# Penalty for each February 18, 2009 or later violation of a HIPAA administrative simplification provision in which it is established that the violation was due to willful neglect and was not corrected during the 30-day period beginning on the first date the covered entity or business associate knew, or, by exercising reasonable diligence, would have known that the violation occurred — Federal civil penalty maximums — current inflation-adjusted amounts across agencies

For Penalty for each February 18, 2009 or later violation of a HIPAA administrative simplification provision in which it is established that the violation was due to willful neglect and was not corrected during the 30-day period beginning on the first date the covered entity or business associate knew, or, by exercising reasonable diligence, would have known that the violation occurred, agency is HHS; maximum penalty is 2,190,294; minimum penalty is 73,011; annual cap is 2,190,294, recorded from its source on 2026-08-10.

- **Agency:** HHS _(our reading, not quoted from the source)_
- **Violation:** Penalty for each February 18, 2009 or later violation of a HIPAA administrative simplification provision in which it is established that the violation was due to willful neglect and was not corrected during the 30-day period beginning on the first date the covered entity or business associate knew, or, by exercising reasonable diligence, would have known that the violation occurred _(verified: appears in the quote below)_
- **Maximum penalty:** 2,190,294 _(verified: appears in the quote below)_
- **Minimum penalty:** 73,011 _(verified: appears in the quote below)_
- **Annual cap:** 2,190,294 _(verified: appears in the quote below)_

## What the source says

> | <https://www.ecfr.gov/current/title-45/section-160.404#p-160.404(b)(2)(iv)(A)> 45 CFR 160.404(b)(2)(iv)(A) , <https://www.ecfr.gov/current/title-45/section-160.404#p-160.404(B)> (B) | OCR | Penalty for each February 18, 2009 or later violation of a HIPAA administrative simplification provision in which it is established that the violation was due to willful neglect and was not corrected during the 30-day period beginning on the first date the covered entity or business associate knew, or, by exercising reasonable diligence, would have known that the violation occurred | 2024 | | | | | | Minimum | 2024 | 71,162 | 73,011 | | | | Maximum | 2024 | 2,134,831 | 2,190,294 | | | | Calendar Year Cap | 2024 | 2,134,831 | 2,190,294

## Source

- https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-A/part-102/section-102.3

Last verified: 2026-08-10. Review by: 2027-02-26.
Part of [Federal civil penalty maximums — current inflation-adjusted amounts across agencies](https://referencesource.org/federal-civil-penalty-maximums/).