Statutory and Regulatory Provisions

Description of Violation

Adjusted Penalty Amount

45 C.F.R. § 160.404(b)(1)(i) and (ii)

Pre-February 18, 2009, violations of HIPAA's administrative simplification provisions. 

(February 18, 2009, was the effective date of certain increased penalties for HIPAA violations under the Health Information Technology for Economic and Clinical Health Act (HITECH Act).)

$187

$47,061 (calendar year cap)

42 U.S.C. § 1320d-5(a); 45 C.F.R. § 160.404(b)(2)(i)(A) and (B)

February 18, 2009, or later violations of HIPAA's administrative simplification provisions, if it is established that a HIPAA covered entity (CE) or business associate (BA) did not know (and by exercising reasonable diligence would not have known) that the CE or BA violated the provision.

$137 (minimum)

$68,928 (maximum)

$2,067,813 (calendar year cap)

42 U.S.C. § 1320d-5(a); 45 C.F.R. § 160.404(b)(2)(ii)(A) and (B)

February 18, 2009, or later violations of HIPAA's administrative simplification provisions, if it is established that the violation was due to reasonable cause and not willful neglect.

$1,379 (minimum)

$68,928 (maximum)

$2,067,813 (calendar year cap)

42 U.S.C. § 1320d-5(a); 45 C.F.R. § 160.404(b)(2)(iii)(A) and (B)

February 18, 2009, or later violations of HIPAA's administrative simplification provisions, if it is established that the violation was due to willful neglect and was corrected during the 30-day period beginning on the first date the CE or BA knew (or by exercising reasonable diligence would have known) that the violation occurred.

$13,785 (minimum)

$68,928 (maximum)

$2,067,813 (calendar year cap)

42 U.S.C. § 1320d-5(a); 45 C.F.R. § 160.404(b)(2)(iv)(A) and (B)

February 18, 2009, or later violations of HIPAA's administrative simplification provisions, if it is established that the violation was due to willful neglect and was not corrected during the 30-day period beginning on the first date the CE or BA knew (or by exercising reasonable diligence would have known) that the violation occurred.

$68,928 (minimum)

$2,067,813 (maximum)

$2,067,813 (calendar year cap)

42 U.S.C. § 300gg-15(f) (Section 2715 of the Public Health Service Act (PHSA)); 45 C.F.R. § 147.200(e)

Failure to provide summaries of benefits and coverage (SBCs), as required under the Affordable Care Act (ACA) (see Practice Note, Summaries of Benefits and Coverage Under the ACA).

$1,362

42 U.S.C. § 300gg-18 (PHSA § 2718); 45 C.F.R. § 158.606

Violations of the ACA's medical loss ratio reporting and rebating rules (see Legal Update, Guidance on Plan Asset Implications of Medical Loss Ratio Rebates).

$136

CARES Act, Pub. L. No. 116-136, § 3202(b)(2); 45 C.F.R. § 182.70

Noncompliance by health provider with rule requiring public disclosure of the cash price for COVID-19 diagnostic testing on the provider's public website (see Practice Note, COVID-19 Vaccine and Testing Requirements for Group Health Plans).

$323 per day

42 U.S.C. §§ 300gg-118, 300gg-134 (PHSA §§ 2799A-8, 2799B-4)

Failure to comply with the surprise medical billing requirements for providers, facilities, and air ambulance services providers under the No Surprises Act (NSA) (part of the Consolidated Appropriations Act, 2021 (CAA-21)) (see Surprise Medical Billing for Health Plans, Health Insurers, and Health Care Providers and Facilities Toolkit).

$11,445

42 U.S.C. § 1395y(b)(3)(C); 42 C.F.R. § 411.103(b)

Penalty for an employer or other entity that offers any financial or other incentive for an individual who is entitled to benefits not to enroll under a group health plan or large group health plan that would be a primary plan.

$11,162

42 U.S.C. § 1395y(b)(7)(B)(i)

Failure of an entity serving as an insurer, third-party administrator (TPA), or fiduciary for a group health plan to provide information identifying situations where the group health plan is, or was, a primary plan (relative to Medicare) to HHS.

$1,428

42 U.S.C. § 18041(c)(2); 45 C.F.R. §§ 150.315 and 156.805(c)

Failure to comply with ACA requirements addressing risk adjustment, reinsurance, risk corridors; penalty for violations of rules or standards of behavior associated with insurer participation in the ACA's health insurance exchanges (see Article, Health Insurance Exchange and Related Requirements Under the ACA).

$187

42 U.S.C. § 18081(h)(1)(A)(i)(II); 45 C.F.R. § 155.285

Providing false information on an exchange application.

$34,065

42 U.S.C. § 18081(h)(1)(B); 45 C.F.R. § 155.285

Knowingly or willfully providing false information on an exchange application.

$340,641

42 U.S.C. § 300gg-22(b)(2)(C)(i); 45 C.F.R. § 150.315

Penalty for each day, for each individual affected by the failure of a health insurer or non-federal governmental group health plan to comply with certain federal market reforms under the PHSA.

$177