HIPAA willful neglect penalties are the steepest civil fines in federal health privacy enforcement, and for 2026 they range from $14,602 per violation at the low end to $2,190,294 per violation at the top, with a calendar-year cap of $2,190,294 for repeated violations of the same requirement.1Federal Register. Annual Civil Monetary Penalties Inflation Adjustment Willful neglect is the top category of HIPAA culpability, defined by federal regulation as a conscious, intentional failure or reckless indifference to the obligation to comply with the rules.2eCFR. 45 CFR 160.401 It’s the only tier where the Office for Civil Rights has no discretion to waive a penalty.3Office of the Law Revision Counsel. 42 USC 1320d-5 General Penalty for Failure to Comply With Requirements and Standards
What Counts as Willful Neglect
HIPAA enforcement uses four tiers of culpability. The lower two cover violations an entity didn’t know about or that happened despite reasonable cause. Willful neglect occupies the top two.4U.S. Department of Health and Human Services. How OCR Enforces the HIPAA Privacy and Security Rules
The legal test is straightforward. Investigators look for evidence that an organization knew about its HIPAA obligations and either deliberately ignored them or showed extreme indifference to whether it was complying. This is not a data entry mistake or a one-time training gap. The classic pattern is an organization that had been told about a security problem, by its own staff, by a patient complaint, or by a previous OCR inquiry, and did nothing. That inaction, more than any single event, is what separates willful neglect from the lower tiers.
The 30-Day Correction Window
Federal law splits willful neglect into two subtiers based on how fast the organization fixes the problem. The line is a 30-day correction window that starts on the date the entity first knew, or should have known through reasonable diligence, that the violation occurred.5eCFR. 45 CFR 160.404 Amount of a Civil Money Penalty Correct within 30 days and you land in Tier 3. Miss the window and you land in Tier 4, where the per-violation minimum jumps fivefold.
OCR decides whether a correction was timely case by case, based on what the investigation turns up.6Federal Register. Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules There’s no pre-set list of documents you have to file. The entity can submit whatever evidence it has of the fix — updated policies, new access controls, revised training records. OCR then reviews internal logs, communications, audit trails, and patient complaints to pin down when the organization actually gained knowledge of the problem. That date starts the clock, whether or not the entity formally acknowledged the issue.
2026 Penalty Amounts by Tier
The HITECH Act restructured HIPAA penalties in 2009 to make sure willful neglect carried real financial weight. The base statutory amounts are adjusted for inflation every year, and the 2026 figures are the highest yet.1Federal Register. Annual Civil Monetary Penalties Inflation Adjustment
Tier 3, willful neglect corrected within 30 days:
- Minimum: $14,602 per violation
- Maximum: $73,011 per violation
- Calendar-year cap: $2,190,294 for all violations of the same requirement
Tier 4, willful neglect not corrected within 30 days:
- Minimum: $73,011 per violation
- Maximum: $2,190,294 per violation
- Calendar-year cap: $2,190,294 for all violations of the same requirement
How the Cap Actually Stacks
The calendar-year cap applies per requirement, not overall. If an investigation uncovers willful neglect of both the risk analysis requirement and the access control requirement, each has its own cap. An organization that ignored three separate Security Rule provisions across two calendar years could face six separate caps, and the arithmetic can reach the tens of millions. Each distinct HIPAA requirement the entity failed to follow counts as its own violation stream, which is why single investigations sometimes produce headline-grabbing penalty totals.
HHS issued a 2019 enforcement discretion notice that aligned the calendar-year caps with the tiered structure Congress wrote into the HITECH Act rather than applying a single blanket cap across all tiers.7Federal Register. Notification of Enforcement Discretion Regarding HIPAA Civil Money Penalties That notice remains in effect but is not legally binding and can be rescinded. In practice, the amounts above are the published regulatory maximums for 2026 and the figures entities should plan around.
How Willful Neglect Cases Usually End
Despite the large statutory numbers, most OCR enforcement actions do not end with a maxed-out civil money penalty. HHS prefers resolution agreements, voluntary settlements where the entity pays a negotiated amount and agrees to a corrective action plan under HHS monitoring.8HHS.gov. Resolution Agreements Civil money penalties get imposed only when HHS can’t reach a satisfactory resolution through corrective action or informal means.
