Research · 7 min read
How a Health Privacy Penalty Is Decided
Four culpability tiers, a definition of willful neglect, a thirty-day correction window that can remove the penalty entirely, and a set of factors that includes whether anyone's access to care was hindered.
Key takeaways
- The penalty scheme has four bands, separated by what is established about the entity's knowledge rather than by the size of the incident.
- Willful neglect is defined to include reckless indifference, and reasonable diligence is measured against the care a person seeking to satisfy the requirement would exercise.
- In a continuing violation, each day counts as a separate violation, and a covered entity can be liable through the acts of its agents, including workforce members and business associates acting within the scope of the agency.
- The mitigating and aggravating factors include the number of individuals affected, whether the violation hindered an individual's ability to obtain health care, and how the entity responded to prior complaints and to technical assistance.
- A violation not due to willful neglect and corrected within thirty days bars a penalty entirely under the affirmative-defense provision, and an uncorrected one may still be waived where payment would be excessive relative to the violation.
- When a penalty becomes final, the Secretary notifies the public and named licensing, professional and state health program bodies, along with the reason.
Answer first: the tier is chosen by what the company knew
45 CFR 160.404 sets four bands, and what separates them is not the size of the breach. It is the state of mind established about the entity.
The lowest band applies "For a violation in which it is established that the covered entity or business associate did not know and, by exercising reasonable diligence, would not have known that the covered entity or business associate violated such provision." The second applies where "the violation was due to reasonable cause and not to willful neglect." The third applies where "the violation was due to willful neglect and was corrected during the 30-day period beginning on the first date the covered entity or business associate liable for the penalty knew, or, by exercising reasonable diligence, would have known that the violation occurred." The fourth applies where the violation was due to willful neglect "and was not corrected" in that window.
Each band has a floor and a ceiling per violation, and a calendar-year cap "for identical violations during a calendar year (January 1 through the following December 31)."
The dollar figures printed in § 160.404 itself are the original statutory ones and are not the operative amounts. The section says so: the amounts "were adjusted in accordance with the Federal Civil Monetary Penalty Inflation Adjustment Act of 1990... and appear at 45 CFR part 102," and "will be updated annually and published at 45 CFR part 102."
In the table at 45 CFR 102.3, the most recent column — headed "2025 Maximum adjusted penalty ($)" — prints, for the row citing 45 CFR 160.404(b)(2)(i)(A), (B), a minimum of $145 and a maximum of $73,011 per violation with a calendar year cap of $2,190,294. For the reasonable cause row citing (b)(2)(ii), the minimum is $1,461 with the same maximum and cap. For willful neglect corrected, citing (b)(2)(iii), the minimum is $14,602. For willful neglect not corrected, citing (b)(2)(iv), the minimum is $73,011 and the maximum is $2,190,294.
The shape of that last row is the point of the scheme. Where willful neglect is established and not corrected, the floor of the range is the ceiling of every other range.
The three definitions the tiers turn on
45 CFR 160.401 defines exactly three terms for the penalty subpart, and they carry the whole structure.
"Reasonable cause means an act or omission in which a covered entity or business associate knew, or by exercising reasonable diligence would have known, that the act or omission violated an administrative simplification provision, but in which the covered entity or business associate did not act with willful neglect."
"Reasonable diligence means the business care and prudence expected from a person seeking to satisfy a legal requirement under similar circumstances."
"Willful neglect means conscious, intentional failure or reckless indifference to the obligation to comply with the administrative simplification provision violated."
Two features of those definitions matter. The first is that reasonable diligence is an objective standard measured against what a person seeking to satisfy the requirement would do — so an entity that did not know can still fall out of the lowest tier if it would have known had it looked.
The second is that willful neglect includes "reckless indifference," not only conscious intent. An entity that never turned its attention to a requirement can be inside the definition without anyone having decided to break it.
How many violations there are
Because the bands are per violation, counting matters as much as tiering, and 45 CFR 160.406 supplies the method.
The Secretary "will determine the number of violations of an administrative simplification provision based on the nature of the covered entity's or business associate's obligation to act or not act under the provision that is violated, such as its obligation to act in a certain manner, or within a certain time, or to act or not act with respect to certain persons."
Then the sentence that changes the arithmetic: "In the case of continuing violation of a provision, a separate violation occurs each day the covered entity or business associate is in violation of the provision."
