--- title: How much do HIPAA violations cost? - TrueVault description: How much do HIPAA violations cost? - TrueVault --- - [CCPA](https://safe.truevault.com/learn/ccpa/what-is-the-ccpa) - [GDPR Compliance](https://safe.truevault.com/gdpr-guide) - [Personal Data](https://safe.truevault.com/learn/what-is-personal-data) - [DSAR](https://safe.truevault.com/learn/explaining-gdpr-data-subject-requests) - [HIPAA](https://safe.truevault.com/learn/hipaa) - [HIPAA Compliance](https://safe.truevault.com/blog/hipaa-compliance-checklist-download.html) - [Personally Identifiable Information](https://safe.truevault.com/blog/what-is-phi) - [PHI](https://safe.truevault.com/protected-health-information) - [Resources](https://safe.truevault.com/learn/) - [Resource Center](https://safe.truevault.com/learn/) - [TrueVault Safe](https://safe.truevault.com/help/truevault-safe) - [About](https://safe.truevault.com/about-us) - [Contact](https://safe.truevault.com/contact-us) - [Careers](https://careers.truevault.com/) - Solutions - [GDPR Compliance](https://safe.truevault.com/solutions/gdpr-compliance) - [HIPAA Compliance](https://safe.truevault.com/hipaa-compliance) - [For Applications](https://safe.truevault.com/solutions/application-compliance) - [For Data Exchanges](https://safe.truevault.com/solutions/data-exchange-compliance) - [Developers](https://safe.truevault.com/resources/index) - [Pricing](https://safe.truevault.com/safe-pricing) - [Blog](https://safe.truevault.com/blog) - [Login](https://console.truevault.com/login) - [Get Started](https://safe.truevault.com/get-started) Resources - [Home](https://safe.truevault.com/homepage-v3?hsLang=en) - [Resources](https://safe.truevault.com/resources/index?hsLang=en) - How much do HIPAA violations cost # How much do HIPAA violations cost? HIPAA violations are expensive. The penalties for noncompliance are based on the level of negligence and can range from $100 to $50,000 per violation (or per record), with a maximum penalty of $1.5 million per year for violations of an identical provision. Violations can also carry criminal charges that can result in jail time.   Fines will increase with the number of patients and the amount of neglect. The lowest fines start with a breach where you didn’t know and, by exercising reasonable diligence, would not have known that you violated a provision. At the other end of the spectrum are fines levied where a breach is due to negligence and not corrected in 30 days. In legalese, this is known as mens rea (state of mind). So fines increase in severity from no mens rea (didn’t know) to assumed mens rea (willful neglect). The fines and charges are broken down into 2 major categories: *Reasonable Cause* and *Willful Neglect*. Reasonable Cause ranges from $100 to $50,000 per incident and does not involve any jail time. Willful Neglect ranges from $10,000 to $50,000 for each incident and can result in criminal charges. **Unencrypted Data** While encryption is an addressable (rather than required) specification, it does not mean optional. The vast majority of data breaches are due to stolen or lost data that was unencrypted. When in doubt, you should implement the [addressable implementation specifications](https://github.com/truevault/hipaa-compliance-developers-guide/blob/master/04%20HIPAA%20Security%20Rule.md#required-vs-addressable-specifications) of the Security Rule. Most of them are best practices. **Employee Error** Breaches can occur when employees lose unencrypted portable devices, mistakenly send PHI to vendors who post that information online, and disclose personally identifiable, sensitive information on social networks. These are all examples from actual cases. Employee training and adherence to security policies and procedures is extremely important. **Data Stored on Devices** Almost half of all data breaches are the result of theft. When laptops, smartphones, etc. are unencrypted the risk of a breach increases considerably. With TrueVault, your data is safely stored off-premise; so that stolen laptop just has a token on it, and no PHI is compromised. ### Latest Posts ## [Should Utah's Privacy Law Be on Your Radar?](https://safe.truevault.com/blog/utah-privacy-law-does-it-apply?hsLang=en) Phillip Walters / November 17, 2022 ## [Connecticut’s Privacy Law: Does It Apply to Your Business?](https://safe.truevault.com/blog/connecticut-privacy-law-does-it-apply?hsLang=en) Phillip Walters / November 10, 2022 ## [Global Privacy Control: A New Requirement for Compliance](https://safe.truevault.com/blog/global-privacy-control?hsLang=en) Phillip Walters / November 7, 2022 ### Mailing List ### Company - [Blog](https://safe.truevault.com/blog) - [Contact Us](https://safe.truevault.com/contact-us-2019) - [Careers](https://truevault.workable.com) - [HIPAA Compliance Checklist](https://safe.truevault.com/blog/hipaa-compliance-checklist-download.html) - [PDF: Developers Guide to HIPAA compliance](https://my.leadpages.net/leadbox/14472b173f72a2%3A131fd12f8b46dc/5760820306771968/) ### Developers - [Patterns](https://safe.truevault.com/patterns) - [Documentation](https://docs.truevault.com/) - [Quick Start Guide](https://safe.truevault.com/quick-start-guide) - [Secure Infrastructure](https://safe.truevault.com/secure-infrastructure) - [API Overview](https://safe.truevault.com/api-overview) ### Latest Posts ### Contact Us 201 Mission Street, 12th Floor San Francisco, CA 94105 Email: [hello@truevault.com](mailto:hello@truevault.com) 2021 © All Rights Reserved. [Privacy Policy](https://privacy.truevault.com/privacy-policy) | [Terms of Service](https://safe.truevault.com/terms-of-service?hsLang=en) - - -