HHS moves to reduce HIPAA fines for less-severe violations

The Department of Health and Human Services (HHS) adjusted the monetary penalties it imposes on healthcare providers, health plans and their business associates for violating the Health Insurance Portability and Accountability Act (HIPAA), lowering the annual cap for the least-severe violation from $1.5 million to $25,000.

HHS said the new tier structure is based on culpability and sets different annual limits for fines based on four penalty tiers, according to a notice of enforcement discretion (PDF) issued Friday. Healthcare organizations that have taken steps to comply with HIPAA requirements or work quickly to mitigate violations face a smaller maximum penalty than organizations found neglectful.

Prior to the changes, the annual limit was $1.5 million for every tier.