Which of These Is a Type of Penalty for a HIPAA Violation: Civil and Criminal Tiers, Real Fine Figures, and Who Ends Up Paying

The two types of penalty are civil money penalties and criminal penalties, and within civil enforcement the HHS Office for Civil Rights sorts them into four tiers that now carry statutory minimums starting at $137 per violation, with a calendar-year cap of $2,067,813 for the lowest tier and $2,067,813 as the annual ceiling for the most severe tier under the inflation-adjusted figures published in the Federal Register. Knowing which tier your case falls into tells you far more than knowing that "HIPAA has penalties" ever will.

Why the Civil Penalty Tiers Are the Real Answer Most Quizzes Want

When an exam or a compliance training module asks which of these is a type of penalty for a HIPAA violation, the expected answer is almost always "civil money penalty" or "criminal penalty" — the two statutory categories created in the 1996 law and tightened by the HITECH Act in 2009. The civil side is administered by the Office for Civil Rights within the Department of Health and Human Services, which investigates complaints, conducts audits, and can impose fines without going to court. The criminal side runs through the Department of Justice and requires proof of intent beyond what a civil case needs. A third enforcement lever — corrective action plans — is not technically a "penalty" in the statute, but it is often the most expensive part of a settlement for a small provider.

What trips people up is treating the tiers as separate penalty "types." They aren't. They are levels of culpability within the single civil penalty structure. A covered entity that didn't know it was violating the rule sits in tier one; one acting with willful neglect that it failed to correct sits in tier four. The same violation — say, failing to encrypt a laptop with 4,000 patient records — can land in any of the four tiers depending on what the investigation shows about the entity's awareness and response.

The tiers matter because the money attached to them is not close. Tier one's minimum is $137 per violation. Tier four's minimum is $68,928 per violation. That's a 503-fold difference in the floor, before you multiply by the number of records involved. According to the HHS Office for Civil Rights penalty inflation adjustment published in the Federal Register, those figures are the civil monetary penalty maximums that apply per violation for the calendar year, and they are readjusted annually for inflation under the Federal Civil Penalties Inflation Adjustment Act.

Those numbers follow the inflation-adjusted schedule HHS has applied since 2019, when the agency removed the prior practice of stacking identical violations into enormous single penalties and instead capped the total per identical provision per year.

Which Violation Lands You in Which Tier: Four Worked Scenarios

A front-desk employee leaves a printed schedule on the counter and a patient photographs it. The practice had a shredding policy, trained staff, and the employee simply made a mistake. That is tier two territory at most — reasonable cause, since the infrastructure existed but wasn't followed. OCR has historically settled these informally or with a corrective action plan rather than a fine.

A hospital discovers its EHR audit logs weren't reviewed for 14 months because the compliance officer quit and nobody was assigned the task. That reads as willful neglect that was corrected once discovered, so tier three. If the hospital finds the gap, fixes it within 30 days, and documents the fix, the exposure is $13,785 per violation rather than $68,928.

A covered entity receives an OCR data request, ignores it, and continues the same billing practice for another year. That is tier four: willful neglect, not corrected. This is the tier behind most of the headline multi-million-dollar settlements, and the per-violation math is what drives the total into seven figures.

A business associate — a cloud vendor storing ePHI — suffers a breach because its encryption at rest was misconfigured. The vendor had a signed BAA but never conducted a risk analysis. Tier three is the common landing spot. Business associates have been directly liable for HIPAA since the HITECH Act, and OCR's enforcement actions against them climbed steadily through the 2010s and into the 2020s.

Criminal Penalties Are Rare but Carry Prison Time, and the Tier Structure Is Different

The criminal track is where HIPAA diverges from most regulatory schemes: it can put a person in federal prison. The statute creates three criminal tiers, and unlike civil penalties, they are graded by knowledge and intent rather than neglect. A person who knowingly obtains or discloses individually identifiable health information faces up to one year in prison and a $50,000 fine. If the offense is committed under false pretenses, the ceiling rises to five years and $100,000. If the intent was to sell, transfer, or use the information for commercial advantage, personal gain, or malicious harm, it becomes ten years and $250,000.

