers 1 to 3, fines run from $145 to $73,011 per violation. Tier 4 is willful neglect (a conscious or reckless failure to follow the rules) left unfixed past 30 days. There, fines run from $73,011 per violation up to a $2,190,294 yearly cap for identical violations.

Every year, quietly and without much fanfare, HHS adjusts HIPAA civil monetary penalties for inflation. Most years, the change is a rounding error. HHS published the latest update on January 28, 2026. The multiplier was 1.02598, so penalties went up about 2.6% across the board. See our complete HIPAA violations and penalties guide for context on how these tiers work in practice.

That doesn’t sound dramatic. But here’s why it matters: penalty amounts have been climbing steadily since the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015 started mandating these annual increases. The cumulative effect is major. The maximum penalty per violation for the worst offenders now sits at $2,190,294, up from $2,134,831 last year.

The new amounts took effect January 28, 2026, following publication in the Federal Register. Any penalty assessed on or after that date applies the new figures, even for violations that occurred earlier (as long as they occurred after November 2, 2015).

And these numbers aren’t theoretical. In 2025 alone, OCR collected more than $8.3 million in HIPAA settlements and civil monetary penalties across 21 enforcement actions. The fine amounts keep going up every year.

Here’s what the numbers actually mean for your practice.

The Four HIPAA Penalty Tiers: What Each Fine Level Means

HIPAA fines aren’t one-size-fits-all. The Office for Civil Rights (OCR) uses a four-tier framework based on culpability: essentially, how much you knew or should have known that you were violating the law. The less aware you were, the lower the penalty. The more willful your neglect, the higher it goes.

Tier 1: “Didn’t Know and Couldn’t Have Known”

You genuinely had no idea, and reasonable diligence (the care a careful business would take) wouldn’t have caught it.

• Per violation: $145 minimum, $73,011 maximum
• Annual cap under enforcement discretion: $25,000 in 2019, adjusted for inflation since

This is the most forgiving tier. If OCR concludes you had reasonable protections in place and the violation was something you couldn’t realistically have prevented or detected, Tier 1 applies. Think: a vendor breach entirely outside your control, where you had a signed BAA and solid security policies.

But “didn’t know” has to be genuinely true, not “we never bothered to check.” OCR will look at whether you were exercising reasonable diligence. If the problem would have surfaced during a routine risk analysis that you simply never ran, you’re not Tier 1.

Tier 2: “Reasonable Cause”

You didn’t know, but you would have known if you’d been paying attention.

• Per violation: $1,461 minimum, $73,011 maximum
• Annual cap under enforcement discretion: $100,000 in 2019, adjusted for inflation since

This is where a lot of practices land when OCR investigates. You didn’t deliberately violate HIPAA, but you weren’t paying close enough attention. Common examples: no risk analysis in three years, an unencrypted file-sharing service nobody vetted, or a team member who never received proper training.

The key distinction from Tier 1 is that a reasonable compliance effort would have surfaced the problem before OCR found it.

Tier 3: “Willful Neglect, But You Fixed It”

You clearly should have known better, but you fixed the violation within 30 days of when you knew, or should have known, about it.

• Per violation: $14,602 minimum, $73,011 maximum
• Annual cap under enforcement discretion: $250,000 in 2019, adjusted for inflation since

“Willful neglect” sounds alarming. The legal definition is “conscious, intentional failure or reckless indifference to the obligation to comply with the administrative simplification provision violated.” In plain words: you consciously or recklessly failed to follow the rules. In practice, this tier often applies to practices with obvious gaps (no BAAs with vendors, no team training, no encryption) that fixed them within 30 days of when they knew, or should have known, about the problem.

The 30-day correction window matters. Fix the violation within 30 days of when you knew, or should have known, about it. Then you stay in Tier 3. Miss that window and you move to Tier 4, where things get much worse.

Tier 4: “Willful Neglect, And You Didn’t Fix It”

You knew you had a problem, you ignored it, and you still haven’t corrected it.

• Per violation: $73,011 minimum, $2,190,294 maximum
• Annual cap: $2,190,294

This is the nuclear option. It applies when willful neglect was not fixed within 30 days of when the practice knew, or should have known, about it. The $2.19 million yearly cap covers identical violations of one HIPAA provision (one specific rule). Break the Privacy Rule AND the Security Rule AND the Breach Notification Rule, and those caps stack.

The largest HIPAA settlements in history run into the millions. Anthem paid $16 million. Premera Blue Cross paid $6.85 million. These aren’t small practices, but the enforcement logic applies at every scale.

2025 vs. 2026 HIPAA Penalty Amounts: Side-by-Side Comparison

Here’s how the per-violation amounts changed with the January 28, 2026 update.

The per-violation change looks modest. But penalties aren’t always about a single incident. OCR can count each violation separately, and a violation that keeps going counts again each day. The numbers add up fast. One hundred uncorrected violations of one provision at the Tier 4 minimum would add up to $7.3 million. The yearly cap of $2,190,294 for identical violations is what holds the total down.

The Enforcement Discretion Wrinkle Most People Miss

Here’s something that trips people up: there are technically two sets of annual caps in play.

The statutory caps (the ones written into the law) set a single annual maximum of $2,190,294 for identical violations of one HIPAA provision, no matter the tier.

But in April 2019, HHS issued a Notice of Enforcement Discretion that lowered the annual caps for Tiers 1 through 3. Under that notice, HHS uses these annual limits, adjusted for inflation:

The enforcement discretion caps are HHS policy, not law. HHS can end that policy and go back to the full caps in the regulation. The 2019 notice says HHS will use the lower caps, adjusted for inflation, “until further notice.” HHS does not list the adjusted amounts in the regulation. That is why this post shows the 2019 figures.

