The four penalty tiers
HIPAA civil monetary penalties are tiered by culpability, and the tier is determined by what you knew and whether you fixed it.
| Tier | Culpability | Practical meaning |
|---|---|---|
| 1 | Did not know, and would not have known with reasonable diligence | Lowest penalties |
| 2 | Reasonable cause, not wilful neglect | Higher |
| 3 | Wilful neglect, corrected within 30 days | Higher again |
| 4 | Wilful neglect, not corrected | Highest |
Penalty amounts are adjusted annually for inflation and are assessed per violation with annual caps per provision, so specific figures move. The structural point does not move: the difference between tier 3 and tier 4 is whether you corrected the problem, and the difference between tier 1 and tier 3 is largely whether you had looked.
That is why a current risk analysis matters beyond the document itself — it is evidence of reasonable diligence.
How investigations start
Breach reports. Reporting a breach affecting 500 or more triggers OCR review as a matter of course. The investigation examines your compliance generally, not only the incident.
Complaints. Anyone can file one. Right-of-access complaints from patients are a large and growing category.
Compliance reviews. OCR can initiate without a complaint or breach.
Referrals from other agencies or from state attorneys general, who also have HIPAA enforcement authority.
The pattern worth internalising: an incident opens the door, and what happens next is about everything else. Organizations are frequently penalised less for the breach than for what the investigation found around it.
What gets cited most
No risk analysis, or one that is not accurate and thorough. This appears in settlement after settlement and is the single most consistent finding in HIPAA enforcement.
No risk management. A risk analysis exists, risks were identified, and nothing documents that they were addressed. Arguably worse than not having looked, because it evidences knowledge without action.
Missing BAAs. Vendors touching PHI with no agreement in place — easily found and easily fixed in advance.
Insufficient access controls. Particularly audit controls and the ability to show who accessed what.
Right of access failures. Records not provided within 30 days, which OCR has pursued as a dedicated initiative.
No workforce training evidence. See training requirements.
Corrective action plans
Most resolutions include a corrective action plan alongside any monetary settlement, and the CAP is frequently the more expensive half.
A typical CAP requires a comprehensive risk analysis, a documented risk management plan, revised policies and procedures, workforce retraining, and reporting to HHS for a period of years. That last item is the one organizations underestimate: it is an ongoing operational obligation with real cost.
What reduces exposure
A current, thorough risk analysis. The single most protective document available, because it moves you away from wilful neglect.
Evidence that identified risks were addressed. The half organizations skip.
Complete BAA coverage. Inventory vendors touching PHI and close gaps — see BAA requirements.
Encryption. Encrypted PHI is not unsecured PHI, so many incidents never become reportable breaches at all.
Prompt correction. The difference between tier 3 and tier 4 is whether you fixed it, and 30 days is the line.
FAQs
What are the HIPAA penalty tiers?
Four, based on culpability: no knowledge with reasonable diligence, reasonable cause without wilful neglect, wilful neglect corrected within 30 days, and wilful neglect not corrected. Amounts are assessed per violation with annual caps and are adjusted for inflation, so the tier matters more than any fixed figure.
What triggers an OCR HIPAA investigation?
Breach reports affecting 500 or more individuals trigger review as a matter of course. Complaints from anyone, including patients, are a common route — right-of-access complaints particularly. OCR can also initiate compliance reviews without any complaint, and referrals arrive from other agencies and state attorneys general.
What is the most common HIPAA violation cited?
Failure to conduct an accurate and thorough risk analysis. It appears in settlement after settlement and is the most consistent finding in HIPAA enforcement, followed closely by failure to document risk management — where risks were identified and nothing shows they were addressed.
What is a HIPAA corrective action plan?
A remediation programme imposed as part of a resolution, typically requiring a comprehensive risk analysis, a documented risk management plan, revised policies, workforce retraining, and reporting to HHS for a period of years. The ongoing reporting obligation is frequently more costly than the monetary settlement.
How can I reduce HIPAA enforcement exposure?
Maintain a current and thorough risk analysis, document that identified risks were actually addressed, ensure every vendor touching PHI has a BAA, encrypt PHI so incidents do not become reportable breaches, and correct any identified failure promptly — the line between the two highest penalty tiers is whether it was fixed within 30 days.
Where to go next
Start with a HIPAA risk assessment, review your BAAs, or see HIPAA consulting.