Written and maintained by CASRAI Editorial Board
Last updated
Regulatory & Legal Notice: This reference summarizes federal statutory and regulatory penalty provisions from Title 42 of the U.S. Code and Title 45 of the Code of Federal Regulations for healthcare compliance, clinical research governance, and health informatics professionals. It does not constitute legal advice.
Privacy officers, hospital general counsel, and clinical research administrators evaluating HIPAA violation penalties (and HIPAA fines and penalties) must distinguish among three intersecting federal schedules: (1) the statutory base Civil Money Penalty (CMP) tiers enacted by the HITECH Act under 42 U.S.C. § 1320d-5 and codified at 45 CFR § 160.404, (2) the annual inflation-adjusted civil penalty multipliers published by HHS in 45 CFR § 102.3 (alongside HHS OCR’s 2019 Notice of Enforcement Discretion), and (3) federal criminal penalties prosecuted by the U.S. Department of Justice (DOJ) under 42 U.S.C. § 1320d-6.
What Are HIPAA Violation Penalties?
HIPAA violation penalties are the federal civil monetary fines, corrective action plans, and criminal sentences imposed on Covered Entities, Business Associates, and individuals who violate the HIPAA Privacy Rule, HIPAA Security Rule, or HIPAA Breach Notification Rule. Civil enforcement is administered by the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) under the HIPAA Enforcement Rule (45 CFR Part 160, Subparts C, D, and E) and State Attorneys General under 42 U.S.C. § 1320d-5(d), while knowing wrongful disclosures of individually identifiable health information are referred to the U.S. Department of Justice (DOJ) for criminal prosecution.
The 4-Tier HIPAA Civil Money Penalty (CMP) Schedule (45 CFR § 160.404 & 45 CFR § 102.3)
Under 45 CFR § 160.404(b)(2), HHS OCR assigns every civil violation to one of four culpability tiers based on the entity’s knowledge of the violation and whether the entity acted with reasonable diligence, reasonable cause, or willful neglect. Because the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015 requires federal agencies to adjust statutory civil penalties annually for cost-of-living inflation (codified at 45 CFR § 102.3), compliance officers track both the original HITECH statutory base figures, the 2019 HHS OCR Notice of Enforcement Discretion annual caps (84 FR 18151), and the current 45 CFR § 102.3 inflation-adjusted schedule:
| HIPAA Culpability Tier (45 CFR § 160.404(b)(2)) | Statutory Definition (45 CFR § 160.401) | HITECH Statutory Base Range (Per Violation) | 45 CFR § 102.3 Inflation-Adjusted Range (Per Violation) | Annual Calendar-Year Cap for Identical Provisions (45 CFR § 102.3 vs. 2019 OCR Enforcement Discretion Base) |
|---|---|---|---|---|
Tier 1: Did Not Know (Unknowing)§ 160.404(b)(2)(i) |
The covered entity or business associate did not know and, by exercising reasonable diligence, would not have known that the person violated the administrative simplification provision. | $100 – $50,000 | $145 – $73,011 | $2,190,294 codified in 45 CFR § 102.3 ($25,000 statutory base cap under 2019 OCR Notice of Enforcement Discretion) |
Tier 2: Reasonable Cause§ 160.404(b)(2)(ii) |
The violation was due to reasonable cause (an act or omission in which a covered entity or business associate knew, or by exercising reasonable diligence would have known, that the act or omission violated HIPAA, but in which the entity did not act with willful neglect). | $1,000 – $50,000 | $1,461 – $73,011 | $2,190,294 codified in 45 CFR § 102.3 ($100,000 statutory base cap under 2019 OCR Notice of Enforcement Discretion) |
Tier 3: Willful Neglect — Corrected Within 30 Days§ 160.404(b)(2)(iii) |
The violation was due to willful neglect (conscious, intentional failure or reckless indifference to the obligation to comply with HIPAA) and was corrected within 30 days of the first date the entity knew, or by exercising reasonable diligence would have known, that the violation occurred. | $10,000 – $50,000 | $14,602 – $73,011 | $2,190,294 codified in 45 CFR § 102.3 ($250,000 statutory base cap under 2019 OCR Notice of Enforcement Discretion) |
Tier 4: Willful Neglect — Not Corrected Within 30 Days§ 160.404(b)(2)(iv) |
The violation was due to willful neglect and was not corrected within 30 days of discovery. | $50,000 minimum per violation | $73,011 – $2,190,294 | $2,190,294 per identical requirement or prohibition per calendar year ($1,500,000 statutory base) |
How OCR Counts Continuing Violations and Multiple Provision Breaches
A critical driver of multi-million-dollar HIPAA resolution agreements and CMP assessments is how 45 CFR § 160.406 calculates separate violations:
- Per-Day Continuing Violations: For a continuing violation (such as failing to conduct an enterprise-wide HIPAA Security Rule risk analysis under 45 CFR § 164.308(a)(1)(ii)(A), failing to execute a Business Associate Agreement under § 164.504(e), or failing to provide a patient timely access to medical records under § 164.524), each day the failure continues constitutes a separate violation up to the annual calendar-year cap for that provision.
