What are the penalties for not being HIPAA compliant?

The United States Department of Health and Human Services (HHS) may impose civil and criminal penalties for non-compliance. There are 4 tiers of civil penalties. Here is what email breach penalties look like for each tier.

Tier 1

This only applies if you had absolutely no idea you needed HIPAA compliant email. That is extremely hard to prove, but some people think sending PHI over a non-compliant email service is okay.

HHS may give you a warning if you are lucky. More likely, you will be fined $100 per email that contains PHI, or a maximum of $25,000 per year. At HHS's discretion, this may go up to $50,000 per year. If you can prove total ignorance, you may get a smaller fine and a slap on the hand. You will most likely not face criminal penalties, but that is still a risk.

If you are reading this, you are not really capable of a Tier 1 violation. Yours would be more severe.

Tier 2

You know you need HIPAA compliant email, but you keep using non-compliant email to send PHI. HHS will fine you $1,000 per email with PHI, or a maximum of $10,000 per year. They may refer your case to the Department of Justice (DOJ), which can press charges for wrongful disclosure of individually identifiable health information. On top of civil penalties, the DOJ will fine you up to $50,000 and up to 1 year in prison.

Tier 3

You use a HIPAA compliant email service but do not follow its policies and best practices. This is willful neglect: you know what to do per your provider, but choose not to follow it. Examples are forwarding emails to or from a non-compliant email service, or refusing to use supported email software or devices.

HHS will fine you $10,000 per email with PHI, or a maximum of $100,000 per year, only if you are willing to correct the situation. They may refer your case to the DOJ. On top of civil penalties, the DOJ will fine you up to $100,000 and up to 5 years in prison.

Tier 4

The same as Tier 3, except you refuse to correct the situation even after HHS warns you. This is the most severe case of willful neglect. HHS will fine you $50,000 per email with PHI, or a maximum of $1.5 million per year. They may refer your case to the DOJ. On top of civil penalties, the DOJ will fine you up to $250,000 and up to 10 years in prison.