HIPAA Penalty Exposure Estimator
Three questions about your records, safeguards and documentation. You get the civil penalty tier or tiers your answers most resemble, with the official per-violation amounts and annual caps — clearly an estimate, not a quote or legal advice.
Step 1 of 3About 1 minute
About how many patient records does your practice hold?
The number of people affected is one of the factors OCR weighs under 45 CFR 160.408 when it sets a penalty amount.
Sources
- HIPAA Penalty Tiers Explained (2026): Civil and Criminal Penalties — our full guide to the tiers and amounts used here
- Federal Register: Annual Civil Monetary Penalties Inflation Adjustment (January 28, 2026)
- eCFR: 45 CFR Part 160, Subpart D (Imposition of Civil Money Penalties)
- Federal Register: Notification of Enforcement Discretion Regarding HIPAA Civil Money Penalties (April 30, 2019)
- HHS: HIPAA Compliance and Enforcement
- HHS: HIPAA Enforcement Process
- Congress.gov: H.R. 7898 (Public Law 116-321), recognized security practices
- Cornell LII: 42 U.S.C. 1320d-6 (Wrongful disclosure of individually identifiable health information)
This page is general information, not legal advice. Check current federal and Texas requirements with your attorney.