One missed risk assessment or one lost laptop can cost your organization millions. That's not an exaggeration. The penalties for non compliance with HIPAA range from a few hundred dollars per violation to felony charges with prison time, depending on what happened and how it happened. If you're building or running a healthcare application, you need to know exactly where those lines sit before you cross them.

This article breaks down the real numbers: the four tiers of civil monetary penalties, the criminal charges the Department of Justice can pursue, and how OCR enforcement actually plays out in practice, including recent settlements you can learn from. You'll see how penalty amounts scale with negligence, and why "we didn't know" rarely works as a defense.

We wrote this guide because most teams integrating with EHRs underestimate how fast compliance gaps turn into legal exposure. At SoFaaS, we build HIPAA-compliant infrastructure specifically so developers don't have to become compliance experts overnight. Understanding these fines and consequences first, though, makes it obvious why getting the technical safeguards right from day one matters so much.

Why HIPAA penalties matter for your organization

Most people picture a HIPAA fine as a single line item, a check the compliance department writes and everyone moves on. That's not how it works in practice. A single enforcement action can trigger a corrective action plan that locks your organization into years of mandatory audits, external monitoring, and reporting obligations to the Office for Civil Rights (OCR). Those obligations cost more in staff time and legal fees than the original penalty. Understanding hipaa non compliance penalties isn't an academic exercise for your legal team; it's a direct input into how you architect your product, vet your vendors, and price your risk.

Enforcement comes from more than one direction

OCR, part of the U.S. Department of Health and Human Services, handles the majority of HIPAA enforcement, but it's not the only body with teeth. State attorneys general can bring their own actions under the HITECH Act, and the Department of Justice steps in when violations cross into criminal territory. Each agency has different thresholds for action and different remedies available.

Enforcer	Authority	Typical Outcome
OCR (HHS)	Civil investigations, audits	Monetary penalties, corrective action plans
State Attorneys General	Civil suits under HITECH	Damages, injunctions, settlements
Department of Justice	Criminal prosecution	Fines, imprisonment

Because three separate agencies can pursue the same underlying incident, a breach rarely stays contained to one investigation. A weak access control that triggers an OCR review can also draw state-level scrutiny if patient data crossed state lines, which it almost always does in a cloud-based health app.

The costs that never show up in the penalty tables

Fines get the headlines, but they're often the smallest piece of the total damage. Breach notification alone is expensive: under the HIPAA Breach Notification Rule, you must notify every affected individual, and if the breach hits 500 or more people, you notify HHS and local media too. Add forensic investigation, credit monitoring for affected patients, legal counsel, and the engineering hours spent patching the vulnerability, and the real bill dwarfs the civil penalty.

The fine is rarely the expensive part. The lawsuits, lost contracts, and rebuild work that follow are.

Reputational damage compounds all of it. Health systems and EHR vendors do due diligence before integrating with third-party apps, and a public HIPAA settlement shows up in every background check a partner runs on you. For an early-stage healthcare startup, that single search result can end partnership conversations before they start.

Why this hits healthcare tech companies especially hard

If you're building software that touches protected health information (PHI), you're almost certainly a business associate under HIPAA, which means you carry direct liability, not just contractual liability passed down from a covered entity. The 2013 Omnibus Rule made this explicit: business associates can be investigated, fined, and sued directly by OCR, independent of whatever happens to the healthcare provider you're serving. Reviewing the Department of Health and Human Services' own summary of the HIPAA Rules gives you the clearest picture of where that liability starts and stops (see HHS.gov's HIPAA guidance).

This matters even more for teams integrating with EHR systems, because every API connection, every OAuth token, and every webhook payload is a potential exposure point. A misconfigured integration that leaks PHI to the wrong endpoint doesn't just cost you the fine; it can cost you the EHR vendor relationship entirely, since systems like Epic and Cerner audit the apps connecting to their platforms and can revoke access after a compliance failure. Once you understand how steep the downside is, the argument for building on infrastructure that's already been through SOC 2 and HIPAA audits stops being a nice-to-have and starts looking like basic risk management.