- Stacking Caps Across Distinct C.F.R. Provisions: The annual calendar-year cap applies per identical requirement or prohibition per calendar year. If a single cyber incident or clinical data breach reveals simultaneous failures across four distinct provisions—for example, (1) failure to conduct an accurate risk analysis (`§ 164.308(a)(1)(ii)(A)`), (2) failure to implement audit controls (`§ 164.312(b)`), (3) impermissible disclosure of ePHI (`§ 164.502(a)`), and (4) failure to issue timely breach notification (`§ 164.404`)—and those failures persisted across multiple calendar years, OCR can stack the annual cap for each distinct C.F.R. citation across each calendar year.
How HIPAA Breach Notification Requirements Interact with Tier 3 vs. Tier 4 Penalties
Notice how the boundary between Tier 3 and Tier 4 willful neglect penalties hinges on a strict 30-calendar-day correction window (`45 CFR § 160.404(b)(2)(iii)`), while the HIPAA Breach Notification Rule (`45 CFR §§ 164.400–414`) enforces parallel statutory reporting clocks:
- The 30-Day Willful Neglect Correction Clock (`45 CFR § 160.404(b)(2)(iii)`): Begins on the first date the covered entity or business associate knew, or by exercising reasonable diligence would have known, that the underlying HIPAA violation occurred. Completing verifiable technical remediation (e.g., revoking exposed credentials, executing a missing BAA, or delivering overdue Right of Access records) within 30 days prevents escalation from Tier 3 to Tier 4.
- The 60-Day Breach Notification Clock (`45 CFR §§ 164.404–408`): Following discovery of a breach of unsecured PHI, the covered entity must notify affected individuals without unreasonable delay and in no case later than 60 calendar days after discovery; breaches affecting 500 or more individuals also require notification to the HHS Secretary (via the OCR Breach Portal) within 60 calendar days and prominent media notice in the affected state/jurisdiction, whereas breaches affecting fewer than 500 individuals must be logged and reported to the HHS Secretary within 60 days after the end of the calendar year (`45 CFR § 164.408(c)`).
Criminal Penalties for Wrongful HIPAA Disclosures (42 U.S.C. § 1320d-6)
When an individual—including a hospital employee, clinician, researcher, or business associate contractor—knowingly obtains or discloses individually identifiable health information in violation of HIPAA, the U.S. Department of Justice prosecutes criminal charges under 42 U.S.C. § 1320d-6 across three statutory tiers:
| DOJ Criminal Tier (42 U.S.C. § 1320d-6(b)) | Statutory Mens Rea / Conduct Element | Maximum Criminal Fine | Maximum Federal Imprisonment |
|---|---|---|---|
Tier 1: Knowing Wrongful Acquisition or Disclosure42 U.S.C. § 1320d-6(b)(1) |
Knowingly obtaining or disclosing individually identifiable health information in violation of Title II of HIPAA (e.g., unauthorized snooping in a celebrity, coworker, or family member’s EHR chart). | Up to $50,000 | Up to 1 year |
Tier 2: Offense Committed Under False Pretenses42 U.S.C. § 1320d-6(b)(2) |
Offense committed under false pretenses (e.g., impersonating an authorized clinician, using stolen EHR credentials, or misrepresenting clinical research authorization to extract patient records). | Up to $100,000 | Up to 5 years |
Tier 3: Intent to Sell, Transfer, or Use for Gain or Malicious Harm42 U.S.C. § 1320d-6(b)(3) |
Offense committed with intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm (e.g., selling patient lists, identity theft rings, or retaliatory disclosure). | Up to $250,000 | Up to 10 years |
How Are HIPAA Violation Penalties Mitigated in Clinical Research and Healthcare?