45 CFR 160.402 addresses who is liable. Where more than one covered entity or business associate was responsible, "the Secretary will impose a civil money penalty against each such covered entity or business associate," with a joint and several rule for members of an affiliated covered entity.
The same section extends liability through agents. "A covered entity is liable, in accordance with the Federal common law of agency, for a civil money penalty for a violation based on the act or omission of any agent of the covered entity, including a workforce member or business associate, acting within the scope of the agency." The parallel paragraph applies the same rule to a business associate for its own workforce members and subcontractors.
One anti-stacking rule sits at § 160.404(b)(3): where a requirement "is repeated in a more general form in another administrative simplification provision in the same subpart, a civil money penalty may be imposed for a violation of only one of these administrative simplification provisions."
The factors, and the correction defense
45 CFR 160.408 lists what the Secretary considers in setting an amount, "which may be mitigating or aggravating as appropriate." There are five headings, and several of the sub-items are more concrete than penalty factors usually are.
"The nature and extent of the violation" may include "The number of individuals affected" and "The time period during which the violation occurred." "The nature and extent of the harm" may include whether the violation "caused physical harm," "resulted in financial harm," "resulted in harm to an individual's reputation," and "hindered an individual's ability to obtain health care."
The history heading asks whether the current violation is the same or similar to previous indications of noncompliance, what the entity did about those, "How the covered entity or business associate has responded to technical assistance from the Secretary," and "How the covered entity or business associate has responded to prior complaints."
"The financial condition" heading asks whether financial difficulties affected the ability to comply, whether a penalty "would jeopardize the ability of the covered entity or business associate to continue to provide, or to pay for, health care," and "The size of the covered entity or business associate." A fifth heading reads simply "Such other matters as justice may require."
45 CFR 160.410 then provides a defense that can remove the penalty rather than reduce it. For violations occurring on or after February 18, 2009, the Secretary "may not impose a civil money penalty on a covered entity or business associate for a violation if the covered entity or business associate establishes to the satisfaction of the Secretary that the violation is" both "Not due to willful neglect" and "Corrected during" the 30-day period beginning when the entity knew or would have known of it, or "Such additional period as the Secretary determines to be appropriate based on the nature and extent of the failure to comply."
Where a violation described in that provision is not corrected in time, § 160.412 permits the Secretary to "waive the civil money penalty, in whole or in part, to the extent that the payment of the penalty would be excessive relative to the violation."
What comes before a penalty, and what follows one
A penalty is the end of a path, not its beginning, and two sections of subpart C describe the earlier steps.
45 CFR 160.304 states the starting posture: "The Secretary will, to the extent practicable and consistent with the provisions of this subpart, seek the cooperation of covered entities and business associates in obtaining compliance," and "may provide technical assistance to covered entities and business associates to help them comply voluntarily."
45 CFR 160.312 describes what happens when an investigation or compliance review indicates noncompliance. The Secretary "may attempt to reach a resolution of the matter satisfactory to the Secretary by informal means," and "Informal means may include demonstrated compliance or a completed corrective action plan or other agreement." If the matter resolves informally, the entity is told in writing, and so is the complainant where the matter arose from a complaint.
If it does not resolve informally, the entity is told and given "an opportunity to submit written evidence of any mitigating factors or affirmative defenses for consideration under §§ 160.408 and 160.410," and "must submit any such evidence to the Secretary within 30 days" of receiving that notification. Only after that step, and only if the Secretary finds a penalty should be imposed, does a notice of proposed determination issue under § 160.420.
Where no violation is found, § 160.312(b) requires the Secretary to inform the entity and, if the matter arose from a complaint, the complainant, in writing.
Two provisions describe the aftermath. 45 CFR 160.418 states that, with two statutory exceptions, "a penalty imposed under this part is in addition to any other penalty prescribed by law." And 45 CFR 160.426 provides that whenever a proposed penalty becomes final, "the Secretary will notify, in such manner as the Secretary deems appropriate, the public" and a list of bodies including "the appropriate State or local medical or professional organization," the state agencies administering state health care programs, the appropriate peer review organization, and "the appropriate State or local licensing agency or organization" — together with "the reason it was imposed."
That last section is the one worth remembering when reading about a company's regulatory history. A final penalty under this part is not only a payment; it is a notification that travels to licensing and professional bodies.