How to avoid HIPAA non-compliance penalties

Preventing a penalty is far cheaper than fighting one. Most enforcement actions trace back to the same handful of gaps: no risk assessment, weak access controls, missing business associate agreements, or a breach that sat unreported for too long. Fixing those gaps upfront is a fraction of the cost of a corrective action plan, and it's work you control on your own timeline instead of OCR's.

Run a real risk assessment, not a checkbox exercise

Every covered entity and business associate is required to conduct a security risk assessment, but too many teams treat it as a form to file away. Do it properly: inventory where PHI lives, map every system that touches it, and document the gaps you find along with a remediation timeline. OCR consistently cites "failure to conduct an accurate and thorough risk assessment" as a root cause in its largest settlements, so this single step protects you against a huge share of potential penalties.

A risk assessment you actually act on is the cheapest insurance policy in healthcare tech.

Lock down access, encryption, and vendor agreements

Technical safeguards stop breaches before they start, but administrative safeguards are what OCR checks first during an investigation. Cover both:

• Encrypt PHI at rest and in transit, without exception.
• Enforce role-based access control so staff and integrations only reach the data they need.
• Sign a business associate agreement (BAA) with every vendor and API partner that touches PHI, before you send them a single record.
• Log and monitor access so you can prove, not just claim, who touched what and when.
• Patch and update systems on a defined schedule, not an ad hoc one.

Skipping the BAA step is one of the most common and most avoidable mistakes. If a vendor won't sign one, that's a signal to walk away, not a detail to sort out later.

Train your team and prepare for the breach you hope never happens

Technology alone doesn't prevent violations; people do, or fail to. Annual HIPAA training for every employee who touches PHI, paired with a written incident response plan, means your team knows exactly what to do in the first hours after a suspected breach, which is often the window that determines whether a small incident stays small.

Relying on infrastructure that's already built for this reduces your exposure automatically. Platforms like SoFaaS handle encryption, audit logging, and BAA-covered EHR connections as part of the managed service, so your engineering team isn't reinventing HIPAA safeguards for every new integration. That's the practical version of prevention: fewer places for something to go wrong in the first place.

The four tiers of civil monetary penalties

HIPAA's civil penalty structure isn't a single flat fine. The HITECH Act created four distinct tiers, each tied to how much the organization knew and how quickly it fixed the problem. OCR adjusts the dollar ranges for inflation almost every year, so treat these as current benchmarks rather than fixed numbers, and always check the latest figures on HHS.gov before assuming a specific amount applies to your case.

Tier 1: you genuinely didn't know

This tier covers violations where the organization did not know, and reasonably could not have known, that its actions violated HIPAA. It's the lightest tier, but it still isn't free. Per-violation fines start in the low hundreds and can climb into the tens of thousands, because ignorance reduces the penalty, it doesn't erase it.

Tier 2: reasonable cause, no willful neglect

Here, the organization should have known better. Maybe a policy existed but nobody enforced it, or a warning sign got missed. Reasonable cause violations carry noticeably higher per-incident fines than Tier 1, reflecting that a bit more diligence would have caught the issue.

Tier 3 and Tier 4: willful neglect

Willful neglect means the organization knew about the risk and simply didn't act. Tier 3 applies when the violation gets corrected within 30 days of discovery; Tier 4 applies when it doesn't. Tier 4 carries the harshest penalties in the entire civil framework, and OCR reserves it for cases where an organization ignored known gaps, such as skipping a risk assessment year after year despite repeated internal flags.

Willful neglect that never gets corrected is the one scenario where OCR has almost no reason to go easy on you.

