HIPAA Violation Penalties for Employees and Therapy Practices

Tier or offense	Culpability	Penalty range	Who it applies to	Example in a therapy practice
Civil tier 1: no knowledge	The covered entity or business associate did not know, and reasonable diligence would not have shown, that it violated an administrative simplification provision	$145–$73,011 per violation; up to $2,190,294 for identical violations in a calendar year	Covered entity or business associate; not automatically the individual employee	A practice misses a transaction-standard requirement despite a documented, reasonable compliance program and no warning signs
Civil tier 2: reasonable cause, not willful neglect	The violation resulted from reasonable cause and not willful neglect	$1,461–$73,011 per violation; up to $2,190,294 for identical violations in a calendar year	Covered entity or business associate; the workforce member may also face internal sanctions	A billing workflow creates a preventable standard error, but the practice can show it was not reckless and takes corrective action
Civil tier 3: willful neglect, corrected	The violation was willful neglect and was corrected within the 30-day period described in the regulation	$14,602–$73,011 per violation; up to $2,190,294 for identical violations in a calendar year	Covered entity or business associate; workforce discipline remains a separate employer decision	An owner ignores a known access-control gap, then closes it and documents the correction after discovery
Civil tier 4: willful neglect, not corrected	The violation was willful neglect and was not corrected within that 30-day period	$73,011–$2,190,294 per violation; the calendar-year cap is $2,190,294	Covered entity or business associate; a responsible employee may face additional consequences under other law	A practice knowingly leaves an exposed export or shared privileged account in place after learning of the risk
Criminal offense: knowing wrongful acquisition or disclosure	A person knowingly obtains or discloses individually identifiable health information in violation of 42 U.S.C. 1320d-6	Up to $50,000, up to 1 year in prison, or both; higher maximums apply for false pretenses or commercial advantage, personal gain, or malicious harm	The person who knowingly commits the prohibited conduct	An employee intentionally opens a neighbor’s record and sends details to a friend, outside a treatment or job function

The Federal Register notice published January 28, 2026, lists these inflation-adjusted HIPAA civil money penalty amounts and makes them applicable to penalties assessed on or after that date when the violation occurred on or after November 2, 2015. The ranges are federal limits, not an automatic bill for every incident. Confirm the amount, assessment date, and applicable rule against the notice and 45 CFR 160.404 before relying on a number in a live matter; enforcement also considers the facts, the violation, correction, and other applicable law.

The civil table answers what a covered entity or business associate may face under the HIPAA administrative simplification penalty authority. It does not mean that every privacy, Security Rule, or Breach Notification Rule failure is assigned one row without an investigation. It also does not convert an employee’s internal sanction into a federal civil penalty against that person.

What HIPAA violation penalties for employees usually mean

When you research HIPAA violation penalties for employees, start by separating three questions that practices often blend together:

1. What can the federal government impose? The civil money penalty authority in 45 CFR 160.404 generally addresses a covered entity or business associate. Criminal liability under 42 U.S.C. 1320d-6 can attach to a person who knowingly obtains or discloses individually identifiable health information in violation of the statute.
2. What can the practice impose? A practice can apply an appropriate workforce sanction under its written policy, up to and including termination, after a fair review of the facts and any applicable employment agreement or law.
3. What else may apply? A licensing board, state privacy law, employment law, contract, malpractice carrier, or another federal law may create duties or consequences outside HIPAA’s civil penalty table.

Do not promise an employee that a case is “only a warning” before the privacy or security lead has preserved facts and counsel has reviewed a material or ambiguous event. Do not promise a patient that the practice has made a final breach determination while the assessment is still open.

The four civil penalty tiers in plain language

The four post-February 18, 2009 tiers ask how much the entity knew, how serious the disregard was, and whether the entity corrected willful neglect within the regulatory window. That is the civil side of HIPAA violation penalties for employees and practices. The dollar amount is not the practice’s sanction policy. It is a federal civil penalty limit that applies to the covered entity or business associate under the cited authority.

Tier 1: no knowledge after reasonable diligence

This is the lowest statutory tier, but it is not a safe harbor for an absent compliance program. The question is whether the entity did not know and, by exercising reasonable diligence, would not have known that it violated an administrative simplification provision. Keep evidence of the controls, training, monitoring, and escalation that made the lack of knowledge reasonable.

Tier 2: reasonable cause without willful neglect

Reasonable cause is more serious than no knowledge, but it is distinct from willful neglect. A practice should preserve the facts showing what happened, who noticed it, what the practice did after discovery, and why the conduct was not a reckless disregard of its obligations.

Tier 3: willful neglect corrected within 30 days

Willful neglect is a conscious, intentional failure or reckless indifference to the obligation under 45 CFR 160.401. If the practice learns of that violation, the correction clock and the evidence supporting correction matter. Record the discovery date, the corrective action, the person who approved it, and the date the control was working.

Tier 4: willful neglect not corrected

The highest civil tier applies when an established violation is due to willful neglect and is not corrected during the regulatory 30-day period beginning when the covered entity or business associate knew, or by exercising reasonable diligence would have known, that the violation occurred. Do not wait for a formal demand before closing a known access, disclosure, or administrative simplification gap. If the practice cannot complete correction immediately, document containment, the owner, interim controls, counsel contact, and the dated plan to finish.

When an employee’s conduct can become criminal

42 U.S.C. 1320d-6 addresses a person who knowingly obtains or discloses individually identifiable health information in violation of the statute. The maximum prison term and fine increase when the conduct is committed under false pretenses or with intent to sell, transfer, or use the information for commercial advantage, personal gain, or malicious harm.

