By using this site, you agree to the Privacy Policy and Terms of Use.
Accept
Health Works CollectiveHealth Works CollectiveHealth Works Collective
  • Health
    • Mental Health
    Health
    Healthcare organizations are operating on slimmer profit margins than ever. One report in August showed that they are even lower than the beginning of the…
    Show More
    Top News
    physical health
    5 Ways Playing Games Can Improve Neural and Physical Health
    September 9, 2022
    Reasons For Hair Loss and Its Treatment
    Reasons For Hair Loss and Its Treatment
    February 16, 2022
    healthcare organization
    5 Actionable Strategies For Healthcare Organizations
    August 15, 2022
    Latest News
    Beyond Nutrition: Everyday Foods That Support Whole-Body Health
    June 15, 2025
    The Wide-Ranging Benefits of Magnesium Supplements
    June 11, 2025
    The Best Home Remedies for Migraines
    June 5, 2025
    The Hidden Impact Of Stress On Your Body’s Alignment And Balance
    May 22, 2025
  • Policy and Law
    • Global Healthcare
    • Medical Ethics
    Policy and Law
    Get the latest updates about Insurance policies and Laws in the Healthcare industry for different geographical locations.
    Show More
    Top News
    The Latest Numbers on Exchange Enrollment
    January 20, 2014
    conversational AI in healthcare
    How Conversational AI is Making Healthcare More Patient-Centric
    July 24, 2024
    create tracking metrics HIS
    Create Tracking Metrics for ICD-10 Preparation
    February 18, 2014
    Latest News
    Let Your Lawyer Handle the Work Before You Pay Medical Costs
    July 6, 2025
    Top HIPAA-Compliant Messaging Apps for Healthcare Teams
    June 25, 2025
    When Healthcare Ends, the Legal Process Begins: What Families Should Know About Probate and Medical Estates
    June 20, 2025
    Preventing Contamination In Healthcare Facilities Starts With Hygiene
    June 15, 2025
  • Medical Innovations
  • News
  • Wellness
  • Tech
Search
© 2023 HealthWorks Collective. All Rights Reserved.
Reading: What Is the Penalty for a HIPAA Violation?
Share
Notification Show More
Font ResizerAa
Health Works CollectiveHealth Works Collective
Font ResizerAa
Search
Follow US
  • About
  • Contact
  • Privacy
© 2023 HealthWorks Collective. All Rights Reserved.
Health Works Collective > Business > What Is the Penalty for a HIPAA Violation?
BusinesseHealthPolicy & LawTechnology

What Is the Penalty for a HIPAA Violation?

tswann
tswann
Share
6 Min Read
SHARE

HIPAA violations are expensive. The penalties for noncompliance are based on the level of negligence and can range from $100 to $50,000 per violation (or per record), with a maximum penalty of $1.5 million per year for violations of an identical provision. Violations can also carry criminal charges that can result in jail time.

Contents
Unencrypted DataEmployee ErrorData Stored on DevicesBusiness Associates

HIPAA violations are expensive. The penalties for noncompliance are based on the level of negligence and can range from $100 to $50,000 per violation (or per record), with a maximum penalty of $1.5 million per year for violations of an identical provision. Violations can also carry criminal charges that can result in jail time.

Fines will increase with the number of patients and the amount of neglect. Starting with a breach where you didn’t know and, by exercising reasonable diligence, would not have known that you violated a provision. To the other end of the spectrum where a breach is due to negligence and not corrected in 30 days. In legalese, this is known as mens rea (state of mind). So fines increase in severity from no mens rea (didn’t know) to assumed mens rea (willful neglect).

The fines and charges are broken down into 2 major categories: “Reasonable Cause” and “Willful Neglect”. Reasonable Cause ranges from $100 to $50,000 per incident and does not involve any jail time. Willful Neglect ranges from $10,000 to $50,000 for each incident and can result in criminal charges.

More Read

Why Are People Afraid Of Life Insurance?
What Really Happens When You Dial 9-1-1?
The Costs of Being a Patient and a Doctor
Why iPad EMRs are Better for Doctor Patient Interaction
CMS Delays 2014 Final Rule

HIPAA violation categories and their respective penalty amounts are outlined in the chart below:

ViolationAmount per violationViolations of an identical provision in a calendar year
Did Not Know$100 – $50,000$1,500,000
Reasonable Cause$1,000 – $50,000$1,500,000
Willful Neglect — Corrected$10,000 – $50,000$1,500,000
Willful Neglect — Not Corrected$50,000$1,500,000

Source: HHS, Federal Register.gov

Unencrypted Data

Addressable does not mean optional. This is a point that we made in a previous post How do I become HIPAA compliant? (a checklist), but it cannot be stressed enough. The vast majority of data breaches are due to stolen or lost data that was unencrypted. When in doubt, you should implement the addressable implementation specifications. Most of them are best practices.

