HHS has applied the annual inflation adjustment to the civil monetary penalties for violations of the HIPAA Rules effective January 28, 2026, increasing the financial penalties for covered violations. HIPAA-certified entities also need to take note of these updates.
HHS Adjustment Of HIPAA Penalties
The Department of Health and Human Services’ Office for Civil Rights has applied an inflation increase to the penalties for violations of the HIPAA Rules in line with the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015, with the updated penalty amounts effective from the date of their publication in the Federal Register on January 28, 2026.
The Office of Management and Budget is responsible for issuing the annual inflation multiplier used in these adjustments, but has not yet announced the multiplier for 2026.
HHS did not apply the 2025 inflation adjustment by the statutory January deadline and implemented the updated amounts on January 28, 2026, following the previous adjustment that took effect on August 8, 2024.
Adjusted Penalty Tiers
For violations assessed under the updated 2025 rates, the minimum and maximum civil monetary penalties per violation and the annual penalty limits vary by tier of culpability:
- Tier 1 penalties for lack of knowledge – a minimum of $145 and maximum of $73,011 with an annual cap of $2,190,294
- Tier 2 penalties for reasonable cause – a minimum of $1,461 and maximum of $73,011 with an annual cap of $2,190,294
- Tier 3 penalties for willful neglect corrected within 30 days – a minimum of $14,602 and maximum of $73,011 with an annual cap of $2,190,294
- Tier 4 penalties for willful neglect not corrected within 30 days – a minimum of $73,011 and maximum of $2,190,294 with an annual cap of $2,190,294.
Enforcement Discretion And Application
The Office for Civil Rights continues to maintain a 2019 Notice of Enforcement Discretion affecting the penalty caps for certain tiers, which remains in effect and results in lower annual penalty caps for three of the four liability tiers, but this discretion can be rescinded at any time. For violations that occurred prior to November 2, 2015, or for penalties assessed before September 6, 2016, the pre-adjustment civil penalty amounts in effect prior to September 6, 2016, continue to apply.
Penalties For Part 2 Regulations
Separate but analogous penalty structures apply to violations of the Part 2 regulations, which are enforced by the Office for Civil Rights and align with the HIPAA penalty structure but use the penalty amounts from the HITECH Act of 2009 as their starting point, resulting in lower penalty amounts and annual caps for violations of those regulations.
