§160.404 Amount of a civil money penalty.
(a) The amount of a civil money penalty will be determined in accordance with paragraph (b) of this section and §§160.406, 160.408, and 160.412.
(b) The amount of a civil money penalty that may be imposed is subject to the following limitations:
(1) For violations occurring prior to February 18, 2009, the Secretary may not impose a civil money penalty—
(i) In the amount of more than $100 for each violation; or
(ii) In excess of $25,000 for identical violations during a calendar year (January 1 through the following December 31);
(2) For violations occurring on or after February 18, 2009, the Secretary may not impose a civil money penalty—
(i) For a violation in which it is established that the covered entity or business associate did not know and, by exercising reasonable diligence, would not have known that the covered entity or business associate violated such provision,
(A) In the amount of less than $100 or more than $50,000 for each violation; or
(B) In excess of $1,500,000 for identical violations during a calendar year (January 1 through the following December 31);
(ii) For a violation in which it is established that the violation was due to reasonable cause and not to willful neglect,
(A) In the amount of less than $1,000 or more than $50,000 for each violation; or
(B) In excess of $1,500,000 for identical violations during a calendar year (January 1 through the following December 31);
(iii) For a violation in which it is established that the violation was due to willful neglect and was corrected during the 30-day period beginning on the first date the covered entity or business associate liable for the penalty knew, or, by exercising reasonable diligence, would have known that the violation occurred,
(A) In the amount of less than $10,000 or more than $50,000 for each violation; or
(B) In excess of $1,500,000 for identical violations during a calendar year (January 1 through the following December 31);
(iv) For a violation in which it is established that the violation was due to willful neglect and was not corrected during the 30-day period beginning on the first date the covered entity or business associate liable for the penalty knew, or, by exercising reasonable diligence, would have known that the violation occurred,
(A) In the amount of less than $50,000 for each violation; or
(B) In excess of $1,500,000 for identical violations during a calendar year (January 1 through the following December 31).
(3) If a requirement or prohibition in one administrative simplification provision is repeated in a more general form in another administrative simplification provision in the same subpart, a civil money penalty may be imposed for a violation of only one of these administrative simplification provisions.
Download our Free HIPAA Project Plan.