The DOJ brings few of these cases, and the ones that make news tend to involve insiders — a nurse who pulled records of a celebrity patient, a hospital employee who sold patient lists, a scheduler who looked up an ex-partner's chart. The 2003 prosecution of a Texas hospital worker who accessed a patient's records and disclosed them is among the early examples, and DOJ has continued to pursue individual insider cases since. The point for compliance training is not that criminal charges are likely; it's that the statute creates a personal exposure that corporate insurance does not cover for intentional conduct.

The pragmatic takeaway: criminal penalties are a real answer to the "which type" question, but they are not the penalty most organizations actually face. Civil money penalties and corrective action plans account for the overwhelming share of enforcement outcomes. If a quiz offers both "civil money penalty" and "criminal penalty" as options, both are correct categories — the question usually wants whichever one fits the fact pattern, and intent is the discriminator.

Those figures come from the Social Security Act enforcement provisions as amended by HITECH, codified at 42 U.S.C. § 1320d-6, and the fine amounts are the statutory maximums, not adjusted annually the way civil penalties are. Courts can impose less.

State Attorneys General Can Fine You Separately, and That Stacking Gets Missed

The HITECH Act gave state attorneys general the authority to bring civil actions for HIPAA violations affecting residents of their state, and this is the penalty route most compliance decks skip. A single breach can produce an OCR settlement and a separate state action, and the state remedy is not capped by HIPAA's federal schedule. The AG can seek damages on behalf of residents, injunctive relief, and in some state statutes, statutory damages per record.

Connecticut's attorney general settled with a health system over a 2015 breach involving unencrypted data, and the resulting agreement included a payment plus a compliance undertaking. New York's AG has pursued similar actions against pharmacy chains and health plans. The dollar figures vary widely by state and by the size of the affected population, and no single schedule applies — which is exactly why the federal tier table doesn't capture a covered entity's worst-case exposure.

There's a second stacking issue. HHS can refer a case for criminal prosecution while simultaneously pursuing civil penalties, and the two are not mutually exclusive for the same conduct in every scenario, though DOJ and OCR coordinate. The practical consequence for a compliance officer is that a cost estimate built only on the OCR civil penalty table understates the total by an unbounded margin, because the state and criminal tracks have their own economics.

According to data OCR publishes on its enforcement website, the office has resolved thousands of cases since 2003, and the majority closed with no monetary settlement — they end in technical assistance or a corrective action plan. That distribution matters. The penalty table reads like a threat; the actual enforcement data reads more like a triage system where documentation and responsiveness move you out of the expensive tiers.

The Corrective Action Plan Is the Penalty Nobody Budgets For

A corrective action plan is a multi-year agreement in which the covered entity commits to specific remediation steps, submits periodic reports to OCR, and pays for independent monitoring. It is not a fine, but the cost often dwarfs the fine. A three-year CAP that requires an outside consultant to audit policies, retrain staff, and certify compliance can run into six figures annually for a mid-size provider, and the reports are not optional.

The classic CAP elements are predictable: a risk analysis performed to the standard in the HIPAA Security Rule, a risk management plan, revised policies on access controls and device encryption, workforce training with attendance records, and a designated privacy or security officer with documented authority. Failure to meet CAP milestones reopens the case, and OCR has pursued entities for CAP noncompliance — which converts a resolved matter into an active tier-three or tier-four problem.

This is the element that turns a compliance budget conversation realistic. A provider comparing the cost of encryption software against the tier-one minimum of $137 per violation can talk itself into skipping the project. That comparison ignores that the realistic outcome for an unencrypted breach with no documented risk analysis is a CAP plus a settlement, not a tier-one fine. The CAP rarely appears in the table of maximums because it isn't a penalty — it's a contract.

