It’s worth revisiting how much noncompliance can cost because the civil money penalties (CMP) for HIPAA violations have just been adjusted upward for inflation by the U.S. Department of Health and Human Services (HHS).

HIPAA Penalties are on a Sliding Scale

It’s important to remember that penalties are on a four-tier sliding scale; the worse the violation, the higher the penalty.

Last week the minimum penalty per “unknowing” violation was $127; this week the minimum is $137. The next level up, for a violation due to reasonable cause but not willful neglect, is $1,379 per violation. The potential maximum per violation at both levels is a whopping $68,928, while the annual cap is $2,067,813. There are two additional levels for more serious violations; all four of them are outlined below.

The Federal Register Contains Formal Law

In 2019 under the prior penalty structure, HHS decided that the annual cap should not be the same for all four tiers. However, the penalty chart was not officially changed in the Federal Register. Instead, HHS issued a Notice of Enforcement Discretion (NED), indicating that the Office for Civil Rights (OCR) would apply a different penalty structure for the annual penalty caps.

This led to confusion because the NED suggested the law had changed, but it hadn’t. The 2019 HHS Notice of Enforcement Discretion is not formal law.

The chart below reflects current law in the Federal Register.

Table of Civil Money Penalties for HIPAA Violations Adjusted for Inflation effective October 6, 2023
Tiers 1 through 4 – from Least to Most Serious	Minimum Penalty per Violation	Maximum Penalty per Violation	CMP Limit for Identical Violations in a Calendar Year
Tier 1.  Unknowing Violation Lack of knowledge	$137	$68,928	$2,067,813
Tier 2. Violation Due to Reasonable Cause  Reasonable cause and not willful neglect	$1,379	$68,928	$2,067,813
Tier 3.  Violation Due to Willful Neglect and Corrected within 30 Days Willful neglect but was corrected promptly	$13,785	$68,928	$2,067,813
Tier 4.  Violation Due to Willful Neglect and Not Corrected Willful neglect but was not corrected within 30 days	$68,928	$2,067,813	$2,067,813

Reference: 88 Fed. Reg. 69531 (Oct. 6, 2023)

HIPAA Enforcement Today

OCR’s top priorities in 2023 are website tracking breaches and the right of access rule.

OCR is required to investigate all healthcare data breaches that affect 500 or more individuals, but they also investigate complaints. Once an investigation begins, OCR might uncover other violations. Most common problems OCR discusses in its settlement announcements include failure to conduct a risk analysis, failure to follow the Security Rule and failure to provide adequate workforce training.

If OCR believes there is criminal conduct they will refer it to the Department of Justice for investigation and criminal enforcement.

The FTC, the States and Private Lawsuits

OCR is serious about enforcement. But enforcement can also come from other sources.

The Federal Trade Commission (FTC) is amping up enforcement of health privacy rules. In some cases the FTC coordinates with OCR (website tracking) while in other cases it pursues investigations on its own (GoodRx, BetterHelp and Premom).

The HITECH Act of 2009 gave State Attorneys General authority to enforce the HIPAA Privacy and Security Rules. The most recent example is the Blackbaud breach which resulted in a $50 million settlement.

Private civil lawsuits are on the rise. Although HIPAA does not provide a private right to sue, if protected health information (PHI) is breached plaintiffs can sue under state privacy and consumer protection laws and use HIPAA as a standard to prove negligence if the defendant did not comply.

Avoid and Reduce HIPAA Penalties with Compliance

The best defense against expensive investigations and lawsuits is strong HIPAA compliance. Up to date policies, annual Risk Analysis and workforce training are essential.