Tier	Level of Knowledge	Per-Violation Range (approx.)	Annual Cap (approx.)
1	Did not know	$137 - $68,928	$2,067,813
2	Reasonable cause	$1,379 - $68,928	$2,067,813
3	Willful neglect, corrected	$13,785 - $68,928	$2,067,813
4	Willful neglect, not corrected	$68,928 minimum	$2,067,813

Every tier shares the same annual cap per violation category, but that cap resets each year and applies separately to each type of violation, so a multi-year, multi-category breach can blow past that number fast. The hipaa penalties for non-compliance scale this way specifically to punish repeated or ignored risk, not honest mistakes, which is exactly why a documented, acted-upon risk assessment matters so much before OCR ever comes calling.

Criminal penalties and jail time for violations

Civil fines hit the organization's bank account. Criminal charges hit an individual's freedom, and that distinction changes everything about how seriously you should treat this topic. The Department of Justice, not OCR, prosecutes criminal HIPAA violations, and it reserves that power for cases involving knowing misconduct, not honest mistakes or sloppy paperwork. If you're wondering whether hipaa non compliance penalties can ever mean jail time, the answer is yes, and the law spells out exactly when.

The three tiers of criminal liability

Federal law under 42 U.S.C. § 1320d-6 breaks criminal violations into three levels of intent, each with its own sentencing range:

Violation Type	Maximum Fine	Maximum Prison Term
Knowingly obtaining or disclosing PHI	$50,000	1 year
Committed under false pretenses	$100,000	5 years
Intent to sell, transfer, or use PHI for commercial gain, personal gain, or malicious harm	$250,000	10 years

Notice how the penalty scales with motive, not just outcome. A curious employee who peeks at a celebrity patient's chart faces different exposure than someone who steals records to sell on the black market, even if the technical act (unauthorized access) looks similar on paper.

Criminal liability under HIPAA isn't about the size of the breach. It's about what you intended to do with the data.

Who actually faces prosecution

DOJ prosecutions target individuals far more often than corporations. Physicians, nurses, hospital employees, and IT staff have all been convicted for snooping on records, selling patient data, or using PHI to commit identity theft and insurance fraud. Software vendors and their employees aren't exempt just because they sit outside a hospital's walls; if you build or operate a system that touches PHI and someone on your team knowingly misuses it, that person can be charged personally, separate from whatever civil penalty your company absorbs.

Qualifying for criminal charges generally requires proof of intent, which is why most enforcement stays civil. But intent isn't hard to establish when someone accesses records they had no work reason to view, or when audit logs show a pattern of unauthorized queries right before a data sale surfaces. This is exactly why access logging matters as much for legal defense as for security; without it, you can't prove an employee's access was legitimate, and neither can prosecutors prove it wasn't. For a full statutory breakdown, the Department of Justice publishes its own summary of federal health care fraud and HIPAA criminal statutes worth reading if your team handles sensitive records directly.

Real-world examples of major HIPAA fines

Numbers on a tier chart feel abstract until you see what actually triggered them. OCR publishes every resolution agreement it signs, and the pattern across a decade of settlements is remarkably consistent: unencrypted devices, ignored risk assessments, and breaches that sat unreported for months. Looking at these cases tells you more about how hipaa penalties for non-compliance actually get applied than any dollar range ever could.

The settlements that set the benchmark

Anthem's 2018 settlement remains one of the largest in OCR history at $16 million, tied to a breach that exposed the records of nearly 79 million people after attackers exploited weak access controls and a missing enterprise-wide risk analysis. Premera Blue Cross paid $6.85 million after a similar failure to conduct a thorough risk assessment let a malicious actor sit inside its network for months. Smaller organizations aren't spared either. Athens Orthopedic Clinic, a regional practice, settled for $1.5 million after failing to have business associate agreements in place and ignoring its own risk assessment findings.

| Organization | Year | Settlement | Root Cause | |---|---|---| | Anthem, Inc. | 2018 | $16,000,000 | No enterprise-wide risk analysis, weak access controls | | Premera Blue Cross | 2020 | $6,850,000 | Failure to conduct risk analysis, unaddressed vulnerabilities | | Excellus Health Plan | 2021 | $5,100,000 | Insufficient risk analysis and access monitoring | | Memorial Healthcare System | 2017 | $5,500,000 | No BAA, unauthorized employee access not detected | | Athens Orthopedic Clinic | 2019 | $1,500,000 | Missing BAAs, ignored risk assessment findings | | Elite Dental Associates | 2019 | $10,000 | Impermissible PHI disclosure on social media |

Every major settlement traces back to a document that already existed, a risk assessment nobody acted on.

