HIPAA penalty tiers: the current civil penalty amounts
HIPAA civil penalties come in four tiers keyed to culpability, set by the HITECH Act and adjusted for inflation every year. As codified today at 45 CFR 102.3, they run from $145 per violation where the practice could not have known, up to $2,190,294 per violation for willful neglect left uncorrected, with an annual cap of $2,190,294 for violations of an identical provision. The tier depends on what you knew, what you documented, and how fast you fixed it.
Researched and written by Larry Osakwe · Last verified July 15, 2026
Checked against the 45 CFR 102.3 table via the eCFR. Not a lawyer, not a certified compliance professional, and not affiliated with HHS.
The four penalty tiers, with current amounts
These are the amounts in Table 1 to 45 CFR 102.3 as codified today, reflecting HHS’s 2025 annual inflation adjustment published January 28, 2026 (91 FR 3665, FR Doc. 2026-01688). Each “violation” is a single failure to comply with a single provision; a lost laptop or an unsigned vendor can count as many.
| Tier | Culpability standard | Per violation (min–max) | Annual cap (identical provision) |
|---|---|---|---|
| Tier 1 | No knowledgeThe practice did not know of the violation and, exercising reasonable diligence, would not have known.45 CFR 160.404(b)(2)(i) | $145–$73,011 | $2,190,294 |
| Tier 2 | Reasonable causeThe violation was due to reasonable cause and not to willful neglect.45 CFR 160.404(b)(2)(ii) | $1,461–$73,011 | $2,190,294 |
| Tier 3 | Willful neglect, correctedThe violation was due to willful neglect but was corrected within 30 days of when the practice knew, or should have known, of it.45 CFR 160.404(b)(2)(iii) | $14,602–$73,011 | $2,190,294 |
| Tier 4 | Willful neglect, not correctedThe violation was due to willful neglect and was not corrected within that 30-day window.45 CFR 160.404(b)(2)(iv) | $73,011–$2,190,294 | $2,190,294 |
The civil monetary penalty amounts are adjusted annually; when HHS publishes the next adjustment, the authoritative numbers are always the current 45 CFR 102.3 table. The tier definitions themselves live at 45 CFR 160.404.
The annual caps OCR actually applies are lower
The codified table applies the same annual cap to all four tiers. In April 2019, HHS announced that it reads the HITECH Act differently and, as a matter of enforcement discretion pending further rulemaking, applies a separate annual limit to each tier (Notification of Enforcement Discretion Regarding HIPAA Civil Money Penalties, 84 FR 18151, April 30, 2019). The notice’s caps, stated in 2019 dollars and applied “as adjusted for inflation”:
| Culpability | Annual limit (2019 dollars) |
|---|---|
| No knowledge | $25,000 |
| Reasonable cause | $100,000 |
| Willful neglect, corrected | $250,000 |
| Willful neglect, not corrected | $1,500,000 |
HHS publishes no codified table of these discretion caps as adjusted, so we won’t invent current figures; the practical point is that for anything short of uncorrected willful neglect, OCR’s stated yearly exposure ceiling is far below the codified $2,190,294. Discretion is not a right: the notice creates no legal obligations and no legal rights, and HHS can revisit it.
What is the maximum HIPAA fine?
Under the current codified table at 45 CFR 102.3, the maximum civil penalty is $2,190,294 for all violations of an identical HIPAA provision in a calendar year, and up to $2,190,294 per violation for uncorrected willful neglect. For the three lower culpability tiers the per-violation maximum is $73,011. These figures reflect HHS's 2025 annual inflation adjustment (91 FR 3665, published January 28, 2026) and rise with each year's adjustment. Separately, OCR announced in 2019 that as a matter of enforcement discretion it applies lower annual caps to the three lower tiers: $25,000, $100,000, and $250,000 in 2019 dollars, adjusted for inflation.
Can a small practice really get fined?
Yes. Nothing in the penalty rules exempts small practices: the tiers apply to every covered entity and business associate, from a solo practice to a hospital system. OCR has publicly announced enforcement actions against small and solo providers, most visibly under its Right of Access initiative, where many of the announced resolutions involved small practices. In practice OCR resolves most investigations of small practices through voluntary corrective action or settlement rather than maximum-tier penalties, and documented good-faith compliance is what moves a case toward the lower tiers.
What triggers an OCR investigation?
Three main routes. First, complaints: anyone (a patient, an employee, a competitor) can file a complaint with OCR, which is required by 45 CFR 160.306 to investigate when a preliminary review indicates a possible violation due to willful neglect. Second, breach reports: breaches affecting 500 or more people, which must be reported to HHS under 45 CFR 164.408, are investigated as a matter of course, and smaller reported breaches can be too. Third, compliance reviews and audits: OCR may open a compliance review on its own initiative under 45 CFR 160.308, including after media reports, and the HITECH Act directs HHS to conduct periodic audits.
Not sure the penalty rules even apply to you? Start with the covered-entity test, profession by profession.
What moves a practice down the tiers: documentation
The tier structure is a documentation test wearing a penalty schedule. Tier 1 turns on whether you exercised reasonable diligence; tiers 3 and 4 turn on whether willful neglect was corrected within 30 days. Every one of those questions is answered by paper: a documented risk analysis, adopted policies, a training log, signed BAAs, and a breach procedure you can show you followed. A practice that can produce the standard nine-document set is arguing for the bottom of the table; a practice with nothing in writing is arguing for willful neglect. Weighing the paperwork against the risk? See is HIPAA compliance worth it.
Sources
- www.ecfr.gov/current/title-45/subtitle-A/subchapter-A/part-102/section-102.3
- www.federalregister.gov/documents/2026/01/28/2026-01688/annual-civil-monetary-penalties-inflation-adjustment
- www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-D/section-160.404
- www.federalregister.gov/documents/2019/04/30/2019-08530/notification-of-enforcement-discretion-regarding-hipaa-civil-money-penalties
- www.hhs.gov/hipaa/for-professionals/compliance-enforcement/index.html
Last verified July 15, 2026. Dollar amounts are the codified figures in Table 1 to 45 CFR 102.3 reflecting HHS’s 2025 annual inflation adjustment (91 FR 3665, published January 28, 2026); they change with each annual adjustment, so confirm against the current 102.3 table before relying on them. Educational self-help information about HIPAA enforcement, not legal advice and not a prediction of any penalty in any case; actual penalties depend on the facts, aggravating and mitigating factors under 45 CFR 160.408, and OCR’s discretion. If you are facing an OCR investigation, talk to a qualified attorney. State attorneys general can also enforce HIPAA, and state law may add separate penalties.
The cheapest tier is the one you document your way into
The complete nine-document binder, built to order for your practice and state, with every policy citing the rule that requires it.
See the binder and pricing