From 9bd65282ce102faf149cda37467c903929ad18b4 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 24 Jul 2026 10:09:25 +0000 Subject: [PATCH] docs(hipaa): update stale 2024 penalty figures to current 2026 HHS OCR tiers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit HHS OCR's inflation-adjusted civil monetary penalty amounts (45 CFR § 160.404) were updated in the Federal Register effective January 28, 2026, raising per-violation and annual-cap figures. The mapping still cited the superseded 2024 amounts ($137-$68,928, $2.07M cap), which is exactly the kind of stale compliance citation this repo's audit-ready templates are meant to avoid. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01FR9Xai5vLvS169FyRcgmTY --- mappings/hipaa.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mappings/hipaa.md b/mappings/hipaa.md index 1e563af..db6d2aa 100644 --- a/mappings/hipaa.md +++ b/mappings/hipaa.md @@ -4,7 +4,7 @@ This file maps each policy template to specific requirements under the HIPAA Sec > **Scope note:** The HIPAA Security Rule applies to **electronic Protected Health Information (ePHI)** only. Covered Entities (CEs) and Business Associates (BAs) must comply with all Required specifications; Addressable specifications must either be implemented or documented with a compliant alternative. Policy documents establish administrative controls — you also need operational evidence (training records, access logs, risk analysis documentation, BAA registers). See the [Healthcare/HIPAA Industry Overlay](../industry-variants/healthcare-hipaa-overlay.md) for implementation guidance. -> **Penalty reminder:** Violations range from $137 to $68,928 per violation (as of 2024 inflation adjustments), up to $2.07M per violation category per year. Willful neglect with no correction starts at $68,928 per violation. +> **Penalty reminder:** HHS OCR's civil monetary penalty tiers (45 CFR § 160.404), effective January 28, 2026 per the latest Federal Register inflation adjustment, range from $145 (Tier 1 — no knowledge) to $73,011 per violation, up to $2,190,294 per violation category per year. Willful neglect with no correction (Tier 4) starts at $73,011 per violation and can reach the full $2,190,294 annual cap for a single category. Note: OCR's 2019 Notice of Enforcement Discretion caps annual totals lower for Tiers 1–3 ($25,000 / $100,000 / $250,000) — verify current OCR guidance before citing these figures in an audit deliverable, as amounts are re-adjusted for inflation annually. ---