The 2024 Change to the Business Associate Agreement and What It Changed About Liability

The HITECH Act made business associates directly liable for Security Rule compliance, and the enforcement pattern since then shows BAs facing civil money penalties without the covered entity being fined at all. A cloud storage vendor, a billing clearinghouse, a transcription service — each can be the primary respondent in an OCR action if the breach traces to its systems and its own safeguards were deficient.

This matters for the penalty question because the type of penalty stays the same but the payer changes. In a breach traced to a BA, the covered entity's customers may face notification obligations and reputational damage while the BA pays the civil money penalty. Contracts typically include indemnification and breach-cost allocation, but OCR does not care about the contract — it enforces against whoever violated the rule.

The 2024 final rule on reproductive health data under the HIPAA Privacy Rule added another layer, restricting the use and disclosure of reproductive health care information for certain purposes and expanding the circumstances under which a BA's conduct draws scrutiny. For penalties, the practical effect is a new category of potential violation that OCR has signaled it will enforce, and any compliance cost model that predates that rule understates current exposure.

Business associates who have not signed a compliant BAA, or who are operating under an outdated agreement, should confirm their status with the covered entity's compliance office and verify current requirements on the HHS website, since the agreement terms and the enforcement posture have shifted over time.

How OCR Actually Decides Whether to Fine: The Five Factors

The Office for Civil Rights publishes the factors it weighs in determining penalty amounts, and they are more useful than the tier table alone because they explain why two entities with identical breaches get different outcomes. The factors include the nature and extent of the violation, the number of individuals affected, the harm resulting from the violation, the entity's history of prior compliance or noncompliance, the entity's financial condition, and the amount of cooperation with the investigation.

Cooperation is the cheapest lever a covered entity controls. An entity that self-reports a breach, provides the requested documents promptly, and demonstrates a remediation plan is routinely treated more favorably than one that stonewalls or produces records in dribs. OCR settlement press releases note cooperation and corrective action, and the agency's resolution agreements often cite the entity's willingness to resolve voluntarily as a factor in the outcome.

The financial condition factor is why small providers sometimes settle for smaller amounts than the tier minimum would suggest. OCR has discretion in settlement negotiations, and a rural clinic with limited resources is not going to be fined into insolvency — the agency's goal is compliance, not revenue. That discretion cuts both ways: a large health system with a documented history of prior findings will not get the benefit of the doubt.

Prior compliance history is the factor most often ignored in self-assessments. A single prior breach with a corrective action plan that was closed, followed by a second breach in a related area, reads as a pattern. The tier assignment can escalate on the strength of that history alone, even if the second incident was less severe than the first.

A Worked Calculation: What a 12,000-Record Breach Could Cost Across Tiers

Take a mid-size medical group with 12,000 patients whose unencrypted backup drive goes missing. The drive holds names, dates of birth, diagnosis codes, and insurance identifiers — clearly ePHI. Under the tier structure, the per-violation count is the variable that drives everything, and OCR's practice in settlements has been to treat each affected individual's record as a violation unit for counting purposes in many cases, though the agency does not publish a rigid formula.

If the group had no risk analysis, no encryption, and no documented device inventory, the investigation likely lands in tier three or four. At tier three's $13,785 per violation, even a conservative count of one violation per affected individual produces a nominal figure of $165,420,000 — which is why the annual cap matters. The cap of $344,640 per identical provision per year (tier three) becomes the binding number, and that is before the cap on the most severe tier of $2,067,813.

At tier two, the math is different: $1,379 per violation with a $103,390 annual cap per identical provision. A group that can document a risk analysis, training, and a good-faith encryption effort but had a lapse in device tracking is arguing for tier two. The gap between tier two's cap and tier four's cap — $103,390 versus $2,067,813 — is the financial value of documentation, and it is roughly a twentyfold difference on the same underlying incident.

The lesson from the arithmetic is that the per-violation figures in the news are almost never what gets paid as a raw calculation. Settlement amounts reflect caps, negotiated allocation across provisions, the entity's ability to pay, and the cooperation credit. The tier table is the frame; the settlement is the outcome.

