HIPAA Civil Money Penalty Tiers (45 CFR 160.404)
The four-tier culpability and penalty structure for HIPAA civil money penalties, with statutory caps adjusted annually for inflation.
Primary source
45 CFR 160.404 — eCFR →https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-D/section-160.404
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
Additional sources
45 CFR 160.404 sets the four-tier penalty structure for HIPAA civil money penalties.
The tiers (HITECH-amended; implemented in 2013 Omnibus):
- No knowledge — the entity did not know and, by exercising reasonable diligence, would not have known.
- Reasonable cause — the violation was due to reasonable cause and not willful neglect.
- Willful neglect, corrected — willful neglect that was corrected within 30 days.
- Willful neglect, not corrected — willful neglect that was not corrected within 30 days.
Each tier has a minimum and maximum penalty per violation, with an annual cap per identical-violation type. HHS adjusts the dollar amounts annually for inflation; the current schedule is published in the Federal Register's annual inflation-adjustment notice and on the HHS regulations enforcement page.
The 2019 HHS Notification of Enforcement Discretion lowered the annual caps for tiers 1-3 to reflect a re-reading of the HITECH statutory text; that notice remains in effect (subject to ongoing reconsideration) and HHS publishes the operative numbers each year.
OCR's enforcement disposition is typically a Resolution Agreement plus corrective action plan; outright contested penalties are rare but litigated cases exist (e.g., MD Anderson, Anthem).
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- RegulationHIPAA Enforcement Rule Overview (45 CFR 160 Subpart C-E)The framework for HHS investigation and enforcement of HIPAA violations: complaints, compliance reviews, informal resolution, civil money penalties, and the four-tier culpability structure.
- RegulationHIPAA Resolution Agreements and Corrective Action Plans (45 CFR 160.312)OCR's preferred enforcement disposition: a Resolution Agreement that includes a corrective action plan, payment, and reporting obligations spanning two to three years.
- RegulationHITECH Enforcement Changes (42 USC 17939)HITECH expanded HIPAA enforcement with state attorney general civil actions, four-tier penalties, willful neglect mandatory investigation, and a percentage of CMPs to harmed individuals.
- SRAHIPAA Settlements and Civil Money Penalties: A Small-Practice Reading ListHow HHS Office for Civil Rights publishes its enforcement record, the tiered civil money penalty structure at 45 CFR 160.404, and what recent small-practice settlements actually say.
- ComplianceBehavioral Health Compliance: 42 CFR Part 2 + HIPAA TogetherHow SAMHSA's 42 CFR Part 2 framework for substance use disorder records overlays HIPAA after the 2024 final rule alignment, and what behavioral health practices must document.
- ComplianceCalifornia Healthcare Compliance: CMIA + HIPAA — Where They DivergeCalifornia's CMIA (Civ. Code §§ 56–56.37) vs HIPAA: stricter consent, 5-working-day inspection / 15-day copy access, private right of action, up to $25k per knowing-and-willful violation + misdemeanor exposure.
- GlossaryAccounting of DisclosuresThe HIPAA right of an individual to receive a list of disclosures of their PHI made by a covered entity over the prior six years.
- BillingBusiness Associate Agreement Checklist for Small PracticesA working checklist for small practices to identify which vendors need a Business Associate Agreement, what clauses the BAA must contain, and how to track them.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.