HIPAA Glossary · Breach & enforcement
Civil money penalty
Also: CMP
The formal penalty OCR imposes when a case does not settle, calculated under the four culpability tiers.
Context
2026 amounts: $145 to $73,011 per violation, calendar-year cap of $2,190,294. HHS made no 2026 inflation adjustment, so the figures published 28 January 2026 continue to apply. See [the penalties post](/blog/hipaa-penalties-exact-amounts/) for the full table and the enforcement discretion caps that often apply in practice.
Related terms
- Enforcement Rule — The HIPAA regulation setting out investigation procedures and the civil money penalty structure, including culpability tiers.
- Willful neglect — Conscious, intentional failure or reckless indifference to HIPAA obligations.
- Resolution agreement — The settlement instrument closing an OCR enforcement action, typically pairing a payment with a corrective action plan.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.