A business can be fined for HIPAA non-compliance when it is a HIPAA Covered Entity or a HIPAA Business Associate and the Department of Health and Human Services Office for Civil Rights determines that the organization violated the HIPAA Privacy Rule, HIPAA Security Rule, or HIPAA Breach Notification Rule. Civil enforcement applies to organizations such as health plans, health care clearinghouses, and many health care providers, as well as vendors that create, receive, maintain, or transmit protected health information on behalf of a Covered Entity.
Financial consequences can include civil money penalties and resolution agreements that require payment and corrective action obligations. Civil money penalties are assessed using a tiered structure tied to organizational culpability, including whether the organization lacked knowledge, acted with reasonable cause, or engaged in willful neglect and whether timely correction occurred. Penalties are assessed based on the facts of the case and can apply on a per-violation basis, with limits that apply to repeated violations of an identical requirement or prohibition during a calendar year.
State attorneys general can also bring actions for HIPAA violations and may obtain monetary relief and other remedies through litigation or settlement. A single incident can create overlapping exposure when it involves multiple failures, such as missing access controls, insufficient risk analysis, improper disclosures, or delayed breach notification under the HIPAA Breach Notification Rule.
Criminal enforcement is separate from civil enforcement and applies to knowing misuse of protected health information, including obtaining or disclosing protected health information in violation of the statute, with higher exposure when conduct involves false pretenses or personal gain. Organizations address fine risk through documented compliance programs, workforce training aligned with job duties, vendor governance with business associate agreements, and security controls that meet HIPAA Security Rule safeguard requirements.