Sources
- 45 CFR Part 160, Subpart D — Imposition of Civil Money Penalties (§ 160.401 Definitions; § 160.402 Basis for a civil money penalty; § 160.404 Amount of a civil money penalty; § 160.406 Violations of an identical requirement or prohibition; § 160.408 Factors considered in determining the amount of a civil money penalty; § 160.410 Affirmative defenses; § 160.412 Waiver; § 160.418 Penalty not exclusive; § 160.426 Notification of the public and other agencies)The four culpability bands and their per-violation floors, ceilings and calendar year caps in § 160.404(b)(2); the statement in § 160.404(a) that the amounts were adjusted for inflation and appear and are updated at 45 CFR part 102; the anti-stacking rule in § 160.404(b)(3); the definitions of reasonable cause, reasonable diligence and willful neglect in § 160.401; the multiple-entity, affiliated-entity and agency liability rules in § 160.402; the counting method and per-day continuing violation rule in § 160.406; the five factor headings and their sub-items in § 160.408, including number of individuals affected, physical, financial and reputational harm, hindered ability to obtain health care, response to technical assistance and prior complaints, and the financial condition items; the affirmative defense in § 160.410(c); the waiver provision in § 160.412; the penalty-not-exclusive statement in § 160.418; and the notification of the public and named organizations in § 160.426.
- 45 CFR 102.3 — Penalty adjustment and table (Table 1 to § 102.3, Civil Monetary Penalty Authorities Administered by HHS)The adjusted amounts quoted from the table's most recent column, headed "2025 Maximum adjusted penalty ($)", for each row whose CFR cell names the corresponding paragraph of 45 CFR 160.404: minimum $145 and maximum $73,011 with a $2,190,294 calendar year cap for the did-not-know band; minimum $1,461 for the reasonable cause band; minimum $14,602 for willful neglect corrected; and minimum $73,011 with a maximum of $2,190,294 for willful neglect not corrected. The rows were matched by their own CFR citation cells, and the column was identified from the table's own printed header row.
- 45 CFR 160.304 — Principles for achieving compliance; 45 CFR 160.312 — Secretarial action regarding complaints and compliance reviewsThe cooperation and technical assistance posture in § 160.304; the informal resolution route in § 160.312(a)(1) including demonstrated compliance and a completed corrective action plan; the written notification of an informal resolution to the entity and the complainant; the opportunity to submit written evidence of mitigating factors or affirmative defenses within 30 days under § 160.312(a)(3)(i); the reference forward to a notice of proposed determination under § 160.420; and the written notification where no further action is warranted in § 160.312(b).
Frequently asked questions
What determines which penalty band applies?
45 CFR 160.404(b)(2) sorts violations by what is established about the entity: that it did not know and by exercising reasonable diligence would not have known; that the violation was due to reasonable cause and not willful neglect; that it was due to willful neglect and was corrected within 30 days; or that it was due to willful neglect and was not corrected in that window.
What does willful neglect mean here?
45 CFR 160.401 defines it as "conscious, intentional failure or reckless indifference to the obligation to comply with the administrative simplification provision violated." Reckless indifference is inside the definition, so an entity that never addressed a requirement can fall within it.
Are the dollar amounts in the regulation the current ones?
No. Section 160.404 states that the amounts were adjusted for inflation and appear at 45 CFR part 102, and that they are updated annually and published there. In the § 102.3 table, the most recent column, headed 2025, prints a per-violation maximum of $73,011 for the first three bands and a calendar year cap of $2,190,294, with band minimums of $145, $1,461 and $14,602 respectively, and a minimum of $73,011 for willful neglect not corrected.
How is the number of violations counted?
Section 160.406 bases the count on the nature of the obligation violated — to act in a certain manner, within a certain time, or with respect to certain persons — and provides that in a continuing violation, a separate violation occurs each day the entity is in violation.
Can a penalty be avoided by fixing the problem?
Section 160.410(c) provides that the Secretary may not impose a penalty where the entity establishes to the Secretary's satisfaction that the violation was not due to willful neglect and was corrected within the 30-day period beginning when it knew or would have known of the violation, or within such additional period as the Secretary determines appropriate.
Who is told when a penalty becomes final?
Section 160.426 provides that the Secretary will notify the public and, among others, the appropriate state or local medical or professional organization, the state agencies administering state health care programs, the appropriate peer review organization, and the appropriate state or local licensing agency or organization, together with the reason the penalty was imposed.