HHS said a month of inflation data that was never produced during last year's federal funding lapse left no basis for this year's increase.

 

What happened

HHS will not apply an inflation adjustment to its civil monetary penalties in 2026, including the penalties for HIPAA violations, according to a notice in the Federal Register published October 21, 2026. Federal law normally requires agencies to raise their penalty amounts each year in line with inflation, so that fines keep their value as a deterrent. The yearly increase is calculated from the Consumer Price Index for October of the previous year. HHS will keep using the 2025 penalty levels for all penalties imposed after January 15, 2025. The same penalty structure covers failures in how organizations protect patient information, including in email and other electronic systems.

 

Going deeper

The adjustment depends on October Consumer Price Index data from the Bureau of Labor Statistics. Because of a lapse in federal appropriations from October 1 to November 12, 2025, the bureau was unable to produce the October 2025 figures, according to the HHS notice. Without them, there was no multiplier to apply for 2026. The Office of Management and Budget issued guidance on April 17, 2026, canceling the 2026 adjustment and telling agencies to continue using their 2025 penalty amounts, and HHS’s notice follows that guidance. The 2025 multiplier, based on October 2024 data, was 1.02598.

 

What was said

HHS "will continue to use the 2025 civil monetary penalty levels because there will be no cost-of-living adjustment for 2026," the department stated in the notice. The notice was signed by Gustav Chiarello, Assistant Secretary for Financial Resources at HHS.

 

In the know

HHS is one of several federal agencies to publish the same decision this year. The Justice Department said in July that the statute does not allow an alternative way of calculating penalty amounts when the October data is missing, in its own Federal Register notice, and that it would review its civil penalties in 2027. The Securities and Exchange Commission and the Department of Housing and Urban Development published similar notices. HIPAA penalties are set in four tiers based on the level of fault, ranging from violations the organization did not know about up to willful neglect that was not corrected within 30 days, with a yearly cap for repeat violations of the same requirement.

 

The big picture

The penalty schedule staying flat changes little about what a HIPAA failure costs, because the amount a regulator settles for is only part of it. When Yakima Valley Memorial Hospital settled with OCR over security guards viewing patient records without a work reason, it paid $240,000 and also agreed to a corrective action plan with two years of monitoring, according to HHS. State attorneys general bring their own actions under state law as well. Earlier this month, New York and Connecticut secured $2.7 million from a pediatric network and its IT vendor over a 2024 breach, along with required security improvements, according to the New York Attorney General. For covered entities, the obligations that drive those outcomes, such as risk analysis, access controls, and staff training, are unchanged.

 

FAQs

Why weren't HIPAA penalties increased this year?

The yearly increase is calculated from October inflation data, and the October 2025 figures were never produced because of the federal funding lapse. Without that data, there was no multiplier to apply.

 

Which penalty amounts apply now?

HHS will keep using the 2025 penalty levels for penalties imposed after January 15, 2025.

 

Does this affect state penalties?

No. State attorneys general enforce under their own laws and set their own amounts.

 

Will penalties rise again next year?

The Justice Department said it will review its civil penalties in 2027. Normal annual adjustments depend on the October data being available.

 

How are HIPAA penalties tiered?

By level of fault, from violations an organization didn't know about, through reasonable cause, to willful neglect that was or wasn't corrected within 30 days. Each tier has its own range and a yearly cap.