HIPAA Security Rule penalties: amounts and what drives them

What can a HIPAA Security Rule penalty cost, and what decides the amount?

If a regulator inquiry, a breach or a customer contract now demands proof of Security Rule compliance, the first number to know is the exposure. For penalties assessed on or after January 28, 2026, the inflation-adjusted civil money penalty for violations on or after February 18, 2009 ranges from $145 to $2,190,294 per violation, and the calendar-year cap for identical violations is $2,190,294. The low end applies where the entity did not know of the violation, and the high end applies to uncorrected willful neglect, so the spread between those two outcomes is what makes the tier and the response so consequential. The culpability tier decides where an organization lands within that range. HHS sorts violations into four tiers: did not know, reasonable cause, willful neglect corrected within 30 days, and willful neglect not corrected. Time to correct matters because a violation that is fixed inside the correction window moves out of the uncorrected tier. The documented risk analysis matters because it is the first record an investigator requests, and it shows whether the entity knew about a risk and acted on it. An organization that can show a current analysis, a risk management plan and dated corrective steps is in a far stronger position than one that cannot.

Ownership of these decisions stays with the organization. It owns its controls, its risk analysis and its response to any finding. An implementation partner can prepare systems, configuration records and evidence, but that work does not change the tier and does not shield the entity from liability. Penalties are set by HHS, and no private certifier or consultant can reduce or waive them. Ask any outside party to state in writing what it delivers and what it does not, and confirm with counsel how the entity's own records would read to an investigator. The current amounts are published in 45 CFR 102.3, and that table should be checked again before any budget decision, since the figures are adjusted each year.

How the four culpability tiers set the per-violation range

This table compares the four culpability tiers in 45 CFR 160.404 with the inflation-adjusted per-violation range and the calendar-year cap that apply to penalties assessed on or after January 28, 2026. Amounts are adjusted annually under 45 CFR Part 102 and cover violations that occurred on or after November 2, 2015. Read each row from left to right: the tier depends on what the entity knew and how quickly it corrected the problem, the tier sets the floor and ceiling for each violation, and the cap limits total penalties for identical violations in one calendar year.

Culpability tier	What it means in plain terms	Adjusted range per violation	Calendar-year cap
Did not know	The entity did not know of the violation and, using reasonable diligence, would not have known.	$145 to $73,011 per violation	$2,190,294 per calendar year
Reasonable cause	The entity knew or should have known of the violation, but the failure was not willful neglect.	$1,461 to $73,011 per violation	$2,190,294 per calendar year
Willful neglect, corrected within 30 days	Conscious or reckless indifference to the requirement, cured within 30 days of learning of the problem.	$14,602 to $73,011 per violation	$2,190,294 per calendar year
Willful neglect, not corrected	Conscious or reckless indifference to the requirement, with no correction inside the 30-day window.	$73,011 to $2,190,294 per violation	$2,190,294 per calendar year

How an investigator decides which tier applies

The tier an investigator assigns turns on three questions: what the entity knew about the violation, why the violation happened, and what the entity did once it learned of it. The four culpability tiers under 45 CFR 160.404 separate an entity that did not know and could not reasonably have known from one that acted with willful neglect, and willful neglect is further split by whether the entity corrected the problem within 30 days of when it first knew or should have known. Reasonable cause sits between these ends. Each question is answered from the entity's own records, so the file an organization assembles before any contact with OCR matters as much as the conduct it describes.

The documents an entity would put in front of OCR are a current, written risk analysis and dated remediation records. A risk analysis that identifies where electronic protected health information lives, rates the threats and vulnerabilities, and shows which measures were chosen shows that the entity was assessing its exposure rather than ignoring it. Remediation records that show what was fixed, who approved the fix, and when it was completed establish the timeline that the 30-day window depends on. Confirm internally how your organization dates the moment it first learned of a gap, because that date, not the date the gap was fixed, anchors the correction period.

