HIPAA Violation Penalties: The Four Tiers and OCR Enforcement Context

Tier Summary (Jan 28, 2026 Adjustment)

OCR 2019 Notice of Enforcement Discretion

OCR’s 2019 Notice of Enforcement Discretion continues to apply lower annual caps by tier (inflation-adjusted from the $25k / $100k / $250k / $1.5M structure) pending further rulemaking. Buyers and counsel should read both the regulation’s calendar-year figures and OCR’s published discretion policy for any given enforcement year.

Public Settlements

OCR publishes resolution agreements and civil money penalties on hhs.gov. Cross-check amounts and facts against the agency notice for your case study — settlement headlines change as new matters close. See also cases summarised on the HIPAA hub.

How CyberSilo Helps

• CSA reduces “willful neglect” exposure by making gaps visible with owners and due dates
• ThreatHawk shortens discovery time for incidents that drive Breach Notification clocks

Frequently Asked Questions

What are the four HIPAA penalty tiers?

Did not know; reasonable cause; willful neglect corrected within 30 days; willful neglect not corrected within 30 days — see 45 CFR 160.404.

Which dollar amounts should we cite in 2026?

Use the January 28, 2026 HHS inflation adjustment for assessments on/after that date, and note OCR may still apply its 2019 annual-cap discretion policy.

Do business associates face the same CMPs?

Yes — after HITECH/Omnibus, BAs can be directly liable and subject to OCR enforcement.

Related HIPAA Resources

HIPAA hub · Incident response · Certification · CSA