What Are the HIPAA Civil Money Penalty Tiers?

HIPAA civil money penalties are set in four tiers based on culpability: the entity did not know and, with reasonable diligence, would not have known; reasonable cause and not willful neglect; willful neglect corrected within 30 days of actual or constructive knowledge; or willful neglect not timely corrected. HHS announced no 2026 inflation adjustment.

Tiers. 45 CFR 160.404(b) sets minimum and maximum penalty amounts per violation, and a calendar-year cap for identical violations, for each of four culpability levels:

1. The covered entity or business associate did not know, and by exercising reasonable diligence would not have known, of the violation.
2. The violation was due to reasonable cause and not willful neglect.
3. The violation was due to willful neglect and was corrected within 30 days after the entity knew, or by exercising reasonable diligence would have known, of it.
4. The violation was due to willful neglect and was not corrected within that 30-day period.

Inflation adjustments. Penalty amounts are subject to statutory inflation adjustments under 45 CFR Part 102. HHS announced no additional 2026 inflation adjustment and continued the 2025 levels (91 FR 66566, Oct. 21, 2026). The 2025 adjustment, published January 28, 2026 (91 FR 3665), was not a separate 2026 increase.

Enforcement discretion. In a 2019 notice, HHS stated it would apply lower annual caps for the lower tiers, as adjusted for inflation, until further notice. This is enforcement discretion pending further notice, separate from the codified penalty table in 160.404. HHS considers factors in 45 CFR 160.408, such as the nature and extent of the violation and harm, in setting amounts.

Affirmative defenses and waivers. 45 CFR 160.410 and 160.412 provide limited affirmative defenses and waiver conditions, not an automatic cure for willful neglect.

Other outcomes. HHS may resolve matters by informal means, which "may include demonstrated compliance or a completed corrective action plan or other agreement" (45 CFR 160.312).

Note. Learn Laws® is a training company, not a law firm. This FAQ summarizes federal rules for general information and is not legal advice. HHS and OCR do not endorse any private consultants' or education providers' seminars, materials or systems, and do not certify any persons or products as "HIPAA compliant."