Statutory and Regulatory Provisions

Description of Violation

Adjusted Penalty Amount

42 U.S.C. § 1320d-5(a); 45 C.F.R. § 160.404(b)(1)(i) and (ii)

Pre-February 18, 2009, violations of HIPAA's administrative simplification provisions. 

(February 18, 2009, was the effective date of certain increased penalties for HIPAA violations under the Health Information Technology for Economic and Clinical Health Act (HITECH Act).)

$159

$39,936 (calendar year cap)

42 U.S.C. § 1320d-5(a); 45 C.F.R. § 160.404(b)(2)(i)(A) and (B)

February 18, 2009, or later violations of HIPAA's administrative simplification provisions, if it is established that a HIPAA covered entity (CE) or business associate (BA) did not know (and by exercising reasonable diligence would not have known) that the CE or BA violated the provision.

$117 (minimum)

$58,490 (maximum)

$1,754,698 (calendar year cap)

42 U.S.C. § 1320d-5(a); 45 C.F.R. § 160.404(b)(2)(ii)(A) and (B)

February 18, 2009, or later violations of HIPAA's administrative simplification provisions, if it is established that the violation was due to reasonable cause and not willful neglect.

$1,170 (minimum)

$58,490 (maximum)

$1,754,698 (calendar year cap)

42 U.S.C. § 1320d-5(a); 45 C.F.R. § 160.404(b)(2)(iii)(A) and (B)

February 18, 2009, or later violations of HIPAA's administrative simplification provisions, if it is established that the violation was due to willful neglect and was corrected during the 30-day period beginning on the first date the CE or BA knew (or by exercising reasonable diligence would have known) that the violation occurred.

$11,698 (minimum)

$58,490 (maximum)

$1,754,698 (calendar year cap)

42 U.S.C. § 1320d-5(a); 45 C.F.R. § 160.404(b)(2)(iv)(A) and (B)

February 18, 2009, or later violations of HIPAA's administrative simplification provisions, if it is established that the violation was due to willful neglect and was not corrected during the 30-day period beginning on the first date the CE or BA knew (or by exercising reasonable diligence would have known) that the violation occurred.

$58,490 (minimum)

$1,754,698 (maximum)

$1,754,698 (calendar year cap)

42 U.S.C. § 300gg-15(f) (Section 2715 of the Public Health Service Act (PHSA)); 45 C.F.R. § 147.200(e)

Failure to provide summaries of benefits and coverage (SBCs) (see Practice Note, Summaries of Benefits and Coverage under the ACA).

$1,156

42 U.S.C. § 300gg-18 (PHSA § 2718); 45 C.F.R. § 158.606

Violations of the Affordable Care Act's (ACA's) medical loss ratio reporting and rebating rules (see Legal Update, Guidance on Plan Asset Implications of Medical Loss Ratio Rebates).

$116

42 U.S.C. § 1395y(b)(3)(C); 42 C.F.R. § 411.103(b)

An employer or other entity offering any financial or other incentive for an individual entitled to benefits not to enroll under a group health plan or large group health plan that would be a primary plan.

$9,472

42 U.S.C. § 1395y(b)(7)(B)(i)

Failure of an entity serving as an insurer, third-party administrator (TPA), or fiduciary for a group health plan to provide information identifying situations where the group health plan is (or was) a primary plan to Medicare to HHS.

$1,211

42 U.S.C. § 18041(c)(2); 45 C.F.R. §§ 150.315 and 156.805(c)

Failure to comply with the requirements of the PHSA; penalty for violations of rules or standards of behavior associated with insurer participation in the ACA's federally facilitated health insurance exchanges (see Article, Health Insurance Exchange and Related Requirements Under the ACA).

$159

42 U.S.C. § 18081(h)(1)(A)(i)(II); 45 C.F.R. § 155.285

Providing false information on an exchange application.

$28,906

42 U.S.C. § 18081(h)(1)(B); 45 C.F.R. § 155.285

Knowingly or willfully providing false information on an exchange application.

$289,060

42 U.S.C. § 18081(h)(2); 45 C.F.R. § 155.260

Knowingly or willfully disclosing protected information from the exchange.

$28,906