That criminal standard is not the same as an employee making an accidental chart click or opening the wrong patient with no further use. It is also not a reason for a practice to conduct an informal interrogation that destroys evidence. Preserve the audit trail, restrict access when necessary, identify the facts, and escalate promptly to qualified healthcare counsel when the conduct appears intentional, repeated, extortionate, or tied to personal gain.

Build a sanction policy that can be applied consistently

45 CFR 164.530(e) requires a covered entity to apply appropriate sanctions against workforce members who fail to comply with its privacy policies and procedures. Its stated exceptions cover actions that meet the conditions of 45 CFR 164.502(j) or 45 CFR 164.530(g)(2); the rule does not create a general exception for an action that merely seems reasonable. The rule does not give your practice a universal punishment ladder. Your policy should make the decision path clear before a stressful case arrives.

A workable policy names:

• Covered conduct: unauthorized access, use, disclosure, password sharing, unsafe export, failure to report, retaliation, and bypassing a required safeguard.
• Immediate controls: who can suspend access, preserve logs, secure devices, and keep clinical operations safe while the review is open.
• Fact review: who interviews the workforce member, who checks system logs, who identifies the information involved, and who records the employee’s explanation.
• Decision owner: the privacy officer, security officer, practice owner, or a named committee, with a backup for after-hours events.
• Sanction factors: intent, scope, repetition, training, role, treatment relationship, self-reporting, cooperation, mitigation, and prior findings.
• Available actions: coaching, retraining, written warning, access restriction, suspension, reassignment, termination, referral to a board or law enforcement, or another action counsel approves.
• Documentation: allegation, dates, evidence, decision, policy section, approval, notice to the workforce member, and corrective action due date.
• Consistency check: how the practice compares the decision with materially similar cases without exposing unrelated employees’ confidential information.

Apply the policy to well-liked clinicians, owners, contractors, and administrators. A sanction policy that exists only for the newest employee is not a reliable compliance control.

What to do when you suspect a violation

Use this sequence for a suspected employee or contractor violation when HIPAA violation penalties for employees are part of the concern:

1. Protect current care. Keep clients safe and maintain necessary clinical access through an approved, limited account or coverage plan.
2. Preserve facts. Export relevant audit logs, save messages, record discovery time, and secure devices or files without altering evidence.
3. Limit access. Pause the specific account, session, export, or integration that may cause further disclosure. Record who authorized the change.
4. Name the lead. Route the matter to the privacy or security officer and the practice owner or designated incident lead.
5. Classify carefully. Identify whether the facts concern a policy violation, a potential breach of unsecured PHI, an administrative simplification violation, possible criminal conduct, or more than one category.
6. Review the employee’s explanation. Use a fair, documented process and avoid promising the outcome before the review is complete.
7. Escalate material issues. Contact healthcare counsel, your cyber or malpractice carrier, and law enforcement when counsel advises or the facts require it.
8. Decide and document. Apply the sanction policy, record the reasoning, complete corrective actions, and separately assess notification duties.

A sanction decision does not replace the breach analysis. A breach analysis does not replace workforce discipline. Keep the workstreams connected through one incident owner, but do not collapse them into one label.

Prevention controls for therapy practices

A practice can lower the chance and cost of a violation by making the safe action easier than the unsafe one:

• Give each workforce member a unique account and role-based access. Do not use shared EHR or email credentials.
• Review audit logs on a defined cadence, with a named person responsible for follow-up.
• Train on privacy, security, reporting, and sanctions at hire and when a role or tool changes.
• Give schedulers, billers, supervisors, clinicians, and contractors the minimum access their work requires.
• Remove access the same day a person leaves or changes role; rotate shared secrets the person could access.
• Keep a written incident path with after-hours contacts and a backup owner.
• Require workforce members to report suspected wrong-recipient disclosures, snooping, lost devices, and unsafe exports.
• Test the sanction policy with a tabletop example before you need to use it.

The practice’s compliance program should be specific to its systems. A generic policy does not show who can open a chart, who reviews the log, or who signs the decision.

How Emosapien fits a review-first workflow

Emosapien is documentation software for mental-health clinicians, not a federal enforcement tool or a substitute for your privacy officer. Its review-first workflow can help a practice keep draft documentation under clinician review and preserve a consistent note process, while the practice still controls access, training, sanctions, incident response, and legal decisions.

For the broader operating controls, use the therapy compliance resource hub, the solo-practice HIPAA guide, and the group-practice HIPAA guide. For incident response and notification, use the HIPAA breach notification guide for therapists.

Closing checklist

• Civil penalty tier and responsible entity identified
• Employee or contractor access preserved, restricted, or restored by a named owner
• Audit logs, messages, devices, and discovery time preserved
• Privacy or security lead assigned, with an after-hours backup
• Employee explanation reviewed without prejudging the result
• Breach-notification analysis kept separate from workforce sanctions
• Criminal concerns escalated to qualified healthcare counsel
• Sanction decision applied under the written policy and documented
• Corrective action has an owner and a due date
• Training, access, and monitoring controls updated after closure

References

• U.S. Department of Health and Human Services. (2026, January 28). Annual civil monetary penalties inflation adjustment. Federal Register, 91(18). (Inflation-adjusted amounts applicable to penalties assessed on or after January 28, 2026, when the violation occurred on or after November 2, 2015.)
• Electronic Code of Federal Regulations. 45 C.F.R. § 160.404: Amount of a civil money penalty. (Civil penalty tiers, per-violation ranges, correction window, and calendar-year caps.)
• Electronic Code of Federal Regulations. 45 C.F.R. § 164.530: Administrative requirements. (Workforce sanction requirement in paragraph (e).)
• United States Code. 42 U.S.C. § 1320d-6: Wrongful disclosure of individually identifiable health information. (Criminal offense and enhanced penalties.)