The penalties for breaking HIPAA fall into four buckets: civil fines that start at $145 per violation and can exceed $2 million in a single calendar year, criminal charges carrying up to $250,000 in fines and ten years in prison, separate lawsuits brought by state attorneys general, and personal consequences like being fired or losing a professional license. Which of these actually applies depends on what you did, how much you knew, and how quickly you fixed the problem. The Office for Civil Rights (OCR) at the Department of Health and Human Services handles civil enforcement; the Department of Justice prosecutes the criminal side.
Civil Fines by Tier
Civil penalties follow a four-tier structure keyed to the violator’s state of mind and whether they corrected the problem. The base numbers are set by statute and adjusted for inflation every year. The ranges below reflect the January 2026 inflation adjustment published in the Federal Register:1Federal Register. Annual Civil Monetary Penalties Inflation Adjustment
- Tier 1, no knowledge: the entity did not know and could not reasonably have known about the violation. $145 to $73,011 per violation.
- Tier 2, reasonable cause: not willful neglect, but circumstances that should have been addressed. $1,461 to $73,011 per violation.
- Tier 3, willful neglect corrected within 30 days: $14,602 to $73,011 per violation.
- Tier 4, willful neglect not corrected: $73,011 to $2,190,294 per violation.
The per-violation number is what makes these fines dangerous. A single breach can involve thousands of individual records, and each record can count as its own violation. Even at the low end of Tier 1, the arithmetic gets large quickly.
The formal regulation applies a uniform calendar-year cap of $2,190,294 across all four tiers. Since 2019, however, OCR has used enforcement discretion to apply lower annual caps for the less culpable tiers while a formal rulemaking remains pending:2Federal Register. Notification of Enforcement Discretion Regarding HIPAA Civil Money Penalties
- Tier 1: $25,000 per year
- Tier 2: $100,000 per year
- Tier 3: $250,000 per year
- Tier 4: $1,500,000 per year
These reduced caps sit in policy, not in codified regulation, so OCR decides case by case whether to apply them. For uncorrected willful neglect, the ceiling remains well above $2 million.
Criminal Charges
When a violation is intentional, the Department of Justice can prosecute. Federal law sets three levels of criminal exposure:3Office of the Law Revision Counsel. 42 USC 1320d-6 Wrongful Disclosure of Individually Identifiable Health Information
- Knowingly obtaining or disclosing protected health information: up to $50,000 in fines and up to one year in prison.
- Doing so under false pretenses, such as using a fake identity to pull records: up to $100,000 and five years.
- Doing so for commercial advantage, personal financial gain, or malicious harm: up to $250,000 and ten years.
Criminal charges can be brought against an individual directly, not just the organization. A staff member who steals patient records to sell them or to harm someone can be prosecuted personally, even if the employer is also paying civil penalties for the same incident.
Getting Fired and Losing Your License
The government penalties are only part of what happens. For a working healthcare professional, the personal consequences often hit harder.
Employers generally treat HIPAA violations as serious disciplinary matters. Sanctions run from written warnings and mandatory retraining up to immediate termination. Snooping in records without a work reason almost always ends in firing, even when the employee had no bad intent.
Licensed professionals face another layer. State licensing boards for doctors, nurses, pharmacists, and therapists can investigate a HIPAA-related complaint on their own, independent of any federal action. Board sanctions include formal reprimands, fines, and required continuing education. In serious cases, or when there is a pattern, the board can suspend or permanently revoke the license. Defending a licensing action usually requires a specialized attorney, so the legal costs stack on top of any government penalty.
Lawsuits by State Attorneys General
Federal enforcement is not the only civil track. The HITECH Act authorizes every state attorney general to sue in federal court on behalf of residents whose health information was compromised.4U.S. Department of Health and Human Services. State Attorneys General
A state AG can seek an injunction to stop an ongoing violation and pursue statutory damages of up to $100 per violation, capped at $25,000 in a calendar year for repeated violations of the same requirement.5Office of the Law Revision Counsel. 42 USC 1320d-5 General Penalty for Failure to Comply With Requirements and Standards The dollar figures are modest next to OCR’s, but a state action produces its own reputational damage and legal bills, and several attorneys general have used this authority against providers and business associates tied to significant breaches.
Late or Missing Breach Notifications Are Their Own Violation
When unsecured protected health information is exposed, the fix cannot stop at internal cleanup. Federal law requires written notice to each affected individual within 60 calendar days of discovering the breach, describing what happened, what data was exposed, what the person should do, and what the organization is doing.6eCFR. 45 CFR 164.404 – Notification to Individuals
If a breach affects 500 or more residents of a state or jurisdiction, the covered entity must also notify prominent media outlets serving that area and report the breach to the HHS Secretary within 60 days. Smaller breaches can be reported to HHS in an annual batch within 60 days after the end of the calendar year of discovery.7HHS.gov. Breach Notification Rule
Missing or botching these notifications counts as a separate violation. An organization can be penalized both for the underlying breach and for failing to report it properly.
Can a Patient Sue You Under HIPAA?
No, not directly. HIPAA does not create a private right of action, and every federal appeals court that has looked at the question has said the same thing. A patient whose records were improperly disclosed cannot sue the responsible party under HIPAA itself.
Patients still have options. They can file a complaint with OCR, which can investigate and impose penalties. State attorneys general can pursue their own actions. And depending on the facts, state privacy statutes, negligence, or breach of contract may support a personal lawsuit. Those cases just do not run on HIPAA.
How Penalties Actually Get Triggered
Most enforcement starts with a complaint to OCR. Anyone can file one, at no cost, in writing. OCR first checks jurisdiction and whether the described conduct would actually be a violation. If so, it notifies the entity and opens an investigation that can include document requests, interviews, and a review of security practices. OCR also opens investigations on its own based on breach reports, media coverage, and compliance audits, so a violation can surface without any complaint at all.8U.S. Department of Health and Human Services. How to File a Health Information Privacy or Security Complaint
When OCR finds no violation, the file closes. When the problem looks like ignorance or weak policies rather than bad intent, OCR often resolves the matter through technical assistance or a corrective action plan requiring updated policies, staff retraining, and monitoring for one to three years. More serious matters produce a formal resolution agreement combining a monetary payment with a corrective action plan; the biggest of these have reached into the millions. Where the evidence points to knowing or intentional conduct, OCR refers the case to the Department of Justice for possible prosecution, which is when the criminal exposure described above becomes real.