HIPAA penalty amounts are inflation-adjusted every January and the schedule has been predictable for a decade. 2026 broke the pattern: HHS declined to adjust the amounts at all. Here are the exact figures you should quote, how they were set, and why the number did not move this year.
The four tiers, exact 2026 amounts
The HITECH Act establishes four civil monetary penalty tiers at 45 CFR 160.404, scaled by culpability. The 2026 amounts, carried over from the January 2026 adjustment:
| Tier | Culpability | Minimum per violation | Maximum per violation | Calendar-year cap |
|---|---|---|---|---|
| 1 | Did not know | $145 | $73,011 | $2,190,294 |
| 2 | Reasonable cause | $1,461 | $73,011 | $2,190,294 |
| 3 | Willful neglect, corrected | $14,602 | $73,011 | $2,190,294 |
| 4 | Willful neglect, not corrected | $73,011 | $2,190,294 | $2,190,294 |
Two reads of the table matter.
“Per violation” multiplies. Each day a required safeguard is absent, and each individual whose record was affected, can be counted as a separate violation. A single underlying failure can produce hundreds or thousands of countable violations.
Tier 4 behaves differently. For willful-neglect-not-corrected, the per-violation minimum is $73,011 — the same as every tier’s maximum. The willful-neglect tiers have always carried the biggest practical exposure.
Why there was no 2026 adjustment
The Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015 requires most federal civil money penalties to be adjusted annually using the October CPI-U. HHS published its January 2026 adjustment on 28 January 2026, applying the standard multiplier (1.02598) to the previously effective amounts. That is the schedule that produced the figures in the table above.
Then: nothing in October 2026. HHS published “No Adjustment to HHS Civil Monetary Penalty Amounts for 2026” on 21 October 2026. The notice cited two reasons:
- The CPI-U was not published. The October 2025 CPI-U figure — the input the adjustment formula requires — was not published because of the 1 October to 12 November 2025 federal funding lapse. Without the input, the standard formula could not run.
- OMB guidance M-26-11 (17 April 2026) applied. The OMB guidance addressing penalty adjustments in a year with incomplete CPI data allowed HHS to keep amounts set earlier rather than impute a value.
The practical effect: the January 2026 figures are the operative figures for every HIPAA settlement announced during the rest of 2026, and continue to apply until the next formal adjustment.
Source for the January 2026 adjustment.
Enforcement discretion: the parallel cap system
Alongside the statutory cap, HHS has operated an enforcement-discretion cap regime since 2019. The 2019 Notice applied lower calendar-year caps to the lower culpability tiers:
| Tier | 2019 enforcement discretion cap |
|---|---|
| 1 — Did not know | $25,000 |
| 2 — Reasonable cause | $100,000 |
| 3 — Willful neglect, corrected | $250,000 |
| 4 — Willful neglect, not corrected | $1,500,000 (now $2,190,294 after inflation) |
The 2019 Notice has not been formally rescinded, so the practitioner view is that both cap schemes are available — the statutory maximum under 45 CFR 160.404, and the 2019 lower caps for Tiers 1 to 3. OCR has broadly honoured the 2019 caps in resolution agreements, but there is no durable commitment to continue.
If you are modelling worst-case exposure for a board or an insurer, use the statutory cap ($2,190,294) for Tier 4 and either the 2019 or statutory cap for Tiers 1 to 3, with a note that the choice is OCR’s. Our HIPAA Violations, Fines and Penalties guide carries the full reference.
What recent settlements actually cost
A table of theoretical maximums is useful for budgeting; actual 2026 settlement amounts are useful for calibration. The settlements OCR has publicly announced this year, in order:
- 22 January 2026 — SG Health Plan, settlement amount per HHS resolution agreements page.
- 19 February 2026 — Top of the World Ranch Treatment Centers, $103,000.
- 5 March 2026 — MMG Fusion, settlement amount per HHS resolution agreements page.
- 23 April 2026 — four ransomware settlements announced together, $1,165,000 total.
- 20 May 2026 — Spencer Gifts, settlement amount per HHS resolution agreements page.
- 21 July 2026 — Health plan settlement, OCR’s twentieth ransomware action.
- 27 August 2026 — Azul Vision (Right of Access).
- 17 September 2026 — Ambry Genetics, $700,000.
- 8 October 2026 (announced) — Shen Smiles PC, $140,000.
Three observations.
Most 2026 cheques are well under the statutory maximum. OCR has broadly resolved cases below the statutory cap, consistent with the 2019 enforcement discretion posture. Ambry’s $700,000 is in the top band this year; most settlements are between $100,000 and $300,000.
The cheque is not the full cost. Every one of these resolutions carries a corrective action plan running two to three years, with OCR monitoring, quarterly reporting, and external support engagements. Practitioners who have been through a CAP will tell you the CAP costs more than the cheque.
Right of Access cases are the long tail. Shen Smiles ($140,000) is the fifty-sixth Right of Access settlement. These keep arriving every quarter and are overwhelmingly small practices. The dollar amount is small; the public breach-portal entry is permanent. See our Right of Access post for how to not be the next one.
The bottom line
- 2026 per-violation maximums are $73,011 across all four tiers.
- 2026 calendar-year caps are $2,190,294 at the statutory level, with lower discretionary caps still applied for Tiers 1 to 3.
- HHS made no additional inflation adjustment in October 2026; the January 2026 figures are operative.
- Actual settlements rarely approach the statutory maximum, but the corrective action plans that come with them routinely cost more than the cheque.
If the exposure here is new information, the artefact that moves you from Tier 4 to Tier 1 is your documentation — the current risk analysis, the dated evidence of remediation, the training records tied to policy versions. Our free HIPAA readiness assessment scores where you stand in eight minutes, and the Compliance Score tracks the trajectory.