Civil Penalties vs. Settlements: They’re Not the Same Thing

When you read headlines about HIPAA fines, you’re usually reading about one of two different things:

Civil monetary penalties (CMPs) are what OCR imposes when an organization refuses to cooperate or can’t reach an agreement. These are the penalty tier amounts above, assessed unilaterally by OCR. They’re relatively rare: most cases settle. For real enforcement examples, see the 2025 HIPAA enforcement cases and what they cost.

Settlements are negotiated agreements where the organization pays a lower amount and agrees to a corrective action plan (a written list of fixes OCR monitors). Some cases do end in penalties instead. Gulf Coast Pain Consultants ($1.19 million, December 2024), Children’s Hospital Colorado ($548,265, December 2024), and Warby Parker ($1.5 million, February 2025) all got civil monetary penalties, not settlements.

The practical difference: if you cooperate with OCR, document your compliance efforts, and negotiate in good faith, you’re more likely to settle for less than the maximums. If you fight OCR or stonewall, CMPs get expensive.

Criminal HIPAA Penalties: A Separate Track

Civil fines from OCR are separate from criminal prosecution, which falls to the Department of Justice. Criminal fines are written into the law itself (42 U.S.C. 1320d-6). They are not part of the yearly inflation update:

• Knowingly getting or sharing health information in violation of HIPAA: Up to 1 year in prison, up to $50,000 fine
• Doing it under false pretenses: Up to 5 years in prison, up to $100,000 fine
• Doing it to sell or use the data for commercial advantage, personal gain, or malicious harm: Up to 10 years in prison, up to $250,000 fine

Criminal prosecution is rare but not theoretical. Employees who access and sell patient data for identity theft have been charged. Providers who used PHI for personal financial gain have faced prison time.

State Attorneys General: The HIPAA Enforcement Risk Nobody Expects

Here’s one that catches people off guard: OCR isn’t the only agency that can fine you for HIPAA violations.

Under the HITECH Act, state attorneys general can bring civil actions on behalf of residents harmed by HIPAA violations. They can seek up to $100 per violation. The cap is $25,000 a year for violations of the same requirement. These cases are separate from OCR’s own penalties.

State AGs do use this power. New York fined OrthopedicsNY $500,000 in 2025 over a breach affecting 656,000 people. California, Connecticut, Indiana, Massachusetts, Minnesota, New Jersey, and Pennsylvania have also taken action against HIPAA-regulated organizations over the years.

State enforcement works independently from OCR. Getting a pass from OCR doesn’t protect you from your state AG.

What “Willful Neglect” Actually Looks Like in Practice

Tier 3 and Tier 4 hinge on “willful neglect,” and the term matters because it carries the highest penalties. It is also the one case where OCR must investigate a complaint. If a first look at a complaint points to possible willful neglect, OCR will investigate. For other complaints, investigating is up to OCR.

In practice, here’s what pushes practices into willful neglect territory:

• No risk analysis at all. Not an outdated one: literally none. The Security Rule requires a risk analysis (45 CFR 164.308(a)(1)(ii)(A)). Skipping it entirely can point to willful neglect. OCR’s Risk Analysis Initiative, announced in late 2024, focuses on this exact gap.
• No BAAs with vendors handling PHI. You knew vendors had your patient data and never executed an agreement. This is one of the most common BAA mistakes practices make.
• No team training. Staff handling PHI with zero HIPAA training.
• Ignoring known weak spots. Your own IT team flagged a problem and nobody fixed it.
• Prior OCR guidance ignored. OCR told you to fix something in a previous investigation and you didn’t.

The difference between Tier 3 and Tier 4 is simple: did you fix it within 30 days of when you knew, or should have known, about it? If yes, Tier 3. If no, Tier 4. That 30-day window is your last chance to avoid the worst penalties.

The HIPAA Fine Number That Actually Matters for Your Practice

Forget the $2.19 million maximum for a moment. The number that should be on your radar is $73,011.

That’s the most OCR can charge for a single Tier 2 violation, “Reasonable Cause.” It’s a tier where small and mid-sized practices can easily land. Not because they were negligent in some dramatic way, but because they hadn’t gotten around to doing a current risk analysis, or their team training was a once-a-year checkbox exercise, or they had vendors handling patient data without a signed BAA.

Seventy-three thousand dollars for one violation is a real number for a real practice. And it went up again this year.

Compare that to the cost of compliance. A thorough risk analysis, updated policies, staff training, and proper vendor agreements can be done for a fraction of that amount. The math isn’t complicated.

Sources

• 45 CFR Part 160, Subpart D: Civil Money Penalties
• Federal Register (Jan. 28, 2026): HHS Annual Civil Monetary Penalties Inflation Adjustment
• HHS OCR Resolution Agreements
• 42 U.S.C. 1320d-5: General Penalty for Failure to Comply

Related Reading

• How to Conduct a HIPAA Risk Assessment: The step-by-step process OCR expects you to follow
• HIPAA Fines in 2025: A Complete Breakdown: Where that money came from and what triggered each penalty
• The Business Associate Agreement Mistakes That Will Cost You: The contract gaps that can raise your penalty tier
• Why “Addressable” Doesn’t Mean “Optional” in HIPAA: The compliance myth that leads to willful neglect findings
• The Proposed HIPAA Security Rule Changes: What the proposed rule would change if it becomes final
• What Counts as PHI in AI Prompts?
• OCR Part 2 Enforcement: What Substance Abuse Providers Need to Know
• The Risk of Compliance Badges
• Acadia Healthcare Data Breach

Wondering where your practice falls on the compliance spectrum? One Guy Consulting offers two HIPAA compliance plans, starting at $60 a month per location. Both include a Security Risk Assessment tool, policy and procedure templates, and staff training. Explore HIPAA compliance services Complete a risk assessment