HIPAA penalties run in four culpability tiers, from $145 to $2,190,294 per violation under the 2026 inflation-adjusted amounts, and real OCR outcomes range from a $5,000 settlement to multi-million dollar penalties. Answer four questions and see the tier your practice would most likely face, with every number sourced to HHS.
An educational estimate, not legal advice. OCR decides culpability on the full record.·Figures checked July 2026
OCR sets the penalty tier by culpability: what you knew, what diligence you exercised, and how fast you correct. These four questions map to exactly that.
Answer the four questions and your estimated exposure appears here, using the official 2026 penalty amounts.
Adjusted for inflation effective January 28, 2026 under 45 CFR 102.3. Per-violation amounts, and a calendar-year cap for violations of an identical provision.
| Tier | Culpability | Per violation | Annual cap (identical provision) |
|---|---|---|---|
| Tier 1 | Could not reasonably have known of the violation | $145 to $73,011 | $2,190,294 |
| Tier 2 | Reasonable cause; not willful neglect | $1,461 to $73,011 | $2,190,294 |
| Tier 3 | Willful neglect, corrected within 30 days | $14,602 to $73,011 | $2,190,294 |
| Tier 4 | Willful neglect, not corrected within 30 days | $73,011 to $2,190,294 | $2,190,294 |
Source: HHS annual civil monetary penalty inflation adjustment, published in the Federal Register on January 28, 2026, codified at 45 CFR 102.3. Violations of multiple different provisions can each carry separate exposure. Since a 2019 Notification of Enforcement Discretion, OCR has applied lower annual limits to the three lower tiers; that notice is discretionary policy, not regulation. If anything here is out of date, email tony@seqora.app and it will be corrected.
Four real enforcement outcomes, small practice to national brand. Read the findings: the same failure appears in every single one.
Breach affecting 21,778 individuals. Core OCR finding: no security risk analysis. The dollar figure is small; the two-year OCR-supervised corrective action plan is not. HHS announcement
A business associate, not a provider: ransomware reached client PHI it held. Core OCR finding: no accurate and thorough risk analysis. Vendors to healthcare carry HIPAA exposure too. HHS announcement
Credential-stuffing breach affecting 197,986 individuals. OCR found three Security Rule failures, starting with the risk analysis, and imposed a civil money penalty rather than a settlement. HHS announcement
Phishing breach affecting 114,007 individuals, plus notification failures. Core OCR finding: no compliant risk analysis. Resolved under OCR's Risk Analysis Initiative. HHS resolution agreement
The tier you land in is not luck. It is mostly one document. OCR runs a dedicated Risk Analysis Initiative, and the first artifact investigators request is your documented security risk analysis. Produce a current one and you are arguing diligence in the lower tiers. Fail to produce one and you are arguing about willful neglect. Every case above, from $5,000 to $3,000,000, shares that same core finding.
It depends on culpability. HHS penalty amounts, inflation-adjusted effective January 28, 2026, run in four tiers: $145 to $73,011 per violation where the entity could not reasonably have known of the violation; $1,461 to $73,011 where there was reasonable cause; $14,602 to $73,011 for willful neglect corrected within 30 days; and $73,011 to $2,190,294 for willful neglect left uncorrected. Each tier also carries a calendar-year cap of $2,190,294 for violations of an identical provision.
Yes. In 2025 OCR settled with Vision Upright MRI, a small California imaging practice, for $5,000 plus a two-year corrective action plan after a breach affecting 21,778 individuals; the core finding was a missing security risk analysis. Business associates are on the hook too: BST & Co. CPAs, an accounting firm, paid $175,000 after a ransomware incident, with the same core finding. Small settlements still carry years of OCR-supervised corrective work.
Culpability. OCR looks at whether you knew or could reasonably have known about the problem, whether you exercised reasonable diligence, and whether willful neglect was corrected within 30 days. In practice, the first artifact OCR requests is your documented security risk analysis. OCR runs a dedicated Risk Analysis Initiative, and a missing or inadequate risk analysis is the common finding across enforcement actions from $5,000 settlements to $3,000,000 ones.
For 2026, penalties for violations of an identical provision are capped at $2,190,294 per calendar year. Violations of multiple different provisions can each carry their own exposure. Since a 2019 Notification of Enforcement Discretion, OCR has applied lower annual limits for the lower culpability tiers, but that notice is discretionary policy rather than binding regulation, and the regulatory caps are the numbers above.
The numbers on this page are set in regulation. What changes is which failures keep turning up in the enforcement record.
Security, Sized Right is a monthly issue on what actually changed: what the enforcement record shows, what underwriters started asking for, and what either one means for a practice too small to have a security team. It is written from real client work, not from vendor research.
You can read the current issue in full before deciding whether to subscribe.
Seqora's guided HIPAA Security Risk Analysis turns plain-English questions into scored risks, a dated remediation plan, and a filed evidence record. See a finished sample, or run one on a demo practice right now. No signup.