# Penalty for each February 18, 2009 or later violation of a HIPAA administrative simplification provision in which it is established that the covered entity or business associate did not know and by exercising reasonable diligence, would not have known that the covered entity or business associate violated such a provision — Federal civil penalty maximums — current inflation-adjusted amounts across agencies

For Penalty for each February 18, 2009 or later violation of a HIPAA administrative simplification provision in which it is established that the covered entity or business associate did not know and by exercising reasonable diligence, would not have known that the covered entity or business associate violated such a provision, agency is HHS; statutory authority is 1320(d)-5(a); maximum penalty is 73,011; minimum penalty is 145; annual cap is 2,190,294, recorded from its source on 2026-08-10.

- **Agency:** HHS _(our reading, not quoted from the source)_
- **Violation:** Penalty for each February 18, 2009 or later violation of a HIPAA administrative simplification provision in which it is established that the covered entity or business associate did not know and by exercising reasonable diligence, would not have known that the covered entity or business associate violated such a provision _(verified: appears in the quote below)_
- **Statutory authority:** 1320(d)-5(a) _(verified: appears in the quote below)_
- **Maximum penalty:** 73,011 _(verified: appears in the quote below)_
- **Minimum penalty:** 145 _(verified: appears in the quote below)_
- **Annual cap:** 2,190,294 _(verified: appears in the quote below)_

## What the source says

> 1320(d)-5(a) | <https://www.ecfr.gov/current/title-45/section-160.404#p-160.404(b)(2)(i)(A)> 45 CFR 160.404(b)(2)(i)(A) , <https://www.ecfr.gov/current/title-45/section-160.404#p-160.404(B)> (B) | OCR | Penalty for each February 18, 2009 or later violation of a HIPAA administrative simplification provision in which it is established that the covered entity or business associate did not know and by exercising reasonable diligence, would not have known that the covered entity or business associate violated such a provision | 2024 | | | | | | Minimum | 2024 | 141 | 145 | | | | Maximum | 2024 | 71,162 | 73,011 | | | | Calendar Year Cap | 2024 | 2,134,831 | 2,190,294

## Source

- https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-A/part-102/section-102.3

Last verified: 2026-08-10. Review by: 2027-02-26.
Part of [Federal civil penalty maximums — current inflation-adjusted amounts across agencies](https://referencesource.org/federal-civil-penalty-maximums/).