HIPAA Violation Amounts Adjusted for 2022

The Department of Health and Human Services (HHS) recently released an updated list of annual inflation adjustments applicable to monetary penalties to be assessed on or after March 17, 2022 for violations occurring on or after November 2, 2015. Adjusted penalties are calculated as a result of multiplying the preceding year’s penalties by 2022’s cost-of-living multiplier of 1.06222 and applying that number to each individual penalty amount. Amounts are then rounded to the nearest dollar.

Respective to group health plans, there are several increases to penalties associated with the Health Insurance Portability and Accountability Act (HIPAA) worthy of note due to the higher penalties being levied.

Minimum Penalties:

• As a result of inflation, the minimum penalty amount for a HIPAA violation has now increased from $120 to $127 for a Covered Entity or Business Associate that did not know, and by exercising reasonable diligence would not have known, that a HIPAA provision was violated.
• HIPAA violations stemming from reasonable cause, but not willful neglect, will now carry a minimum penalty of $1,280 (previously $1,205).
• For HIPAA violations occurring as a result of willful neglect that are remedied within 30 days of when the Covered Entity or Business Associate first knew, or, by exercising reasonable diligence, would have known that the violation occurred will move from the previous penalty amount of $12,045 to $12,794.
• HIPAA violations that are established as having resulted from willful neglect that also go uncorrected during the 30-day period beginning on the first date the Covered Entity or Business Associate knew of the violation, or, by exercising reasonable diligence, would have known will move from $60,226 to $63,973.

Maximum Penalties:

The maximum penalty amount for HIPAA violations not due to willful neglect/not timely corrected will increase from $60,226 to $63,973. HIPAA violations that are due to willful neglect and are not remedied in a timely manner will go from a maximum penalty of $1,806,757 to a maximum penalty of $1,919,173.

Calendar Year Penalties:

The guidance offered by HHS also includes calendar year penalty caps for the various HIPAA violations, effectively curbing each individual HIPAA violation at a maximum annual penalty amount of $1,919,173 (up from $1,806,757).