A certificate or seal does not change the tier. HHS states in its 2003 FAQ that it does not endorse or recognize private organizations' certifications and that such certifications do not prevent a later finding of violation. An investigator will therefore look past a seal to the same evidence described above. Any statement about tier outcomes depends on the facts of a specific case, and the organization should not treat this section as a forecast of how OCR will classify its own conduct.

What raises or lowers exposure in a specific case

Penalty amounts are not fixed by the violation alone. OCR weighs how many violations occurred, how long they lasted, how quickly the entity acted once it knew, and what its own records show about its risk analysis and history. Each factor below can be shaped before an inquiry starts.

Number and counting of violations

Penalties are assessed per violation, and identical violations are subject to a calendar-year cap. Each unprotected system, unsigned business associate agreement or missing policy may be counted separately, so the count depends on how the entity scopes its findings. Before an inquiry, inventory where ePHI lives and which safeguards fail on each system, so the entity can explain its own exposure accurately and fix shared causes once rather than system by system. Ask your counsel how the cap applies to your facts.

Length of the compliance gap

A gap that lasted one week and a gap that ran for years are different facts, even when the same safeguard failed. Duration shapes how an investigator reads the culpability tier and whether the failure looks isolated or systemic. Entities can control this by tracking when each safeguard was last verified, setting review dates for policies and access rights, and recording when a gap was found and closed. Dated records make the duration provable in either direction.

Correction within 30 days

Under the willful neglect tiers, correcting the failure within 30 days of when the entity knew or should have known of it moves the violation into a lower tier and a lower per-violation range. The 30-day window starts at knowledge, so detection speed matters as much as the fix itself. Before an inquiry, define who receives security alerts, how findings are triaged, and who can approve emergency changes. Keep a correction log that records the date of knowledge, the action taken and the verification result.

Size and financial condition

HHS has considered an entity's size and financial condition when setting a penalty, and it has reduced penalties where payment would threaten the entity's ability to keep operating. The MMG Fusion settlement of March 2026 reflected its financial condition. Entities that expect to rely on this factor should be able to show current financial records accurately and early, and should not expect it to apply automatically. Confirm with counsel how financial documentation is requested and submitted during an OCR matter.

Prior history with OCR

An entity with earlier complaints, resolution agreements or penalties may face a harsher response to a new matter, because OCR looks for whether earlier corrective action actually changed behavior. Prior history also includes commitments made in an earlier resolution agreement, which carry ongoing obligations. Entities can reduce this risk by tracking every OCR correspondence, completing each corrective commitment on schedule, and confirming that the fix persisted at the next review rather than only at sign-off.

Quality of the risk analysis

A current, thorough risk analysis is the first document OCR requests, and investigators compare it to what the entity actually runs. A risk analysis that omits systems, predates major changes or has no linked risk management plan signals a failure to evaluate risk, which can raise the culpability tier and weaken every other mitigating factor. Before an inquiry, confirm the analysis covers all ePHI systems, is dated and updated after material changes, and records which risks were accepted, reduced or transferred, with the reason for each decision.

Does HHS's 2019 enforcement discretion notice lower the annual cap?

For most violations, HHS now applies lower annual limits than the statutory cap. In April 2019, HHS issued an enforcement discretion notice (84 FR 18151) setting annual limits by culpability tier of $25,000, $100,000, $250,000 and $1.5 million, before inflation adjustment. The notice states that these limits apply indefinitely while HHS conducts rulemaking on the penalty framework. Read it as a statement of how HHS will exercise its enforcement discretion, not as an amendment to 45 CFR 160.404 or 45 CFR 102.3. The regulation's amounts, including the adjusted calendar-year cap of $2,190,294 for identical violations, remain the legal reference point for what a penalty could reach.

The practical question is which figure a given case will be measured against. The lower annual limits are the figures HHS has said it applies in enforcement discretion, but the notice does not remove the statutory ceiling, and the adjusted amounts in 45 CFR 102.3 apply to penalties assessed on or after January 28, 2026, for violations on or after November 2, 2015. A covered entity or business associate should not assume that the lower figure will govern its exposure. Whether the notice limits a specific penalty depends on the tier that OCR assigns, the dates of the violations, and the enforcement posture at the time of assessment.

