HIPAA / HITECH

HIPAA Civil Penalty Calculator

Estimate HIPAA civil monetary penalty ranges by culpability tier and records affected.

How this is calculated

The tool takes the per-violation range for your culpability tier from the HHS inflation-adjusted table in 45 CFR 102.3 (in force since 28 January 2026): Tier 1 US$145-73,011, Tier 2 US$1,461-73,011, Tier 3 US$14,602-73,011, Tier 4 US$73,011-2,190,294.
It treats each affected record as one violation.
Low end = records x tier minimum, capped at OCR’s 2019 enforcement-discretion annual cap for the tier at its published base amount (US$25,000 / 100,000 / 250,000 / 1.5 million).
High end = records x tier maximum, capped at US$2,190,294, the annual cap per identical provision in 45 CFR 102.3.
Entity type only changes the note on business-associate liability.

Worked example

The calculator run on its default inputs:

Records / individuals affected: 5,000 records
Culpability level: Reasonable cause - no willful neglect
Entity type: Healthcare provider

Tier 2 penalty range

$100K-$2.2M

Culpability tier: Tier 2 - Reasonable cause (knew or should have known; no willful neglect)
Per-violation range (45 CFR 102.3, since Jan 28, 2026): $1,461-$73,011
Estimated range (5,000 records, one violation each): $100,000-$2,190,294
Annual cap per identical provision, every tier (45 CFR 102.3): $2,190,294
OCR 2019 enforcement-discretion cap for this tier (base amount, before inflation): $100,000

For 5,000 records at Tier 2 (reasonable cause): 5,000 x US$1,461 is about US$7.3 million, so the low end stops at the US$100,000 Tier 2 cap from OCR’s 2019 notice; 5,000 x US$73,011 stops at the US$2,190,294 regulatory cap. The range is US$100,000 to US$2,190,294, shown as $100K-$2.2M.

Sources

45 CFR 160.404 (eCFR) - the four culpability tiers and statutory amounts
45 CFR 102.3 (eCFR) - the current inflation-adjusted HIPAA amounts, including the US$2,190,294 cap
HHS annual civil monetary penalties inflation adjustment (Federal Register, 28 January 2026) - effective date of the current amounts
HHS Notification of Enforcement Discretion (84 FR 18151, 30 April 2019) - tiered annual caps of US$25,000 / 100,000 / 250,000 / 1.5 million
42 U.S.C. 1320d-5 (govinfo) - state attorney general actions: US$100 per violation, US$25,000 per identical requirement per year
42 U.S.C. 1320d-6 (govinfo) - criminal penalties up to US$250,000 and 10 years

Sources last checked September 2026.

Limitations

OCR can settle through resolution agreements and corrective action plans, and it can group violations by provision rather than by record, so the high end is a worst-case ceiling, not a forecast. HHS re-adjusts the amounts for inflation, so check the 45 CFR 102.3 table for the year a penalty is assessed. This is an indicative estimate for education and planning, not legal advice. Laws and published figures change, and regulators and courts apply discretion no calculator can model - confirm with a qualified legal or compliance professional before acting on a result.