What are the penalties for a HIPAA breach?

How OCR enforcement works

HHS describes OCR's process as reviewing complaints, breach reports and compliance reviews. Where OCR finds a problem it may obtain voluntary compliance and corrective action, enter into a resolution agreement with a corrective action plan and a payment, or impose a civil money penalty. OCR may refer possible criminal violations to the Department of Justice.

The civil money penalty tiers

The HIPAA enforcement rule groups violations into four tiers of culpability:

1. the entity did not know, and with reasonable diligence would not have known, of the violation;
2. the violation was due to reasonable cause and not willful neglect;
3. the violation was due to willful neglect and was corrected within the required period; and
4. the violation was due to willful neglect and was not corrected.

Penalty amounts per violation and annual caps differ by tier and are adjusted for inflation. We do not reproduce the figures here; use the current amounts on the HHS enforcement pages.

Resolution agreements

HHS publishes its resolution agreements and civil money penalty notices on its resolution agreements page. Each lists the entity, the issues found and the terms. A breach report on our tracker does not mean a penalty was imposed.

State enforcement

State attorneys general can also enforce HIPAA in federal court, and they enforce their own state breach laws. See the state law pages and HIPAA vs state breach laws.