Before relying on either figure in a board paper, insurance discussion or contract negotiation, ask OCR or qualified health care counsel to confirm how the notice applies to your facts, including the tier, the number of violations, and any corrective action already taken. Keep a written record of the analysis and the source documents used. Counsel can also confirm whether any rulemaking since 2019 has changed how the limits are applied, since the notice itself is conditioned on that rulemaking.

What happens after an OCR inquiry or breach report

The sequence moves from a complaint or breach report to a documented response, and ends in technical assistance, a resolution agreement or a civil money penalty. Each stage produces records the organization must be able to show OCR.

Complaint or breach report reaches OCR
An individual, a business associate, a state agency or the covered entity itself reports a problem, either as a complaint or as a breach report. OCR opens a file and decides whether to investigate, run a compliance review or treat the matter as a technical assistance case. The organization usually learns of this through a written notice. Your first output is a named internal owner, usually the security official, who confirms receipt and starts a case file that records dates, the people involved and the systems affected.
Preserve evidence and contain the issue
Before answering OCR, the organization secures logs, configuration records, access reports and incident notes so that nothing is overwritten during the response. Containment steps, such as disabling a compromised account or isolating a server, are recorded with time, person and reason. The check that closes this step is a preserved evidence set with a written inventory, and a timeline that separates what was known at the time from what was learned later.
Respond to the OCR data request
OCR sends a written data request asking for specific documents, which typically include the risk analysis, risk management plan, written policies and procedures, training records, business associate agreements, and records of the incident itself. The organization assembles these, provides a cover index, and answers each item in the terms of the request. Counsel usually reviews the response before it is sent. The output is a complete, dated submission that matches what the organization actually did, not a document written for the occasion.
Document the gap and the root cause
The most useful records for OCR are the ones that show the organization found the gap itself. The security official compares the submitted documents with the Security Rule standards and implementation specifications, identifies which were not met or not documented, and records a root cause. For addressable specifications, this includes the documented assessment of whether each measure was reasonable and appropriate. The check that closes this step is a written gap analysis signed by the responsible executive.
Build and execute the corrective action plan
The corrective action plan lists each deficiency, the remediation action, the accountable owner and the evidence that will prove completion. Remediation evidence might include updated risk analysis entries, revised policies, training completion reports, configuration exports showing a control in place, or signed business associate agreements. OCR weighs whether the plan is specific and whether the work is finished. The timeline should come from the organization's own planning and any dates OCR sets, not from assumptions in this guide.
Reach technical assistance or a resolution agreement
HHS states that most OCR cases end in resolution agreements rather than civil money penalties. Where the organization demonstrates compliance or completes corrective action, OCR may close the matter with technical assistance or with a resolution agreement that sets out obligations and monitoring. The output is a signed agreement and the progress reports it requires. Ask counsel to confirm the monitoring terms and what evidence each report must include before signing.
Face a civil money penalty when resolution fails
HHS imposes civil money penalties when it cannot reach a satisfactory resolution through demonstrated compliance or corrective action. The amount depends on the culpability tier of each violation and the adjusted per-violation and calendar-year figures in the penalty regulation. The organization may contest the penalty through the administrative process described in HHS rules. The output at this stage is the penalty notice, the record of the case, and a decision on whether to pursue review, which counsel should evaluate against the evidence already on file.

How to reduce exposure before an inquiry

Penalty exposure under the Security Rule depends heavily on what an organization can show about its own decisions before OCR asks. The cards below cover the records and reviews that connect those decisions, and the organization owns every action even when an implementation partner helps prepare the evidence.

