The maximum HIPAA civil money penalty will not move this year. HHS confirmed through the Federal Register that it is skipping the annual inflation multiplier for 2026 and staying at 2025 levels.
The mechanism is normally automatic. The Federal Civil Penalties Inflation Adjustment Act requires agencies to scale penalties to inflation each year, with the multiplier set by the Office of Management and Budget. HIPAA amounts originate in the HITECH Act, which capped them at $1.5 million per violation, per year. Annual adjustments have since pushed the ceiling to $2,190,294, a 46% increase over the 17-year-old statutory figure.
This year’s skip is not a policy choice. A prolonged government shutdown last fall stalled fiscal 2026 appropriations, and the Bureau of Labor Statistics could not produce the October 2025 Consumer Price Index data needed to calculate the multiplier. OMB informed agencies in April 2026 that the adjustment was canceled and current penalty structures would remain.
The arithmetic resumes later. The 2027 multiplier is expected to fold in cost-of-living movement from 2025 through 2027, which could produce a larger single step.
OCR has separately pressed Congress to raise the underlying HITECH caps, arguing that flat penalties erode deterrence as breach costs climb. That ask has gone nowhere.
For compliance officers, the value here is budgetary and evidentiary. Fine exposure is not rising this year, so the negotiating weight in an OCR corrective action plan shifts toward operational commitments rather than dollar ceilings. Document remediation you have already completed.
