If you violate HIPAA, the consequences can include civil fines starting at $145 per incident and running past $2 million in a single calendar year, federal criminal charges carrying up to ten years in prison, a lawsuit from your state attorney general, termination from your job, and loss of your professional license. Which of these actually lands depends on what you did, whether you knew you were doing it, and how quickly it was corrected. The Office for Civil Rights at HHS handles civil enforcement, the Department of Justice prosecutes criminal cases, and state attorneys general have their own independent authority to sue.
Civil Fines From OCR
OCR uses a four-tier civil penalty structure that scales with how culpable the violator was. The less someone knew, and the faster they fixed the problem, the lower the floor. Even a genuine mistake carries a per-violation minimum, and every tier is adjusted for inflation each year. The 2026 ranges per violation:1Federal Register. Annual Civil Monetary Penalties Inflation Adjustment
- Didn’t know and reasonably couldn’t have known: $145 to $73,011 per violation.
- Reasonable cause, not willful neglect: $1,461 to $73,011 per violation.
- Willful neglect, corrected within 30 days: $14,602 to $73,011 per violation.
- Willful neglect, not corrected within 30 days: at least $73,011 per violation, with a per-violation ceiling above $2.1 million.
The word “violation” matters here. A single incident can involve thousands of records, and each record is its own violation. Those numbers stack fast. The calendar-year cap for violations of a single HIPAA requirement is $2,190,294 in 2026.1Federal Register. Annual Civil Monetary Penalties Inflation Adjustment
Since 2019, HHS has applied an enforcement discretion policy that sets lower annual caps for the less culpable tiers. The base annual maximum is $25,000 for unknowing violations, $100,000 for reasonable cause, and $250,000 for corrected willful neglect. Only uncorrected willful neglect carries the full statutory ceiling. Those caps are also adjusted for inflation, and the policy remains in effect indefinitely.2Federal Register. Notification of Enforcement Discretion Regarding HIPAA Civil Money Penalties The underlying statutory penalty tiers come from federal law.3Office of the Law Revision Counsel. 42 USC 1320d-5 General Penalty for Failure to Comply with Requirements and Standards
Business associates — billing companies, cloud vendors, IT contractors, shredding services, anyone handling protected health information for a covered entity — face the same civil penalties directly. The HITECH Act made that explicit in 2009.4HHS.gov. Direct Liability of Business Associates
Criminal Charges
Criminal HIPAA prosecutions go through the Department of Justice, and they target individuals, not just organizations. The person has to knowingly obtain or disclose protected health information in violation of the law. There are three tiers based on intent:5Office of the Law Revision Counsel. 42 USC 1320d-6 Wrongful Disclosure of Individually Identifiable Health Information
- Knowing violation: up to $50,000 and one year in prison.
- Violation under false pretenses: up to $100,000 and five years in prison.
- Violation with intent to profit or cause harm: up to $250,000 and ten years in prison.
The top tier is where you find people who stole patient data to sell it, used it for identity theft, or weaponized it against someone. Those are felonies. But even the bottom tier, a knowing violation with no bad motive, is a federal misdemeanor with real jail time attached. Covered entities can be charged, and so can individual employees, officers, and anyone else responsible under standard corporate criminal liability principles.6Department of Justice. Scope of Criminal Enforcement Under 42 USC 1320d-6
State Attorney General Lawsuits
Federal enforcement isn’t the only track. HITECH gave state attorneys general authority to file civil suits on behalf of their residents for violations of the Privacy and Security Rules. A state AG can pursue damages or a court order stopping the ongoing conduct.7HHS.gov. State Attorneys General
The state AG has to notify HHS and provide a copy of the complaint before filing, ideally at least 48 hours in advance, though that can shorten in an emergency. Practically, a covered entity that suffers a big breach can end up facing an OCR investigation and a state lawsuit at the same time, each with its own penalties.
Losing Your Job and Your License
Government penalties are only one layer. For the individual who committed the violation, the fallout is often personal. Healthcare employers routinely maintain zero-tolerance policies for unauthorized record access, and staff caught snooping are usually fired on the spot rather than warned. Less serious lapses like a careless disclosure can still lead to suspension or mandatory retraining.
Licensed professionals face a second layer on top of that. State licensing boards for doctors, nurses, pharmacists, and therapists can open their own investigations and impose sanctions, up to and including permanent revocation of a license. A board action is independent of any OCR fine or DOJ prosecution, so one violation can produce consequences from three or four directions simultaneously. For many people, losing the license is worse than the fine, because it ends the ability to work in the field at all.
Failing to Report the Breach Is Its Own Violation
When unsecured protected health information is exposed, HIPAA doesn’t allow a quiet cleanup. Every affected individual must receive written notice within 60 calendar days of the breach’s discovery, weekends and holidays included, and the covered entity has to be able to prove it hit that deadline.8Office of the Law Revision Counsel. 42 USC 17932 Notification in the Case of Breach
If more than 500 residents of a single state are affected, prominent local media must also be notified within the same 60 days, with the same details: what happened, what information was involved, what people should do, and what the organization is doing about it.9HHS.gov. Breach Notification Rule Business associates have the same 60-day window to notify the covered entity. Missing any of these deadlines is itself a HIPAA violation and can trigger the civil penalties described above.
How the OCR Process Actually Plays Out
Most OCR investigations start with a complaint. Once the agency accepts one and opens a case, both the complainant and the entity get notified, and the investigation can involve interviews, document requests, and a full review of privacy and security policies. OCR also opens compliance reviews on its own initiative, often based on breach reports.10HHS.gov. HIPAA Compliance and Enforcement
Confirmed violations usually end in a resolution agreement: a settlement payment plus a corrective action plan. These plans have teeth. A recent settlement with a large health system required a $600,000 payment and a two-year monitoring period run by HHS.11HHS.gov. Resolution Agreement and Corrective Action Plan Settlement with PIH Health Corrective action plans typically force the organization to rewrite its privacy and security policies for HHS approval, run annual risk assessments, retrain the entire workforce every year, and file detailed compliance reports. If the entity breaches the agreement, the monitoring period gets extended and civil penalties come back on the table.
Entities that refuse to cooperate or won’t settle get hit with formal civil monetary penalties instead. OCR issues a notice of proposed determination, and the entity can request a hearing before an administrative law judge. That adversarial track is where the headline-grabbing penalty amounts come from.
Can the Patient Sue You Directly?
Not under HIPAA itself. HIPAA gives no private right of action, so a patient whose records were leaked cannot sue the hospital or employee under the federal statute. Only the government and state attorneys general can bring HIPAA enforcement actions.
That doesn’t leave patients without recourse. They can sue under state law for negligence, breach of confidentiality, or invasion of privacy. Results vary by jurisdiction, and some courts refuse to treat a HIPAA violation as automatic proof of negligence, allowing it only as evidence of the standard of care while requiring the plaintiff to prove each element of the state-law claim on its own. Statutory damages for medical privacy breaches under state laws generally run from $100 to $50,000, though actual damages from identity theft or related harm can go significantly higher.