Keep a current, documented risk analysis

The organization owns its risk analysis, and OCR typically asks for it first. Confirm it covers every system that creates, receives, maintains or transmits electronic PHI, including cloud services, backups, laptops and vendor-hosted tools, and that it records the date, the people involved and the threats considered. Update it after material changes such as a new system, a merger or a security incident. An implementation partner can help map ePHI locations and prepare the documentation, but the analysis and its conclusions remain the organization's.

Correct known gaps and record dates

When the risk analysis or an audit finds a gap, the organization owns the fix and the record of it. Penalty tiers turn heavily on whether an entity knew of a violation and whether it corrected it within the period the regulation sets, so the dated corrective action plan matters as much as the fix itself. Keep tickets, change records and sign-off notes that show when each gap was identified, who owned it and when it closed. Confirm the 30-day window for willful neglect with counsel, since timing is central to tier selection.

Document addressable specification decisions

For each addressable implementation specification, the organization owns the decision to implement, implement an equivalent alternative, or not implement, with the reason. Undocumented choices are hard to defend because the rule requires the assessment to be recorded. Keep a dated decision record tied to the risk analysis, and revisit it when the environment or threat picture changes. A consultant can help structure the record and check it against the standards, but cannot make the decision on the organization's behalf.

Retain policies and documentation for six years

The organization owns retention of written Security Rule policies, procedures and the records that show they were followed. The rule requires documentation to be kept for six years from the date of creation or the date last in effect, whichever is later, and made available to the people who maintain it. Check that backups of policy repositories, access logs, training records and sign-offs survive system migrations and vendor changes. An implementation partner can design the retention scheme and test retrieval, but the records belong to the organization.

Review business associate agreements

The organization owns its business associate agreements and the obligations they pass to vendors and subcontractors. Confirm each agreement names the Security Rule safeguards the vendor must apply, requires incident reporting, and flows the same duties down to subcontractors handling ePHI. Penalties can follow a covered entity whose vendor failed to protect ePHI, so an unsigned or outdated agreement is a common gap. An implementation partner can help inventory vendors and prepare evidence requests, but the contracts and the decision to accept a vendor's assurances stay with the organization.

Who owns the controls, who prepares evidence, and who decides penalties

The covered entity or business associate is the party the Security Rule binds. It decides which safeguards apply, how the risk analysis is scored, which addressable specifications it adopts or replaces with an alternative, and how risks are reduced. When OCR opens an inquiry, the organization is the one that answers, produces records and negotiates any resolution. Outside help can shape the work, but it does not transfer the legal obligation.

Control ownership: The entity owns the safeguards in its environment, including workforce access, encryption choices and audit log review, even when a vendor operates the systems.
Risk decisions: Choices about accepting, mitigating or transferring risk are documented by the entity, with reasons tied to its risk analysis.
Addressable specification decisions: The entity records whether each addressable specification is reasonable and appropriate, and if not, what equivalent measure it uses.
Corrective action: Remediation plans, timelines and evidence of completion belong to the entity, including any corrective action plan agreed with OCR.
Responses to OCR: The entity's security official and counsel handle document requests, interviews and deadlines.

Before you engage anyone, confirm in writing which named individual in your organization approves each risk decision and signs the response to OCR.

HIPAA Security Rule penalty questions buyers ask

What is the maximum HIPAA penalty per violation?

For penalties assessed on or after January 28, 2026, the inflation-adjusted civil money penalty for violations on or after February 18, 2009 runs from $145 per violation where the entity did not know of the violation, up to $2,190,294 per violation for uncorrected willful neglect. The calendar-year cap for identical violations is also $2,190,294 across all tiers (45 CFR 102.3, 91 FR 3666). The tier that applies depends on what the organization knew, how quickly it acted once it knew, and whether it corrected the problem within 30 days. Amounts are adjusted for inflation each year, so confirm the current figures in the Federal Register before relying on them.

Does a HIPAA certification reduce penalties?

