Recognizing that different levels of culpability warrant different annual civil penalty limits, the Department of Health and Human Services adopted a notification April 23, 2019, to be published in the Federal Register April 30, 2019, that reduces the majority of the caps on annual civil penalties. See 45 C.F.R. Part. 160.

The table below shows the differences:

Culpability Old Annual Limit New Annual Limit
No Knowledge $1,500,000 $25,000
Reasonable Cause $1,500,000 $100,000
Willful Neglect – Corrected $1,500,000 $250,000
Willful Neglect – Not Corrected $1,500,000 $1,500,000

In our experience, clients rarely, if ever, fall into the last category. And even if clients are at risk of having been willfully neglectful in violating HIPAA, the new penalty limits add to the incentives for those clients to correct problems that led to the potential violations before potential scrutiny by the Office of Civil Rights. That ounce of prevention could lead to $1,250,000 of cure.