docs(hipaa): update stale 2024 HIPAA penalty figures to current 2026 HHS OCR tiers - #61

Summary

• mappings/hipaa.md's "Penalty reminder" callout cited 2024 HHS OCR civil monetary penalty figures ($137–$68,928 per violation, $2.07M annual cap per category), described in the text itself as "as of 2024 inflation adjustments."
• HHS OCR published updated inflation-adjusted amounts in the Federal Register, effective January 28, 2026 (per 45 CFR § 160.404): $145–$73,011 per violation, up to $2,190,294 per violation category per year for the top culpability tier.
• As of this PR (July 2026), the repo had been citing figures that were roughly two inflation cycles stale — exactly the kind of drift this repo's own open issues (All 18 policy templates cite superseded NIST CSF v1.1 codes, inconsistent with mappings/nist-csf.md's CSF 2.0 upgrade #53, docs/framework_mapping.md is an orphaned, stale duplicate of /mappings — cites NIST CSF v1.1 and isn't linked from README or anywhere else #55, mappings/nist-csf.md — the file cited as the CSF 2.0 source of truth still contains ID.SC and PR.IP, two categories CSF 2.0 removed #58) flag as undermining the "audit-ready" value proposition for compliance mapping content.
• Also noted OCR's 2019 Notice of Enforcement Discretion, which caps annual totals lower than the statutory maximum for the first three tiers, and added a note that these figures are adjusted annually so readers verify current amounts before citing them in an audit deliverable.
• Confirmed via search this was the only place in the repo citing these specific dollar figures (grep -rn "68,928\|2.07M" returned one match, in this file).

Test plan

• Verified the new figures ($145 / $73,011 / $2,190,294, effective Jan 28, 2026) against current HHS/HIPAA-compliance reporting
• Confirmed no other file in the repo references the old penalty amounts
• N/A — documentation-only change, no code paths affected

Generated by Claude Code