No. HHS states that it does not endorse or recognize private organizations' HIPAA certifications, and that a certificate does not prevent HHS from later finding a violation. What matters in an enforcement case is the evidence of what the organization actually did: a current risk analysis, a risk management plan, written policies, and records showing those controls operated. Penalty tiers turn on the organization's knowledge and its response to known problems. A third-party report can support that record, but only the evidence itself supports the organization's position. No action guarantees a lower penalty.

Do the lower HHS caps apply to my case?

They may, but you cannot assume it. Under its April 2019 enforcement discretion notice, HHS applies lower annual limits by culpability tier: $25,000, $100,000, $250,000 and $1.5 million before inflation adjustment (84 FR 18151). The notice has remained in effect pending rulemaking, so OCR can apply these lower annual caps instead of the full inflation-adjusted cap. Whether they apply depends on the case and the tier. Ask counsel to confirm how the current notice and the adjusted figures in 45 CFR 102.3 interact for your facts, and do not treat the lower caps as a planning figure.

Is a HIPAA settlement the same as a civil money penalty?

No. Most OCR cases end in resolution agreements rather than civil money penalties. A resolution agreement usually includes a settlement amount and a corrective action plan that the organization must carry out for a set monitoring period. HHS imposes civil money penalties when it cannot reach a satisfactory resolution through demonstrated compliance or corrective action. Settlement amounts are set case by case, so recent figures do not predict your outcome. Recent Security Rule settlements include Ambry Genetics at $700,000 (September 2026) and MMG Fusion at $10,000 (March 2026), with the lower amount reflecting its financial condition. Read the agreement itself on HHS's agreements page.

How long can an OCR investigation take, and what does OCR request?

The timeline depends on the trigger and the complexity of the case, and no supplied figure sets a standard duration, so confirm expected timelines with counsel. OCR opens cases through complaints, compliance reviews after breach reports, or audits under its HIPAA Audit Program. In a Security Rule matter, the first request is usually the risk analysis, followed by the risk management plan, written policies and procedures, training records, access reviews, audit log review evidence, business associate agreements and incident response records. Organizations that keep these documents current and can produce them quickly tend to narrow the scope of an inquiry.

Can a consultant prevent HIPAA penalties?

No outside party can guarantee that a penalty will not be imposed. A consultant or implementation partner can help build the risk analysis, policies, technical safeguards and evidence that OCR asks for, and that work reduces the chance of a violation and strengthens the organization's position. The covered entity or business associate still owns its compliance decisions and the security official role. DeployOpen plans, implements, hardens and documents self-hosted open-source platforms inside the client's own infrastructure and prepares evidence, but it does not issue audit reports or attestations. Before engaging anyone, ask for a written scope that names the deliverables and the evidence each one produces.

How DeployOpen prepares Security Rule evidence before an inquiry

DeployOpen plans, implements, hardens and documents self-hosted open-source platforms inside your own infrastructure, so the systems that hold electronic protected health information can show the safeguards they rely on. We prepare systems and evidence for your assessment. The covered entity or business associate owns its controls, and only an independent assessor or regulator reaches conclusions about compliance.

How we scope

Engagements are fixed-scope, with systems, deliverables and timelines agreed in writing before work starts.
The written scope names which ePHI systems, hosting environments and safeguards are covered by the work.
Scope also states which decisions stay with your security official, such as risk acceptance and addressable specification choices.

How we build

We configure access control, audit logging, encryption and backup on the platforms named in the agreed scope.
Security testing of applications, APIs and infrastructure is scoped separately and documented against the same safeguards.
Configuration changes are recorded so you can show when each safeguard was put in place and by whom.

How we hand over

You receive documentation that maps each delivered safeguard to the Security Rule requirement it supports.
Handover includes configuration records, test results and runbooks your team can use during an OCR inquiry.
Gaps we find are listed with owners, so your organization decides on remediation and records the outcome.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after the initial engagement ends.
Retainers keep evidence current as platforms change, so logs, backups and configurations stay accurate for inquiries.
Ask any provider to confirm in writing which evidence they produce and which decisions remain with your organization.

HIPAA Security Rule penalties