Employee Error

Breaches can occur when employees lose unencrypted portable devices, mistakenly send PHI to vendors who post that information online, and disclose personally identifiable, sensitive information on social networks. All examples from actual cases. Employee training and adherence to security policies and procedures is extremely important.

Data Stored on Devices

Almost half of all data breaches are the result of theft. When laptops, smartphones, etc. are unencrypted the risk of a breach increases considerably. With TrueVault, your data is safely stored off-premise; so that stolen laptop just has a token on it, and no PHI is compromised.

Business Associates

Almost two-thirds of data breaches involved a business associate. Meaning that you delegated a covered function or activity to someone, and that someone messed up. So pick your partners carefully. Some of the largest breaches reported to HHS have involved business associates. As a result, the final omnibus rule expanded many of the requirements to business associates and greatly enhanced the government’s ability to enforce the law.

What sort of penalties are we talking about? Check out this chart with fines levied in years past:

Entity FinedFineViolation
CIGNET$4,300,000Online database application error.
Alaska Department of Health and Human Services$1,700,000Unencrypted USB hard drive stolen, poor policies and risk analysis.
WellPoint$1,700,000Did not have technical safeguards in place to verify the person/entity seeking access to PHI in the database. Failed to conduct a tech eval in response to software upgrade.
Blue Cross Blue Shield of Tennessee$1,500,00057 unencrypted hard drives stolen.
Massachusetts Eye and Ear Infirmary and Massachusetts Eye and Ear Associates$1,500,000Unencrypted laptop stolen, poor risk analysis, policies.
Affinity Health Plan$1,215,780Returned photocopiers without erasing the hard drives.
South Shore Hospital$750,000Backup tapes went missing on the way to contractor.
Idaho State University$400,000Breach of unsecured ePHI.
Shasta Regional Medical Center$275,000Inadequate safeguarding of PHI from impermissible uses and disclosures.
Phoenix Cardiac Surgery$100,000Internet calendar, poor policies, training.
The Hospice of Northern Idaho$50,000Breach of unsecured ePHI. Unencrypted laptop stolen, no risk analysis.

Source: HHS, Case Examples and Resolution Agreements

Looking at this chart we can conclude that HHS does not like people storing unencrypted PHI on mobile devices. What we don’t see yet are fines levied against business associates. 2014 is the first year where business associates will be audited and fined. Smart money says that the first fines levied against business associates will be passed down toward the end of this year.

If this article makes you nervous, then this might be a good time to revisit your organization’s HIPAA compliance program. The good news is that not every PHI breach ends in a fine. If you can show that you have made a reasonable effort to comply with HIPAA then you may not be dinged.

TAGGED:HIPAAHIPAA violationspatient privacy
Share This Article
Facebook Copy Link Print
Share

Stay Connected

1.5kFollowersLike
4.5kFollowersFollow
2.8kFollowersPin
136kSubscribersSubscribe

Latest News

car accident lawsuit
Let Your Lawyer Handle the Work Before You Pay Medical Costs
Policy & Law
July 6, 2025
women dental care
What Is a Smile Makeover and How Much Does It Cost?
Dental health
June 30, 2025
HIPAA-Compliant Messaging Apps
Top HIPAA-Compliant Messaging Apps for Healthcare Teams
Global Healthcare Policy & Law Technology
June 25, 2025
recovering from injury
Rebuilding After Injury: Path to Physical and Emotional Recovery
News
June 22, 2025

You Might also Like

Doctors-on-Twitter-Physician-Marketing-Social-Media-Twitter
Social Media

20 Doctors You Should Be Following on Twitter

August 14, 2015

The High Cost of Vaccine Refusal

May 10, 2011

Medicare Payments to Providers Are Carved, Sliced and Chopped by Sequestration

March 25, 2013
radiologists inattentional blindness
DiagnosticsMedical EducationRadiologySpecialties

Inattentional Blindness and the Invisible Gorilla Study: Are Radiologists at Risk?

March 28, 2013
Subscribe
Subscribe to our newsletter to get our newest articles instantly!
Follow US
© 2008-2025 HealthWorks Collective. All Rights Reserved.
  • About
  • Contact
  • Privacy
Welcome Back!

Sign in to your account

Username or Email Address
Password

Lost your password?