2026 HIPAA Penalty Amounts — Updated Figures Every Compliance Officer Needs

Every January, HHS publishes updated HIPAA civil money penalty amounts adjusted for inflation. The 2026 figures — published in the Federal Register on January 28, 2026 — are now in effect for all HIPAA enforcement actions. Here are the current numbers every compliance officer needs to know.

2026 HIPAA penalty amounts by tier

The penalty amounts are adjusted annually to account for the cost-of-living increases. The last update, published in the Federal Register on January 28, 2026, applies to all financial penalties imposed after November 2, 2015. The inflation multiplier for 2025 set by the Office of Management and Budget was 1.02598.

Tier 1 — Did not know The covered entity or business associate did not know and would not have known of the violation through reasonable diligence.

• Per violation: $145 to $73,011
• Annual cap (OCR discretion): $36,506 per violation category

Tier 2 — Reasonable cause The violation was due to reasonable cause — the organization knew or should have known of the potential for a violation.

• Per violation: $1,463 to $73,011
• Annual cap (OCR discretion): $146,053 per violation category

Tier 3 — Willful neglect, corrected The violation was due to willful neglect but was corrected within 30 days of discovery.

• Per violation: $14,626 to $73,011
• Annual cap (OCR discretion): $365,052 per violation category

Tier 4 — Willful neglect, not corrected The violation was due to willful neglect and was not corrected within 30 days.

• Per violation: $73,011
• Annual cap (statutory maximum): $2,190,294 per violation category

How OCR actually calculates penalties

Understanding the penalty structure requires understanding how OCR applies it in practice. Several factors shape the final penalty amount:

Multiple violations stack. Annual caps apply per violation category — not per incident. A single ransomware attack that reveals failures in risk analysis (Tier 3), breach notification timing (Tier 2), and access controls (Tier 3) creates three separate penalty tracks with three separate annual caps running simultaneously.

OCR prefers settlements. The vast majority of OCR enforcement actions resolve through resolution agreements rather than civil money penalties. Settlements typically result in lower payments than the maximum penalty amount in exchange for the entity agreeing to a corrective action plan. OCR continues active enforcement through investigations and compliance reviews.

Financial condition is considered. OCR is required to consider the financial condition of the covered entity or business associate when determining penalty amounts. Smaller organizations and those with demonstrated financial hardship typically receive lower penalties — though this does not eliminate penalties entirely.

Prompt self-reporting helps. Organizations that promptly self-report violations, cooperate fully with OCR's investigation, and demonstrate good-faith remediation efforts consistently receive more favorable treatment than those that delay, resist, or conceal violations.

Recognized security practices reduce penalties. Under HITECH Act provisions, organizations that can demonstrate adoption of recognized security practices — including NIST Cybersecurity Framework and HHS 405(d) practices — are eligible for reduced penalties and shortened audit periods.

The enforcement discretion question

OCR continues to apply a 2019 enforcement discretion that lowers annual caps for Tiers 1–3, while Tier 4's cap remains at $2,190,294. OCR may revise this approach in future rulemaking.

This is an important caveat. The reduced annual caps for Tiers 1 through 3 are the result of an administrative enforcement discretion policy — not a statutory change. OCR could revise or withdraw this policy at any time, potentially restoring higher annual caps without Congressional action. The statutory maximum annual caps — which the discretion currently holds in check — are significantly higher than the figures OCR currently applies.

OCR has been pushing Congress to increase the maximum penalties for HIPAA violations, as the total funds from OCR's enforcement actions decreased significantly when the new penalty structure was introduced.

Organizations should plan compliance programs against the current enforced figures while being aware that penalty levels could increase through future policy or legislative action.

Criminal penalties — a separate track

Civil money penalties are not the only financial risk. HIPAA violations involving knowing or intentional conduct can result in criminal prosecution through the Department of Justice. Criminal penalties include:

• Knowingly obtaining or disclosing PHI: up to 1 year imprisonment and $50,000 fine
• PHI obtained under false pretenses: up to 5 years imprisonment and $100,000 fine
• PHI obtained with intent to sell or use for personal gain: up to 10 years imprisonment and $250,000 fine

Criminal prosecutions are relatively rare but occur in cases involving employee theft of patient data, sale of PHI, and unauthorized access to celebrity or public figure records.

State enforcement — an additional layer

The HHS Office for Civil Rights is continuing with its HIPAA right of access and risk analysis enforcement initiatives. But OCR is not the only enforcement authority organizations face.

State attorneys general have independent authority to bring HIPAA enforcement actions on behalf of state residents. New Jersey, New York, California, and several other states have active enforcement programs that operate alongside OCR. State enforcement can result in additional penalties on top of any OCR action and may be triggered by the same incident.

Organizations operating in states with active AG enforcement programs face compounded exposure — two separate investigations, two separate penalty tracks, from two different agencies — for the same underlying incident.

What these numbers mean for compliance investment

The penalty figures make the economics of HIPAA compliance straightforward. A single Tier 3 violation — willful neglect that is corrected — carries a minimum per-violation penalty of $14,626. A comprehensive HIPAA compliance program costs far less than that annually, particularly when using tools like medcomply.ai's Risk Assessment, BAA Generator, and training modules.

The question is not whether compliance investment is worth it. The question is whether your organization will make that investment proactively — before an incident — or reactively, after OCR has already opened an investigation.