Short answer: Civil penalties from HHS are tiered by culpability, from $145 per violation at the lowest tier up to $2,190,294 per violation for uncorrected willful neglect under the current inflation table, with a calendar-year cap of $2,190,294 for identical violations. Knowingly misusing health information is also a federal crime.
HHS’s current inflation-adjusted table (the 2025 adjustment in 45 CFR 102.3) sets these per-violation ranges:
- did not know, and with reasonable diligence would not have known: $145 to $73,011;
- reasonable cause, not willful neglect: $1,461 to $73,011;
- willful neglect, corrected within 30 days: $14,602 to $73,011;
- willful neglect, not corrected: $73,011 to $2,190,294;
with a calendar-year cap of $2,190,294 for identical violations. Many investigations end with a corrective action plan rather than a penalty.
Criminal penalties apply to knowingly obtaining or disclosing individually identifiable health information in violation of HIPAA: up to $50,000 and 1 year in prison; up to $100,000 and 5 years under false pretenses; and up to $250,000 and 10 years with intent to sell or use it for commercial advantage, personal gain or malicious harm.
Texas adds its own penalties under state privacy and breach laws.