Encryption, Documentation, and the Tiers: The Cheapest Risk Reduction Available

Encryption is the single control that most reliably moves a breach out of the expensive tiers, because the HIPAA Security Rule's breach notification provisions treat properly encrypted data as not breached — the "safe harbor" in the Breach Notification Rule means no notification obligation if the data was rendered unusable, unreadable, or indecipherable to unauthorized persons. A missing encrypted laptop with a strong encryption standard is a device loss, not a reportable breach, and the penalty exposure drops accordingly.

Documentation is the second control. OCR's investigations ask for the risk analysis, the risk management plan, the policies, the training records, and the device inventory. An entity that has all five, even with imperfect execution, is arguing from a tier-two posture. An entity with none of them has no defense against a tier-four characterization regardless of how the breach actually happened.

The cost comparison is blunt. Full-disk encryption on a fleet of laptops is a routine IT line item; a three-year CAP with independent monitoring is not. The tier table and the CAP cost together make the case that spending on preventive controls is cheaper than spending on the back end, and the entities that have settled largest are frequently the ones that skipped the inexpensive steps.

A reasonable approach for a small practice is to prioritize in this order: a documented risk analysis, encryption on portable devices, access controls and audit logging, workforce training with records, and a device inventory. Each maps to a Security Rule standard and each is a documented factor in OCR's tier assignment.

FAQ

Is a fine the only type of penalty under HIPAA? No. Civil money penalties and criminal penalties are the two statutory categories, but corrective action plans, state attorney general actions, and breach notification obligations carry real cost without being fines. OCR's own enforcement data shows most resolved cases end in technical assistance or a CAP rather than a monetary payment.

Can an individual employee be fined personally for a HIPAA violation? Yes, under the criminal provisions. The civil penalty structure applies to covered entities and business associates, but 42 U.S.C. § 1320d-6 reaches individuals who knowingly obtain or disclose identifiable health information, with penalties up to $50,000 and one year for the base offense and up to $250,000 and ten years for offenses involving commercial advantage or malicious harm.

How long does a HIPAA penalty stay on the record? Settlement agreements and resolution agreements are published by OCR and remain publicly available indefinitely, and a corrective action plan typically runs two to three years with reporting obligations. A subsequent violation during or after the CAP period can reference the prior history as a factor in tier assignment.

Does a small practice with five employees face the same tiers? The tier structure applies to all covered entities regardless of size, but OCR weighs financial condition and the agency's settlement practice accounts for ability to pay. A small practice's realistic exposure is often a CAP plus a modest settlement rather than the statutory maximum.

What happens if a business associate causes the breach? The business associate can be the direct respondent in an OCR action and face its own civil money penalty, and the covered entity may still have notification and contract obligations. The BAA's indemnification terms allocate the cost between the parties, but they do not change OCR's enforcement authority.

Is a HIPAA violation a felony? Only in the most serious criminal tier. The base criminal offense is a misdemeanor with up to one year, the false pretenses tier is a felony carrying up to five years, and the tier involving intent to sell or use information for commercial advantage or malicious harm carries up to ten years and is a felony.

Does OCR always impose the maximum tier? No. The five published factors — nature and extent of the violation, number of individuals affected, harm, prior compliance history, financial condition, and cooperation — give OCR discretion, and settlements routinely land below the maximum for the applicable tier. The proposed 2024 reproductive health rule and other recent changes affect scope, but the discretionary framework remains.

This article is general educational information about HIPAA enforcement categories and published penalty schedules; it is not legal advice, a compliance determination, or a prediction of how any specific investigation will resolve. Penalty amounts, tier assignments, and enforcement priorities depend on facts, jurisdiction, and agency discretion, so consult a qualified health care attorney or compliance professional in your state before acting on anything here. If you are facing an active OCR investigation or a breach with imminent patient harm, contact local emergency or crisis services as appropriate and engage counsel promptly.