CE

HIPAA

IAN
CO HIPAA
MPL
VIOLATION
PENALTIES

HIPAA was designed

“American Recovery
to provide federal
& Reinvestment Act
protection for
of 2009” is a civil
personal health
penalty structure put
information (PHI) held
in place for Health
by covered health
Insurance Portability
entities and rights
& Accountability Act
with respect to
(HIPAA) violations.
that information.

$
Total $23,504,800
$19,393,200
HIPAA
Fines
$6,193,00

2015 2016 2017

HIPAA Fines HIPAA Fines HIPAA Fines

HIPAA CIVIL MONETARY PENALTY STRUCTURE

The four categories used for the penalty structure are as follows:

CATEGORY 1
The covered entity did not and could not
have known the act was a HIPAA violation.

Minimum Fine:
$100 per violation up to $50,000

CATEGORY 2
A violation that had a reasonable cause
and was not due to willful neglect.

Minimum Fine:
$1,000 per violation up to $50,000

CATEGORY 3
The HIPAA violation was due to willful
neglect but was later corrected.

Minimum Fine:
$10,000 per violation up to $50,000

CATEGORY 4
The HIPAA violation was due to willful
neglect and was not corrected.

Minimum Fine:
$50,000 per violation

HIPAA CRIMINAL PENALTIES

Obtaining PHI under

Obtaining PHI
false pretenses
for personal gain or
Up to $100,000 fine 10
YEARS
with malicious intent
IN JAIL Up to $25,000 fine

Knowingly obtaining
or disclosing PHI 5
YEARS
Up to $50,000 fine
1
IN JAIL

YEARS
IN JAIL

TIER 1 TIER 2 TIER 3

As of December 2017, the most common covered

entities that experience HIPAA violations:

PRIVATE PRACTICES
GENERAL OUTPATIENT
& PHYSICIANS
HOSPITALS FACILITIES

HEALTH PLANS
PHARMACIES (group health plans and
health insurance issuers)

As of December 2017

TOTAL INVESTIGATED RESOLUTIONS

Corrective Action Obtained
(change achieved)
No Violation

25,637
TOTAL
COMPLAINTS
INVESTIGATED
11,386
37,023

As of December 2017
IMPERMISSIBLE USES
THE MOST & DISCLOSURES
of protected health information.
INVESTIGATED
COMPLIANCE LACK OF SAFEGUARDS
of protected health data.

ISSUES WERE: LACK OF PATIENT ACCESS

to their protected health info.

LACK OF ELECTRONIC
ADMINISTRATIVE SAFEGUARDS
of protected health information.

USE OR DISCLOSURE OF
MORE THAN THE MINIMUM
necessary protected health information.

PROTECT YOUR ORGANIZATION

WITH HIPAA TRAINING FROM:

© 2018 Inspired eLearning, LLC. All rights reserved.

SOURCES: https://compliancy-group.com/hipaa-fines-directory-year/
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/data/enforcement-highlights/index.html
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/data/numbers-glance/index.html?language=es