A typical resolution agreement requires the entity to pay a settlement amount, then spend two to three years under active monitoring. During that period the organization must develop or revise written privacy and security policies, submit them to HHS for approval, train all workforce members on the new policies, and report any compliance failures to HHS within 30 days.9U.S. Department of Health and Human Services. HIPAA Right of Access Investigation Resolution Agreement and Corrective Action Plan Workforce members sign certifications confirming they’ve read and understood the policies. The plan also requires the entity to investigate potential failures internally and self-report them.
Do not treat resolution as a soft landing. Negotiated settlements in willful neglect cases still run from hundreds of thousands to several million dollars, and the monitoring obligations consume significant staff time and resources for years.
Criminal Exposure for Individuals
Civil money penalties aren’t the only risk, and they aren’t the only way personal liability can enter the picture. A separate statute, 42 U.S.C. § 1320d-6, creates criminal liability for anyone who knowingly obtains or discloses individually identifiable health information in violation of HIPAA. The Department of Justice handles these prosecutions, not OCR, and the penalties escalate with intent:10GovInfo. 42 USC 1320d-6 Wrongful Disclosure of Individually Identifiable Health Information
- Knowing violation: up to $50,000 in fines and up to one year in prison
- Violation under false pretenses: up to $100,000 in fines and up to five years in prison
- Violation with intent to sell, transfer, or use health information for commercial advantage, personal gain, or malicious harm: up to $250,000 in fines and up to ten years in prison
Civil penalties target the covered entity or business associate as an organization. Criminal charges can reach individual people. Directors, employees, and officers of a covered entity can be prosecuted individually, either as the person who committed the violation or under conspiracy or aiding-and-abetting theories.
State Attorneys General as a Second Front
The HITECH Act didn’t limit enforcement to federal authorities. Section 13410(e) gave every State Attorney General the power to bring civil actions on behalf of state residents for HIPAA Privacy and Security Rule violations.11U.S. Department of Health and Human Services. State Attorneys General A state AG can seek damages for affected residents and injunctions against ongoing violations. The only procedural requirement is notifying HHS at least 48 hours before filing suit.
An organization facing an OCR investigation for willful neglect can simultaneously face a state AG action on behalf of patients in that state. The two proceedings are independent, and a resolution agreement with OCR doesn’t necessarily resolve the state-level claim.
Business Associates Are Directly Liable
Willful neglect findings don’t just land on hospitals and health plans. Under the HITECH Act and the 2013 HIPAA final rule, business associates — the vendors, cloud providers, billing companies, and other third parties that handle protected health information — are directly liable for their own compliance failures.12U.S. Department of Health and Human Services. Direct Liability of Business Associates OCR can take enforcement action directly against a business associate for Security Rule violations, breach notification failures, impermissible uses and disclosures, and failing to enter into proper agreements with subcontractors.
The business associate agreement itself becomes a critical piece of evidence in a willful neglect investigation. A business associate that never executed a proper agreement with subcontractors who handle patient data, or knew a subcontractor was violating its agreement and took no reasonable steps, can be found to have committed willful neglect. The same 30-day correction window and the same penalty structure apply.
What Triggers a Willful Neglect Finding in Practice
OCR doesn’t use a checklist, but certain patterns come up repeatedly.
The single most common trigger is the complete absence of a security risk analysis. HHS considers the risk analysis the foundational step in Security Rule compliance, the starting point for identifying vulnerabilities and deciding what safeguards to put in place.13U.S. Department of Health and Human Services. Guidance on Risk Analysis An entity that never performed one, despite years operating under HIPAA, is telling investigators it never tried. That’s the textbook definition of reckless indifference.
Other patterns that regularly support willful neglect findings: ignoring prior complaints or warnings from patients, staff, or OCR about security gaps; failing to implement encryption on portable devices after a known vulnerability; running outdated systems with no plan to patch or replace them; and having zero documented workforce training on privacy and security obligations. The common thread isn’t the specific technical failure. It’s the evidence that the organization had the knowledge, resources, and time to act, and chose not to.
Challenging a Proposed Penalty
An entity that receives a notice of proposed penalty determination has the right to a hearing before an Administrative Law Judge, but the request must be filed within 90 days of receiving the notice. If the ALJ’s decision is unfavorable, the entity can appeal to the HHS Departmental Appeals Board by filing a notice of appeal within 30 days of the ALJ’s decision.14U.S. Department of Health and Human Services. Guidelines: Appellate Review of Decisions of Administrative Law Judges Relating to Imposition of Civil Money Penalties Based on Violations of the HIPAA Administrative Simplification Provisions Missing the initial 90-day hearing request effectively waives the right to challenge the penalty, so an organization facing a proposed determination should treat that deadline as non-negotiable.