When HHS OCR evaluates a potential enforcement action or calculates a CMP amount, federal law mandates consideration of specific mitigating factors under 45 CFR § 160.408, 45 CFR § 160.410 (affirmative defenses), and 42 U.S.C. § 1320d-5(e):
- The Five Statutory Aggravating/Mitigating Factors (45 CFR § 160.408): OCR weighs (1) the nature and extent of the violation (number of individuals affected and duration), (2) the nature and extent of resulting physical, financial, or reputational harm, (3) the entity’s history of prior compliance or violations, (4) the financial condition of the covered entity or business associate and its ability to continue providing healthcare, and (5) such other matters as justice may require.
- HITECH Section 13412 “Recognized Security Practices” Safe Harbor (42 U.S.C. § 1320d-5(e), enacted by Public Law 116-321): Congress amended the HITECH Act in January 2021 to require HHS to consider whether a covered entity or business associate adequately demonstrates that it had recognized security practices—specifically standards, guidelines, and best practices under the NIST Cybersecurity Framework (NIST Act, 15 U.S.C. § 272(c)(15)) or Section 405(d) of the Cybersecurity Act of 2015 (Health Industry Cybersecurity Practices, HICP)—in place for not less than the previous 12 months. Demonstrating 12 months of continuous NIST CSF or 405(d) HICP implementation serves as a statutory basis to mitigate fines, reduce audit scope, and shorten corrective action plan terms.
- Clinical Research Governance (HIPAA in Clinical Research): Academic medical centers and clinical trial sites prevent unauthorized disclosure penalties (45 CFR § 164.508 & § 164.512(i)) by verifying before any EHR chart extraction or sponsor monitor view that every research access is backed by one of four lawful HIPAA pathways—a signed HIPAA Research Authorization, a documented IRB/Privacy Board Waiver of Authorization (`§ 164.512(i)(2)`), a Limited Data Set with an executed Data Use Agreement (`§ 164.514(e)`), or Safe Harbor/Expert Determination de-identification (`§ 164.514(b)`)—and by auditing controls against our HIPAA compliance checklist.
Frequently Asked Questions
What are the 4 tiers of HIPAA violation penalties?
Under 42 U.S.C. § 1320d-5 and 45 CFR § 160.404(b)(2), HIPAA civil money penalties are divided into four culpability tiers: Tier 1 (Did Not Know, even with reasonable diligence), Tier 2 (Reasonable Cause and not willful neglect), Tier 3 (Willful Neglect corrected within 30 days of discovery), and Tier 4 (Willful Neglect not corrected within 30 days). Under 45 CFR § 102.3 inflation adjustments, per-violation fines range from $145 in Tier 1 up to $2,190,294 in Tier 4, with a codified calendar-year cap of $2,190,294 per identical provision.
What are the criminal penalties for a HIPAA violation?
Criminal violations are prosecuted by the U.S. Department of Justice under 42 U.S.C. § 1320d-6 across three tiers: (1) knowingly obtaining or disclosing individually identifiable health information carries up to a $50,000 fine and 1 year in prison; (2) offenses committed under false pretenses carry up to a $100,000 fine and 5 years in prison; and (3) offenses committed with intent to sell, transfer, or use PHI for commercial advantage, personal gain, or malicious harm carry up to a $250,000 fine and 10 years in prison.
How are HIPAA violation penalties reduced or mitigated in healthcare and clinical research?
Under 45 CFR § 160.404(b)(2)(iii), correcting a violation within 30 calendar days of discovery prevents Tier 4 willful neglect penalties. Additionally, under HITECH Section 13412 (42 U.S.C. § 1320d-5(e)), HHS OCR must consider whether the organization has continuously implemented recognized security practices (such as the NIST Cybersecurity Framework or HHS 405(d) Health Industry Cybersecurity Practices) for at least the preceding 12 months when calculating fines and resolution terms.
