A four-provider dermatology group emails a patient roster to a marketing consultant who never signed a Business Associate Agreement. One email, 1,400 records, zero malicious intent. That practice is now exposed to HIPAA violation penalties calculated per record, per day, or per identical provision — depending on how the Office for Civil Rights frames the count. The dollar figure is not fixed. It is built from a tier, a multiplier, and a judgment about what you knew and when.

This article explains how that number gets constructed, who decides it, and what documentation shifts you down a tier. It is written for the person who signs vendor contracts and answers the OCR letter — not for patients.

What HIPAA Violation Penalties Cost: The Short Answer

Civil HIPAA violation penalties are set by a four-tier structure created under the HITECH Act and adjusted for inflation each year by HHS. The tiers turn on culpability:

  • Tier 1 — Lack of knowledge. You did not know and, exercising reasonable diligence, would not have known.
  • Tier 2 — Reasonable cause. You knew or should have known, but the failure was not willful neglect.
  • Tier 3 — Willful neglect, corrected within 30 days. Conscious disregard, cured inside the statutory window.
  • Tier 4 — Willful neglect, not corrected. Conscious disregard, still uncorrected when OCR arrives.

Each tier carries a minimum and maximum per violation plus an annual cap for all violations of an identical provision in a calendar year. Under the April 2019 Notification of Enforcement Discretion, HHS set those annual caps at $25,000, $100,000, $250,000, and $1.5 million respectively, before inflation adjustment. The adjusted figures are republished in the Federal Register annually, so pull the current table from the HHS enforcement page before you budget anything.

Separately, criminal penalties under 42 U.S.C. § 1320d-6 run up to $50,000 and one year in prison for knowing disclosure, up to $100,000 and five years under false pretenses, and up to $250,000 and ten years for disclosure with intent to sell or use PHI for commercial gain, personal gain, or malicious harm. Those cases go to the Department of Justice, not OCR.

Why the Tier Matters More Than the Incident

Two practices can lose the same 900 records to the same phishing email and land in different tiers. The difference is almost never the technical control. It is the paper trail.

Tier 1 and Tier 2 turn on what a reasonable practice would have caught

If you ran a current risk analysis, documented the identified risk, and were mid-remediation when the incident happened, you have a credible argument for the lower tiers. If your last risk analysis is undated, was performed by a vendor who ran a checklist and left, or does not mention the system that got breached, that argument collapses.

Tier 3 and Tier 4 turn on whether you already knew

Willful neglect means conscious disregard of a known obligation. The most common evidence OCR finds is your own: a prior risk assessment listing an unencrypted laptop fleet, an internal audit flagging shared logins, a staff complaint about the fax machine in the waiting room. Documenting a problem and then doing nothing for three years is worse than never looking — that is the uncomfortable arithmetic of Tier 4.

The 30-day cure window in Tier 3 is real and it is short. It runs from when you knew or should have known of the violation. Practices that treat an incident as a legal problem before they treat it as an operational one routinely burn that window.

Per-Violation Math Turns a Small Lapse Into a Large Number

OCR has discretion over how it counts. A single lost thumb drive can be one violation of the encryption implementation specification, or 3,000 violations of the impermissible disclosure prohibition. A failure to conduct a risk analysis can be counted per day of noncompliance.

Work a scenario. Your practice has no documented risk analysis for the 30 months preceding a breach. Even at low per-violation amounts, a per-day count across 900 days sits against the annual cap for that provision, in whichever tier applies. Now add a second provision — no workforce sanction policy — and a third, no audit controls on the practice management server. Each identical-provision bucket has its own cap. That is how a mid-size practice ends up looking at six figures without a single act of bad faith.

Most matters never reach a civil money penalty. OCR resolves the large majority through voluntary compliance, technical assistance, or a resolution agreement with a corrective action plan. The corrective action plan is the part that costs you: two to three years of reporting obligations, policy rewrites, workforce retraining, and an outside assessor whose invoices are not covered by your settlement figure.

The Missing BAA Is the Cheapest Penalty to Avoid

OCR has repeatedly resolved cases where a covered entity disclosed PHI to a vendor with no executed Business Associate Agreement in place. It is a clean finding. There is no forensic ambiguity, no dispute about intent — either the signed agreement exists on the date of disclosure or it does not.

Build a vendor inventory and answer three questions for each line: does this vendor create, receive, maintain, or transmit PHI on our behalf; is there an executed BAA; and what is its date relative to when we started sending them data. Expect surprises. Answering services, transcription contractors, shredding companies, IT managed service providers, cloud backup, billing companies, e-fax providers, and the consultant who builds your patient reminder campaigns all typically qualify.

