HIPAA Penalty Tiers: What Each Violation Actually Costs
Last updated: 2026-04-05 — ComplianceStack Editorial Team
HIPAA civil money penalties (CMPs) are structured in four tiers based on the covered entity's culpability — from "didn't know" to "willfully ignored." HHS OCR adjusts penalty amounts annually for inflation. The 2024–2026 figures range from $141 per unknowing violation up to $2,134,831 for the most egregious willful neglect. Understanding which tier applies to your situation is the first step to estimating real financial exposure.
Penalty Tier Breakdown
Tier 1 — Unknowing Violation
$141 – $71,162The covered entity did not know, and with reasonable diligence could not have known, that it violated HIPAA. Applies when the violation results from a good-faith but incorrect understanding of the rule.
Tier 2 — Reasonable Cause
$1,424 – $71,162The covered entity knew, or by exercising reasonable diligence would have known, that the act violated HIPAA — but the violation was not due to willful neglect. Reasonable cause exists when circumstances would make it unreasonable to comply.
Tier 3 — Willful Neglect, Corrected
$14,238 – $71,162The violation was the result of conscious, intentional failure or reckless indifference to the obligation to comply — but the covered entity corrected the violation within 30 days of discovery (or when it should have been known).
Tier 4 — Willful Neglect, Not Corrected
$71,162 – $2,134,831The most severe tier. The entity consciously, intentionally, or recklessly violated HIPAA and did not correct the violation within 30 days. OCR is required to impose a civil money penalty at this tier.
How Penalties Are Calculated
OCR multiplies the per-violation penalty by the number of violations of the same type within a calendar year. Multiple violations of the same provision are capped at the annual maximum ($2,134,831). Violations of different provisions stack independently. OCR considers: (1) nature, circumstances, extent, and results of the violation; (2) the entity's history; (3) financial condition; (4) degree of culpability. State attorneys general can pursue parallel actions adding $100 per person per violation (max $25,000/year per provision).
Recent Enforcement Actions
Understand Your HIPAA Penalty Exposure
Use ComplianceStack's free tools to identify gaps before regulators do.
Take the Quiz → Gap Analyzer →Frequently Asked Questions
Can HIPAA penalties be waived or reduced?
Yes. OCR has discretion to waive CMP penalties for Tier 1 and Tier 2 violations if the entity demonstrates: (1) the violation was due to reasonable cause (not willful neglect), and (2) the penalty would be excessive relative to the violation. Entities that self-report, cooperate fully, and implement a robust corrective action plan typically receive significantly reduced penalties or resolution agreements in lieu of CMPs.
What is the difference between a CMP and a resolution agreement?
A Civil Money Penalty (CMP) is a formal financial penalty OCR imposes after adjudication. A Resolution Agreement (RA) is a negotiated settlement where the entity agrees to pay an amount (often lower than the potential CMP) and implement a corrective action plan (CAP). Most HIPAA enforcement actions settle via RA — only a small fraction proceed to formal CMP adjudication. RAs require ongoing OCR oversight for 1–3 years.
Do HIPAA penalties apply to business associates or only covered entities?
Both. Since the 2013 HIPAA Omnibus Rule (implementing HITECH), business associates are directly liable for HIPAA violations — OCR can impose CMPs on BAs independently of the covered entity. A BA that impermissibly discloses PHI, fails to report a breach, or doesn't implement required safeguards can face the same four-tier penalty structure. In 2024, OCR has pursued enforcement actions against both covered entities and their BAs in the same incident.