Privacy and Security Rule Violations Impacted by Rule

On Jan. 17, 2020, the Department of Health and Human Services (HHS) published a final rule increasing the civil monetary penalties for violations of the HIPAA Privacy and Security Rules. HHS is required to adjust these penalties for inflation each year.

Effective Jan. 17, 2020, the following civil penalty amounts apply to violations of HIPAA’s Privacy and Security Rules:

• For each violation where the covered entity does not know about the violation (and by exercising reasonable diligence, would not have known about the violation) the penalty amount is between $119 and $59,522.
• If the violation is due to reasonable cause, the penalty amount is between $1,191 and $59,522.
• For each corrected violation caused by willful neglect, the penalty amount is between $11,904 and $59,522.
• For each uncorrected violation caused by willful neglect, the penalty amount is $59,522, with an annual cap of $1,785,651 for all violations of an identical requirement.