OCR and state attorneys general issue HIPAA violation fines and settlements
The HIPAA Journal lists HIPAA violation fines and settlements imposed by OCR and state attorneys general from 2008 to 2026, including penalty tiers and amounts.
- Framework
- HIPAA
- Who it concerns
- HIPAA-covered entities and business associates that have been fined or settled with OCR or state attorneys general.
What changed?
Each point with the sentence from the source that says it.
OCR issued a Notice of Enforcement Discretion in April 2019 reducing annual penalty limits for tiers 1, 2, and 3 to $25,000, $100,000, and $250,000 respectively.
OCR issued a Notice of Enforcement Discretion in April 2019 stating the annual penalty limits in three of the penalty tiers would be reduced following a reexamination of the language of the HITECH Act.
The 2026 penalty structure includes tier 1 minimum penalty of $145 and maximum of $73,011 per violation, with an annual limit of $2,190,294.
Tier 1 Reasonable Efforts $145 $73,011 $2,190,294
State attorneys general can issue fines for HIPAA violations up to a maximum of $25,000 per violation category, per year, subject to inflation adjustments.
State attorneys general can issue fines for HIPAA violations up to a maximum of $25,000 per violation category, per year.
OCR is continuing its HIPAA right of access and risk analysis enforcement initiatives and commenced enforcement of Part 2 regulations on February 16, 2026.
The HHS’ Office for Civil Rights is continuing with its HIPAA right of access and risk analysis enforcement initiatives, and commenced the enforcement of the Part 2 regulations under its newly delegated responsibility on February 16, 2026.
Which policies should you review?
Suggested from the change above. Check the source before you edit.
- Security Risk Analysis (SRA) Report
Review the risk analysis policy to ensure it addresses the failures cited in recent OCR settlements, such as incomplete risk analysis and lack of risk management.
- HIPAA Breach Notification Policy
Review the breach notification policy to ensure timely notifications to individuals and HHS, as several settlements involved delayed or missing breach notifications.
- Access Control Policy
Review access control procedures to ensure timely access to PHI, as many settlements were for HIPAA Right of Access failures.