HIPAA Penalty Tiers Explained (2026): Civil and Criminal Penalties

Civil money penalties are defined in the HITECH Act amendments to the Social Security Act (42 U.S.C. 1320d-5) and in HHS's regulations at 45 CFR 160.404. The tier depends on what the covered entity or business associate knew and how it responded.

• Tier 1 — Did not know: the entity did not know of the violation and, by exercising reasonable diligence, would not have known.
• Tier 2 — Reasonable cause: the violation was due to reasonable cause and not willful neglect.
• Tier 3 — Willful neglect, corrected: the violation was due to willful neglect and was corrected within 30 days of when the entity knew, or should have known, of it.
• Tier 4 — Willful neglect, not corrected: the violation was due to willful neglect and was not corrected within that 30-day period.

In April 2019, OCR published a Notification of Enforcement Discretion (84 FR 18151). It reads the HITECH Act as allowing lower calendar-year caps for the less culpable tiers, and OCR said it would apply those caps until further notice.

The base annual caps in that notice, before inflation adjustment, are $25,000 for Tier 1, $100,000 for Tier 2, $250,000 for Tier 3 and $1,500,000 for Tier 4. These caps are also adjusted for inflation each year, so check the current HHS figures before relying on a specific number.

Criminal penalties are set by 42 U.S.C. 1320d-6 and are enforced by the Department of Justice, not OCR. They apply to a person who knowingly obtains or discloses individually identifiable health information in violation of HIPAA.

• Knowingly: a fine of up to $50,000, imprisonment of up to 1 year, or both.
• Under false pretenses: a fine of up to $100,000, imprisonment of up to 5 years, or both.
• With intent to sell, transfer or use the information for commercial advantage, personal gain or malicious harm: a fine of up to $250,000, imprisonment of up to 10 years, or both.

Section 13410(e) of the HITECH Act lets state attorneys general bring civil actions in federal court for HIPAA violations affecting residents of their state. That is separate from any action under state law, such as Texas HB 300.

Under 45 CFR 160.408, OCR considers factors when it sets a civil money penalty, including:

• The nature and extent of the violation, including how many people were affected and how long it went on
• The nature and extent of the resulting harm, including physical, financial or reputational harm
• The entity's history of prior compliance, including earlier violations
• The entity's financial condition
• Other matters as justice may require

HHS describes its enforcement process as working first toward voluntary compliance: when OCR finds a problem, it tries to resolve the case through corrective action, technical assistance or a resolution agreement. HHS says that if an entity does not resolve the matter satisfactorily, OCR may then impose civil money penalties.

The failure frequently cited in OCR resolution agreements is the lack of an accurate and thorough risk analysis, which the Security Rule requires at 45 CFR 164.308(a)(1)(ii)(A). A written risk analysis, followed by documented remediation, is the foundation OCR looks for.

Public Law 116-321 (H.R. 7898), signed in January 2021, requires HHS to consider whether an entity had recognized security practices in place for the previous 12 months when it decides penalties, audit outcomes and other remedies. The law defines recognized security practices by reference to standards developed under the NIST Act (the basis of the NIST Cybersecurity Framework) and approaches developed under section 405(d) of the Cybersecurity Act of 2015 (the program behind HHS's Health Industry Cybersecurity Practices publication).

Start with the free HIPAA readiness self-check to see where your gaps are, or look at the HIPAA risk assessment service for a documented analysis your practice can keep on file.

A written incident response and breach notification plan also matters: how a practice handles a security incident, and whether it notifies on time, is part of what OCR reviews after a breach.

• HIPAA readiness self-check
• HIPAA risk assessment
• Incident response & breach notification planning