HIPAA violation penalty calculator
A HIPAA violation can cost from $145 to $2,190,294 per violation, depending on how much the organisation knew and whether it fixed the problem. Pick the issue, the culpability tier, the number of violations and the years involved to see the civil penalty range from 45 CFR 102.3, the current inflation-adjusted table, as we read it on 3 November 2026. Nothing you enter leaves your browser.
Reasonable cause. The organisation knew, or should have known with reasonable diligence, but did not act with willful neglect. Cited as 45 CFR 160.404(b)(2)(ii). Selected issue: No accurate, thorough security risk analysis (45 CFR 164.308(a)(1)(ii)(A)). The tier is decided by what the organisation knew and did, not by the type of violation, so you choose it yourself.
Under HHS’s 2019 notice of enforcement discretion, the annual limit for this tier is lower: $100,000 before inflation adjustment, which would cap the one-year high end at $73,011 before adjustment. HHS said it would apply that structure “as adjusted for inflation”. We have not verified the adjusted figures, so treat the inflation-adjusted discretionary limit as somewhat higher.
An estimate of civil money penalty ranges, not a prediction. Most OCR cases settle for a negotiated amount below these ceilings. Penalties are separate from state attorney general actions, criminal liability and the cost of the breach itself.
HIPAA penalty tiers
| Tier | Per violation | Calendar-year cap (102.3) | 2019 discretion cap, unadjusted |
|---|---|---|---|
| 1. Did not know | $145 to $73,011 | $2,190,294 | $25,000 |
| 2. Reasonable cause | $1,461 to $73,011 | $2,190,294 | $100,000 |
| 3. Willful neglect, corrected within 30 days | $14,602 to $73,011 | $2,190,294 | $250,000 |
| 4. Willful neglect, not corrected | $73,011 to $2,190,294 | $2,190,294 | $1,500,000 |
Source: 45 CFR 102.3, Table 1, the “2025” adjusted column, which was the latest in the eCFR text we read. The table says amounts are adjusted annually, so check the current eCFR text for a newer figure. The last column is from HHS’s April 2019 notice (84 FR 18151).
What is HIPAA, in plain words
HIPAA is a US federal law with three rules security teams deal with. The Privacy Rule limits how protected health information (PHI) can be used and shared. The Security Rule requires administrative, physical and technical safeguards for electronic PHI. The Breach Notification Rule requires covered entities to tell affected individuals, HHS and sometimes the media when unsecured PHI is breached, and business associates to tell the covered entity.
It applies to health plans, clearinghouses, health care providers who transmit health information electronically, and the business associates that handle PHI for them. Enforcement is by HHS’s Office for Civil Rights, and state attorneys general can also bring actions. Willful misuse of PHI can be a criminal matter, which this civil table does not cover.
The usual root cause in OCR cases is the same: no accurate, thorough risk analysis. A risk analysis is the cheapest violation to prevent, and the one every other safeguard is supposed to follow from. Start with the HIPAA risk self-check, and if something has already happened, run the breach notification clock.
Questions people ask
What is HIPAA?
HIPAA, the Health Insurance Portability and Accountability Act of 1996, is the US federal law that sets rules for protecting individually identifiable health information. Its rules apply to covered entities (health plans, health care clearinghouses and most health care providers) and to their business associates, the vendors that handle protected health information on their behalf.
What is a HIPAA violation?
A HIPAA violation is a failure to comply with a requirement of the Privacy, Security or Breach Notification Rules (45 CFR Parts 160 and 164). Common ones include not performing a security risk analysis, using or disclosing protected health information without permission, sharing it with a vendor without a business associate agreement, and not notifying people of a breach on time.
How much is the fine for a HIPAA violation?
Civil penalties depend on the tier. In the inflation-adjusted table in 45 CFR 102.3, as we read it on 3 November 2026, a violation where the organisation did not know costs $145 to $73,011, reasonable cause $1,461 to $73,011, willful neglect corrected in 30 days $14,602 to $73,011, and uncorrected willful neglect $73,011 to $2,190,294. The calendar-year limit shown in that table is $2,190,294 for identical violations.
Why do some sites quote lower annual caps?
In April 2019 HHS published a Notification of Enforcement Discretion (84 FR 18151) saying it would apply separate annual limits to each tier: $25,000, $100,000, $250,000 and $1,500,000 before inflation adjustment. The regulation table still shows one cap for all four tiers, so both figures appear in practice. The calculator shows both.
What are the four HIPAA penalty tiers?
Tier 1: did not know. Tier 2: reasonable cause. Tier 3: willful neglect, corrected within 30 days. Tier 4: willful neglect, not corrected within 30 days. They are set in 45 CFR 160.404, and the dollar amounts are adjusted for inflation each year under 45 CFR Part 102.
What does the HIPAA Privacy Rule require?
The Privacy Rule (45 CFR Part 164, Subpart E) sets limits on how covered entities and business associates use and disclose protected health information, gives individuals rights to access and request amendment of their records, and requires safeguards, a notice of privacy practices, and the minimum-necessary standard for most uses.
What does the HIPAA Security Rule require?
The Security Rule (45 CFR Part 164, Subpart C) requires administrative, physical and technical safeguards for electronic protected health information. The first required administrative implementation specification is an accurate and thorough assessment of the potential risks and vulnerabilities to ePHI, called the risk analysis (164.308(a)(1)(ii)(A)); OCR has run a Risk Analysis Initiative of enforcement actions on it since October 2024.
Does this calculator show real OCR settlements?
No. We could not open the HHS resolution agreement pages to verify amounts, so we list none. The HHS Office for Civil Rights publishes them at hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements.
Sources
- 45 CFR 102.3, civil monetary penalty adjustments, eCFR, read 3 November 2026.
- Notification of Enforcement Discretion Regarding HIPAA Civil Money Penalties, 84 FR 18151 (30 April 2019).
- HHS OCR resolution agreements: where real settlement amounts are listed.
Figures as of 3 November 2026. Not legal advice.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.