If that audit turns up gaps — and on a first pass it usually turns up three to eight — you need executed agreements quickly, not a six-week legal cycle per vendor. A signature-ready Business Associate Agreement builder walks you through the six decisions that actually vary between vendors and exports PDF and DOCX, one-time purchase, no subscription. Close the gaps, date them, file them where your privacy officer can produce them in ten minutes.

Also confirm your subcontractor chain. Your business associates must have BAAs with their subcontractors who handle your PHI. Ask for attestation in writing at renewal.

State Attorneys General Send a Second Bill

HITECH gave state attorneys general authority to bring civil actions on behalf of state residents for HIPAA violations, with statutory damages and attorney's fees. Several states also run parallel breach notification and consumer protection statutes with their own penalty structures — and those apply to data HIPAA may not even reach.

The FTC's Health Breach Notification Rule covers vendors of personal health records and related entities outside HIPAA's scope. If your practice runs a patient-facing app or wellness platform through a non-covered vendor, read the FTC's rule before you assume HIPAA is your only exposure.

What OCR Asks For First

The initial data request in an OCR investigation is predictable. Assemble these now, not after the letter arrives:

  1. Your current security risk analysis, dated, scoped to every system that touches ePHI, with named assets. NIST SP 800-66r2 is the standard reference; HHS points to it directly.
  2. Your risk management plan — the remediation actions tied to each identified risk, with owners and target dates, and evidence of what got done.
  3. Policies and procedures with adoption dates and revision history.
  4. Workforce training records — who, what content, what date, signed acknowledgment.
  5. Your BAA file, complete, with execution dates.
  6. Breach risk assessments for incidents you decided were not reportable, showing the four-factor analysis.
  7. Sanction policy and evidence you have actually applied it.
  8. Access logs and audit control configuration for the systems at issue.

Item six is the one practices skip. Every incident you determine is not a reportable breach requires a documented four-factor assessment. "We decided it was fine" is not a defense. "We assessed the nature of the PHI, the unauthorized recipient, whether it was actually acquired or viewed, and the extent of mitigation, and here is the memo" is.

Breach Notification Deadlines That Create Their Own Penalties

Late notification is an independent violation. For breaches affecting 500 or more individuals in a state or jurisdiction, notify affected individuals, HHS, and prominent media without unreasonable delay and no later than 60 days from discovery. For breaches under 500, notify individuals within 60 days and log the incident for annual submission to HHS within 60 days after the end of the calendar year — meaning your 2025 small breach log is due by March 1, 2026.

Discovery starts when the breach is known, or would have been known by exercising reasonable diligence, by any workforce member other than the person who caused it. Not when leadership is briefed. Every 500-plus breach is published on the OCR breach portal, which is also where you can see what kinds of incidents dominate enforcement in your practice size and specialty.

A 90-Day Plan That Moves You Down a Tier

Days 1–30. Complete the vendor inventory and close BAA gaps. Confirm your named privacy officer and security officer in writing — HIPAA requires both, and "the office manager handles it" is not a designation.

Days 31–60. Run or refresh the security risk analysis with an asset inventory that includes personal devices, cloud services, and anything the front desk installed without telling you. Convert findings into a dated risk management plan with owners.

Days 61–90. Retrain the workforce on the specific risks you found, capture signed acknowledgments, and run a tabletop of your incident response process against a realistic scenario — a misdirected fax, a stolen laptop, a ransomware note. Time how long it takes to determine the 60-day clock start.

OCR has publicly signaled that inadequate risk analysis remains one of the most common findings across investigations, and the Security Rule updates proposed in early 2025 would tighten documentation expectations further if finalized. If you are building the full document set — risk analysis, policies, plans — from scratch, automated HIPAA risk analysis and policy generation gets you to a dated, defensible baseline faster than a blank template folder.

What Does Not Reduce Your Exposure

A certificate on the wall. No organization certifies HIPAA compliance on behalf of HHS, and HHS does not endorse compliance products. Training completion is evidence; a badge is not.

Encryption alone. Encryption creates a safe harbor for breach notification when properly implemented, but it does not cure a missing risk analysis, an unsigned BAA, or an ignored right-of-access request.

Small size. OCR's Right of Access Initiative has repeatedly resolved matters against solo and small practices. A patient who waits 45 days for records and files a complaint is the single most common trigger for an investigation that then examines everything else.

Start with the vendor list — it is the fastest gap to close and the hardest to explain away. If you find missing agreements this week, generate and execute the BAAs before the next disclosure, and date the file.