HHS Confirms No 2026 Inflation Adjustment for HIPAA Civil Monetary Penalties, 2025 Levels Remain
HHS confirmed in the Federal Register that it will not apply an annual inflation multiplier to HIPAA civil monetary penalties in 2026, so the 2025 penalty levels stay in force. The cause is the lengthy fall 2025 government shutdown, which stopped the Bureau of Labor Statistics (BLS) from producing the October 2025 CPI-U data needed to calculate the multiplier. The OMB Director issued a memorandum in April 2026 cancelling the 2026 adjustment and telling agencies to keep their current penalty structures. The current maximum penalty is $2,190,294 per violation, up 46% from the $1,500,000 set by the HITECH Act of 2009. The HHS Office for Civil Rights has been urging Congress to raise the penalties above the HITECH levels. The 2027 multiplier is expected to account for cost-of-living increases from 2025 to 2027.
Detalhes técnicos
- The Federal Civil Penalties Inflation Adjustment Act of 1990, amended by the 2015 Improvement Act, requires annual inflation adjustments to civil monetary penalties.
- OMB sets the annual multiplier, based on CPI-U data from BLS.
- The shutdown followed a lapse in fiscal year 2026 appropriations ahead of the October 1 deadline.
Remediação
No technical action is required. Covered entities and business associates should keep planning their HIPAA compliance against the 2025 penalty tiers.
Linha do tempo
-
HHS Confirms No 2026 Inflation Adjustment for HIPAA Civil Monetary Penalties, 2025 Levels Remain
ler a análise desta fonte ocultar
HHS confirmed in the Federal Register that it will not apply an annual inflation multiplier to HIPAA civil monetary penalties in 2026, so the 2025 penalty levels stay in force. The cause is the lengthy fall 2025 government shutdown, which stopped the Bureau of Labor Statistics (BLS) from producing the October 2025 CPI-U data needed to calculate the multiplier. The OMB Director issued a memorandum in April 2026 cancelling the 2026 adjustment and telling agencies to keep their current penalty structures. The current maximum penalty is $2,190,294 per violation, up 46% from the $1,500,000 set by the HITECH Act of 2009. The HHS Office for Civil Rights has been urging Congress to raise the penalties above the HITECH levels. The 2027 multiplier is expected to account for cost-of-living increases from 2025 to 2027.
Technical Details
- The Federal Civil Penalties Inflation Adjustment Act of 1990, amended by the 2015 Improvement Act, requires annual inflation adjustments to civil monetary penalties.
- OMB sets the annual multiplier, based on CPI-U data from BLS.
- The shutdown followed a lapse in fiscal year 2026 appropriations ahead of the October 1 deadline.
Remediation
No technical action is required. Covered entities and business associates should keep planning their HIPAA compliance against the 2025 penalty tiers.