HIPAA penalties
Current HIPAA civil penalty amounts by tier after the 2025 inflation adjustment, annual caps, criminal penalties, and what determines the amount.
HIPAA penalties at a glance
HIPAA civil penalties are set in four tiers based on culpability. After the 2025 inflation adjustment, they range from $145 per violation when an organization did not know of the violation, to $73,011 per violation and up to $2,190,294 per year for identical violations when it was due to uncorrected willful neglect. HHS applies lower annual caps for the three lower tiers under a 2019 enforcement notice. Criminal penalties reach $250,000 and 10 years in prison.
| Tier 1 — did not know | $145 – $73,011 per violation |
|---|---|
| Tier 2 — reasonable cause | $1,461 – $73,011 per violation |
| Tier 3 — willful neglect, corrected in 30 days | $14,602 – $73,011 per violation |
| Tier 4 — willful neglect, not corrected | $73,011 – $2,190,294 per violation |
| Annual cap (regulation) | $2,190,294 for identical violations per calendar year |
| Criminal | Up to $50,000 / 1 year; $100,000 / 5 years; $250,000 / 10 years |
Civil penalty tiers (2025 amounts)
Civil money penalties are set in 45 CFR 160.404 and adjusted for inflation every year in 45 CFR 102.3. For violations on or after February 18, 2009:
| Culpability | Per violation | Annual cap in the regulation |
|---|---|---|
| Did not know, and could not reasonably have known | $145 – $73,011 | $2,190,294 |
| Reasonable cause, not willful neglect | $1,461 – $73,011 | $2,190,294 |
| Willful neglect, corrected within 30 days | $14,602 – $73,011 | $2,190,294 |
| Willful neglect, not corrected within 30 days | $73,011 – $2,190,294 | $2,190,294 |
The cap applies per calendar year to identical violations, so an organization that violated several different requirements can face several caps.
Lower caps in practice
In 2019, HHS announced that as a matter of enforcement discretion it applies lower annual caps to the three lower tiers — originally $25,000, $100,000 and $250,000, with $1.5 million for uncorrected willful neglect — and those figures are also adjusted for inflation. The notice remains in effect until HHS says otherwise.
What determines the amount
Under 45 CFR 160.408, HHS considers the nature and extent of the violation and the harm caused, how many people were affected, the organization’s compliance history, its financial condition, and other factors. Many cases end with a corrective action plan or settlement rather than a formal penalty.
Criminal penalties
Knowingly obtaining or disclosing individually identifiable health information in violation of HIPAA (42 U.S.C. 1320d-6):
| Offense | Fine up to | Prison up to |
|---|---|---|
| Knowing violation | $50,000 | 1 year |
| Under false pretenses | $100,000 | 5 years |
| For commercial advantage, personal gain or malicious harm | $250,000 | 10 years |
To understand what counts as a violation in the first place, see HIPAA violation.
Next steps
Frequently asked questions
What is the maximum HIPAA fine?
Under the 2025 adjustment, up to $2,190,294 per violation and per calendar year for identical violations. Organizations can face several caps if they violated different requirements.
How much is a HIPAA violation fine for a small practice?
It depends on culpability, harm, history and cooperation. Many cases end with corrective action plans or settlements rather than the maximum; the amounts above are limits, not typical results.
Can individual employees be fined under HIPAA?
Civil penalties are imposed on covered entities and business associates. Individuals who knowingly obtain or disclose health information unlawfully can face criminal prosecution.