HIPAA Fine & Settlement Statistics (2026): Penalty Tiers, Yearly Totals & the Biggest Settlements

A single HIPAA violation can cost anywhere from USD 145 to over USD 2.19 million, and the largest settlement on record reached USD 16 million. But the dollar figures tell a more useful story than sticker shock: what determines the size of a fine is rarely the size of the breach, and almost always the level of documented compliance, or its absence, that OCR finds.

What's in This Guide

1 The Four Penalty Tiers & 2026 Amounts

HIPAA penalties are structured in four tiers based on culpability, how much the organization knew, and whether it acted. The dollar amounts are adjusted for inflation annually; the figures below took effect January 28, 2026.

Two features of this structure matter in practice. First, penalties are assessed per violation, and a single breach can involve many violations affecting many individuals, so totals climb fast. Second, the tier is set by conduct, not accident: an organization that genuinely could not have known sits in Tier 1, while one that ignored a known problem lands in Tier 4. This is why documentation matters so much, being able to show you took reasonable steps is often what keeps an incident in a lower tier. The amounts adjust each year via an inflation multiplier, so exact figures rise over time; the current multiplier applied was 1.02598.

Source: HIPAA Journal on HIPAA violation fines | Mercer on the 2026 penalty adjustment

2 The 2019 Enforcement-Discretion Caps

There is a crucial nuance that changes the real-world exposure for most violations, and many summaries get it wrong.

Although the Federal Register lists a USD 2,190,294 annual cap for every tier, OCR has, since an April 2019 Notice of Enforcement Discretion, applied much lower annual caps to the first three tiers. In practice, the caps OCR uses are far more moderate for the less-culpable tiers, reserving the full multi-million-dollar cap for the most serious category.

Source: Paubox on the enforcement-discretion caps

3 Year-by-Year Enforcement Totals

OCR's enforcement volume has fluctuated year to year, but the trend line and the record years reveal how the agency's priorities have shifted.

The composition of enforcement has changed even more than the count. In 2022, 17 of 22 penalties resolved Right of Access violations, reflecting that initiative's peak. By 2024, the balance had shifted to the Security Rule, with 14 of 22 actions resolving security failures, as OCR's risk-analysis initiative took hold. The overall direction is clear: after a dip in 2023, enforcement climbed to its second-highest level ever in 2025, and a large backlog of breaches under investigation, 978 as of early 2026, signals that more penalties from 2023 to 2024 incidents are still coming.

Source: HIPAA Journal State of HIPAA enforcement

4 The Largest Settlements on Record

The headline settlements illustrate what draws OCR's largest penalties, and nearly all trace to the same root failures documented in enforcement history.

The pattern is consistent across the largest cases: risk-analysis failures, inadequate safeguards, and, notably, insider threats and ignored patient rights. Montefiore's USD 4.75 million penalty is instructive because it stemmed not from an external hacker but from a single employee stealing data over six months, undetected because the organization lacked audit controls on its records. The lesson embedded in the biggest settlements is that OCR penalizes the failure to monitor, document, and control access, the systemic gaps, as heavily as the breach itself.

Source: Secureframe on major HIPAA settlements | HIPAA fine statistics on named cases

5 When Small Incidents Cost Big

One of the most important lessons in the fine data is counterintuitive: the size of a penalty often has little to do with the size of the breach.

Cignet's penalty came from 41 patients, not millions, and was driven by the organization's conduct: it denied a clear legal right and then ignored the regulator. The dental-practice penalty makes the same point at a scale any small office can relate to. Fine size tracks culpability, cooperation, and whether the entity honored patient rights and documented its compliance, not the raw number of records involved. A small practice cannot comfort itself with "we're too small to matter" or "it was only a few patients." The willingness to ignore a rule is what OCR penalizes, and that is available to organizations of any size.

Source: Secureframe on the Cignet case | Healthcare Law Insights on the dental-practice penalty

6 The State Attorney General Layer

Finally, a source of exposure many practices overlook entirely: OCR is not the only enforcer. State attorneys general can pursue the same conduct, creating the potential for parallel penalties.

State attorneys general have authority to enforce HIPAA and parallel state privacy laws, and they increasingly do. The Comstar case in 2026 illustrates the dual exposure vividly: a business associate faced a USD 515,000 state AG fine (Massachusetts and Connecticut) plus a separate USD 75,000 OCR settlement for the same breach. The critical planning insight is that the OCR settlement is often the smallest piece of the total financial exposure. Between OCR penalties, state AG actions, class-action lawsuits, breach-notification costs, and remediation, the full cost of a breach dwarfs the headline federal fine, which is why prevention economics are so favorable.

For the underlying violation types and causes behind these fines, see the companion report on HIPAA violation statistics.

7 Summary Table: Every Statistic at a Glance

Frequently Asked Questions