Penalty for each February 18, 2009 or later violation of a HIPAA administrative simplification provision in which it is established that the violation was due to willful neglect and was not corrected during the 30-day period beginning on the first date the covered entity or business associate knew, or, by exercising reasonable diligence, would have known that the violation occurred
For Penalty for each February 18, 2009 or later violation of a HIPAA administrative simplification provision in which it is established that the violation was due to willful neglect and was not corrected during the 30-day period beginning on the first date the covered entity or business associate knew, or, by exercising reasonable diligence, would have known that the violation occurred, agency is HHS; maximum penalty is 2,190,294; minimum penalty is 73,011; annual cap is 2,190,294, recorded from its source on 2026-08-10.
- Agency
- HHS our reading
- Violation
- Penalty for each February 18, 2009 or later violation of a HIPAA administrative simplification provision in which it is established that the violation was due to willful neglect and was not corrected during the 30-day period beginning on the first date the covered entity or business associate knew, or, by exercising reasonable diligence, would have known that the violation occurred verified
- Maximum penalty
- 2,190,294 verified
- Minimum penalty
- 73,011 verified
- Annual cap
- 2,190,294 verified
Values marked our reading are our classification of what the source says — the source does not print them in those words. The quote below is the evidence for each one; judge it yourself.
What the source says
| <https://www.ecfr.gov/current/title-45/section-160.404#p-160.404(b)(2)(iv)(A)> 45 CFR 160.404(b)(2)(iv)(A) , <https://www.ecfr.gov/current/title-45/section-160.404#p-160.404(B)> (B) | OCR | Penalty for each February 18, 2009 or later violation of a HIPAA administrative simplification provision in which it is established that the violation was due to willful neglect and was not corrected during the 30-day period beginning on the first date the covered entity or business associate knew, or, by exercising reasonable diligence, would have known that the violation occurred | 2024 | | | | | | Minimum | 2024 | 71,162 | 73,011 | | | | Maximum | 2024 | 2,134,831 | 2,190,294 | | | | Calendar Year Cap | 2024 | 2,134,831 | 2,190,294
— ecfr.gov, retrieved 2026-08-10
Source
- ecfr.govhttps://www.ecfr.gov/current/title-45/subtitle-A/subchapter-A/part-102/section-102.3