What these cases have in common

Notice that the fine doesn't scale neatly with organization size. Elite Dental, a small practice, paid $10,000 for responding to a negative online review by disclosing patient details, proof that OCR pursues small, obvious violations just as readily as massive breaches. Memorial Healthcare's case is especially relevant if you build software: the breach stemmed from a former employee's login credentials still working after termination, an access-control failure that any EHR-connected app is equally capable of making.

Rather than treating these as distant news stories, use them as a checklist of what OCR actually investigates: risk assessments, BAAs, access termination, and encryption. The full text of these resolution agreements is public on HHS.gov's enforcement page, and reading a few is worth more than any summary, including this one.

How penalties differ for employees and employers

HIPAA doesn't treat everyone in your organization the same way when something goes wrong. Employers absorb the civil penalties, but individual employees can face criminal charges, job loss, and personal liability that has nothing to do with what their company pays OCR. Knowing where that line falls matters if you're a founder building a team, not just a compliance officer filing paperwork.

The organization carries the civil burden

OCR's civil monetary penalties land on the covered entity or business associate, not the individual staff member who made the mistake. If an employee misconfigures an access control or skips a step in the risk assessment process, the fine, the corrective action plan, and the reputational hit belong to the company. This is why employer liability extends even to actions the leadership team never directly authorized; under HIPAA's vicarious liability rules, an organization is responsible for its workforce's conduct within the scope of employment, similar to how respondeat superior works elsewhere in employment law.

The company pays the fine. The employee who broke the law can still go to prison.

Employees face personal and criminal exposure

Criminal prosecution works differently. The Department of Justice charges individuals, not corporations, when someone knowingly accesses or discloses PHI without authorization. An employee who snoops on a coworker's chart, sells patient records, or uses PHI for identity theft faces the fines and prison terms outlined in the criminal tiers, regardless of whether the employer had strong safeguards in place. Termination almost always follows a confirmed violation too, and a criminal conviction can end a healthcare career entirely, since licensing boards routinely review HIPAA convictions during renewal.

Party	Type of Penalty	Who Pays or Serves
Employer	Civil monetary penalty, corrective action plan	Organization's budget and operations
Employee	Criminal fine, imprisonment	Individual, personally
Both	Reputational damage, loss of trust	Shared, though employee may lose employability

Contractors and vendors sit in a gray zone

Vendors and independent contractors who touch PHI without a signed business associate agreement can end up personally and organizationally liable at the same time, since OCR treats an unsigned or missing BAA as its own separate violation. This is one more reason integration partners matter as much as internal staff training. Whoever writes the code that moves PHI between systems carries real exposure, which is exactly why platforms built for HIPAA-covered data need audit trails clear enough to show who did what, whether that person is a full-time employee or a third-party developer.

Staying compliant for the long term

The penalties for non compliance with HIPAA aren't designed to punish honest mistakes into oblivion, they're designed to reward the organizations that actually do the work: risk assessments, signed BAAs, encryption, access logs, and a team that knows what to do in the first hour of a breach. Every settlement in this article traces back to a gap someone already knew about and never closed. That's the good news, because it means the fix is within your control, not a matter of luck.

Building that foundation from scratch, integration by integration, is exactly where most healthcare teams lose time and money. Skipping that rebuild is the whole point of working with infrastructure that's already SOC 2 and HIPAA audited. If you're connecting to Epic, Cerner, or Allscripts and want compliance handled before you write a line of integration code, go launch your SMART on FHIR app instead of building the safeguards yourself.