HHS will keep HIPAA civil monetary penalties at 2025 levels and skip its annual inflation adjustment for 2026, the department said in an Oct. 21 Federal Register notice.
The freeze traces to last year’s federal government shutdown. The Bureau of Labor Statistics did not produce October 2025 consumer price index data during the lapse in appropriations from Oct. 1 to Nov. 12, 2025. Federal agencies need that month’s data to calculate the yearly penalty multiplier, so no 2026 multiplier exists.
The Office of Management and Budget canceled the 2026 adjustments for federal agencies in an April 17 memo. HHS’ notice cites that guidance.
For HIPAA, the top penalty stays at $2.2 million per violation for willful neglect that isn’t corrected within 30 days. That amount is also the calendar-year cap for violations of an identical provision. Per-violation minimums range from $145, for violations an organization didn’t know about, to $73,011, for uncorrected willful neglect.
The freeze covers HHS’ other civil monetary penalties too. That includes the HHS Office of Inspector General’s penalty for information blocking, which stays at $1.3 million per violation.
The current HIPAA ceiling is about 46% higher than the $1.5 million cap set under the 2009 Health Information Technology for Economic and Clinical Health Act.
HHS last raised its penalties in a Jan. 28 final rule. That rule applied a 1.02598 multiplier based on October 2024 consumer price data.
Becker’s 3rd Annual Fall Chief Pharmacy Officer Summit is the top tier event that the people leading the future of pharmacy convene. This 3-day event is built specifically for Chief Pharmacy Officers and senior pharmacy leaders. The sessions examine the workforce, financial and clinical priorities shaping pharmacy today. Becker’s is where candid discussions flourish and new ideas thrive. Becker's 3rd Annual Fall Chief Pharmacy Officer Summit
