HIPAA penalty tiers for 2026
The HHS Office for Civil Rights (OCR) sets civil money penalties by how much the organisation knew, under 45 CFR 160.404. HHS adjusts the amounts for inflation every year. These are the amounts in force since 28 January 2026 (45 CFR 102.3):
| Tier | Culpability | Per violation |
|---|---|---|
| 1 | Did not know, and with reasonable diligence would not have known | $145 to $73,011 |
| 2 | Reasonable cause, not willful neglect | $1,461 to $73,011 |
| 3 | Willful neglect, corrected within 30 days | $14,602 to $73,011 |
| 4 | Willful neglect, not corrected within 30 days | $73,011 to $2,190,294 |
Annual caps
The regulation caps penalties at $2,190,294 per year for violations of an identical provision, in every tier. Since its 2019 Notice of Enforcement Discretion, OCR has applied lower annual caps for Tiers 1 to 3: $25,000, $100,000 and $250,000 at their base amounts, with $1.5 million for Tier 4, "as adjusted for inflation". HHS has not published the adjusted figures for those notice caps, so the calculator above uses the base amounts for its low end.
How violations are counted
One incident can involve several violations: a missing risk analysis, missing access controls, a late breach notice. OCR usually groups violations by provision rather than per record, and many cases end in a resolution agreement with a payment and a corrective action plan instead of a formal penalty. That is why the calculator shows a range, with the high end as a worst case rather than a prediction.
State attorneys general and criminal penalties
- State attorneys general can bring civil actions under HITECH: up to $100 per violation and $25,000 per identical requirement per calendar year (42 U.S.C. 1320d-5(d)).
- Criminal penalties apply to knowingly obtaining or disclosing protected health information, up to $250,000 and 10 years in prison where the intent is to sell it or use it for commercial advantage or malicious harm (42 U.S.C. 1320d-6).
Breach notification deadlines
| Notify | When |
|---|---|
| Affected individuals | Without unreasonable delay, and no later than 60 days after discovery |
| HHS, breach of 500 or more people | Within 60 days of discovery |
| HHS, fewer than 500 people | Within 60 days of the end of the calendar year |
| Media | When more than 500 residents of a state or jurisdiction are affected |
State breach laws can be stricter. Our US breach notification estimator covers them.
How to lower your exposure
The tier depends on what you knew and what you did about it, so the controls that keep you in Tier 1 or 2 are the ones that show diligence:
- A documented, enterprise-wide risk analysis, kept current. Its absence is one of the most common findings in OCR enforcement.
- A risk management plan that actually closes what the analysis found.
- Access controls, unique user IDs and MFA on systems holding ePHI.
- Audit logs that someone reviews.
- Encryption of ePHI at rest and in transit.
- Business associate agreements with every vendor that can access ePHI.
- Fixing problems quickly once you know about them: correction within 30 days is the difference between Tier 3 and Tier 4.
We do the technical side: risk analysis input, access control, logging, encryption and testing. See healthcare IT.
Sources
- 45 CFR 160.404: penalty tiers (eCFR)
- 45 CFR 102.3: current inflation-adjusted amounts (eCFR)
- HHS inflation adjustment, Federal Register, 28 January 2026
- HHS Notification of Enforcement Discretion, 30 April 2019
- 45 CFR Part 164 Subpart D: breach notification (eCFR)
- 42 U.S.C. 1320d-5 and 42 U.S.C. 1320d-6
Facts checked against the sources above on 22 October 2026. General information, not legal advice.