HIPAA fines by tier in 2026

A civil HIPAA fine assessed from January 28, 2026 onward runs from $145 per violation at the lowest culpability tier to $2,190,294 at the highest, which is also the yearly cap in 45 CFR part 102. A 2019 HHS notice prints lower yearly limits for tiers 1 to 3: $25,000, $100,000 and $250,000.

What does each tier cost per violation?

HHS applies four culpability tiers, set out in 45 CFR 160.404(b)(2)(i) to (iv), and adjusts their dollar amounts for inflation each year in 45 CFR part 102. The notice published January 28, 2026 (91 FR 3665) carries the 2025 adjustment. HHS multiplied each 2024 amount by 1.02598 and rounded to the nearest dollar, so the tier 1 minimum moved from $141 to $145 and the yearly cap from $2,134,831 to $2,190,294. The new amounts govern a penalty assessed from that date forward, if the violation happened on November 2, 2015 or later.

In each row the first figure is the minimum for one violation and the second is the maximum in 45 CFR 102.3. Tier 4 has a minimum but no per-violation maximum in 160.404(b)(2)(iv), so part 102 prints the yearly cap as its maximum. Each cap limits the total for identical violations in a calendar year, January 1 through December 31. The 30 days run from the first date the entity knew, or with reasonable diligence would have known, of the violation.

The tiers reach covered entities and business associates alike. Under 45 CFR 160.103, a fax service that keeps a practice's faxes counts as a business associate, as the post on BAAs for online fax services explains.

Why are the first three tiers capped lower?

The statute sets a separate yearly cap for each tier: $25,000, $100,000, $250,000 and $1,500,000 (42 U.S.C. 1320d-5(a)(3)). The regulation applies the $1,500,000 figure to all four tiers (45 CFR 160.404(b)(2)).

A notice published April 30, 2019 (84 FR 18151) changed how HHS applies that cap. After a review by its Office of the General Counsel, HHS determined that the better reading of the statute gives each tier its own yearly limit. It said it would exercise enforcement discretion, pending further rulemaking, and follow the "interim penalty tiers" in the notice's Table 2 in every enforcement action.

The notice is effective indefinitely. HHS will use the structure "as adjusted for inflation" until further notice. The notice says it creates no legal obligations and no legal rights, and it says HHS expects to revise the tiers in the regulation by rulemaking.

Table 2 differs from the notice's Table 1, which describes the regulation, only in the yearly limits of tiers 1 to 3. Both list tier 4 at a flat $50,000 per violation before inflation. Part 102 prints $73,011 as the tier 4 minimum and the yearly cap as its maximum.

The phrase "as adjusted for inflation" leaves the current size of the three lower limits unprinted. Neither notice gives an adjusted figure for them. The January 2026 notice does not mention the 2019 one, and its table prints only the regulation's yearly caps. The last column above therefore shows the limits as the 2019 notice prints them, which are the statute's own amounts.

What would a fax sent to the wrong number cost?

The penalty schedule has no line for a misdirected fax. Whether one is a reportable breach is a separate rule (45 CFR 164.402) that the wrong-number breach post works through. The penalty turns on what the practice knew, and 45 CFR 160.401 defines the words that sort the facts into tiers.

• Reasonable diligence is the business care and prudence expected from a person seeking to satisfy a legal requirement under similar circumstances.
• Reasonable cause is an act or omission the entity knew, or with reasonable diligence would have known, violated a provision, without willful neglect.
• Willful neglect is conscious, intentional failure or reckless indifference to the obligation to comply.

Applied to a wrong-number fax, the tiers sort violations by what the practice knew. If it did not know the number was wrong when it sent the fax, and would not have known with reasonable diligence, the violation is in tier 1, at $145 to $73,011. If it knew or would have known but acted without willful neglect, the violation is in tier 2, at $1,461 to $73,011. Willful neglect, such as faxing again to a number the practice already knew was wrong, puts the violation in tier 3 ($14,602 to $73,011) when corrected within 30 days and in tier 4 (from $73,011) when not. HHS determines which description fits the facts.

Five provisions shape the outcome:

• A covered entity is liable, under the Federal common law of agency, for a violation based on the act or omission of an agent, including a workforce member, acting within the scope of the agency (160.402(c)(1)).
• HHS may not impose a penalty for a violation that is not due to willful neglect and is corrected within 30 days of the date the entity knew, or with reasonable diligence would have known, of it. HHS can allow a longer period, and the entity must establish the facts to HHS's satisfaction (160.410(c)).
• For a violation the entity did not know of and would not have known of with reasonable diligence, the statute leaves HHS free to use corrective action without a penalty (42 U.S.C. 1320d-5(e)).
• HHS counts violations by the obligation a provision sets, and a continuing violation counts once for each day (160.406).
• Within a tier, HHS weighs the people affected, how long the violation lasted, the harm, the entity's compliance history and its financial condition, including its size, and other matters as justice may require (160.408).

Do other HIPAA penalties use different numbers?

Two other routes carry their own figures. A state attorney general can sue for damages of up to $100 per violation, limited to $25,000 for identical violations in a calendar year (42 U.S.C. 1320d-5(d)). A person who knowingly obtains or discloses identifiable health information in violation of the statute faces a fine of up to $50,000, up to one year in prison, or both, and more where the offense involves false pretenses or an intent to sell, transfer or use the information for commercial advantage, personal gain or malicious harm (42 U.S.C. 1320d-6).

* Fax Pigeon prices and plan terms as of October 14, 2026.