45 CFR 160.408 HIPAA · Part 160: GENERAL ADMINISTRATIVE REQUIREMENTS · Subpart D: Imposition of Civil Money Penalties
45 CFR 160.408 HIPAA: Factors considered in determining the amount of a civil money penalty
eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026.
Official text
In determining the amount of any civil money penalty, the Secretary will consider the following factors, which may be mitigating or aggravating as appropriate:
The nature and extent of the violation, consideration of which may include but is not limited to:
The number of individuals affected; and
The time period during which the violation occurred;
The nature and extent of the harm resulting from the violation, consideration of which may include but is not limited to:
Whether the violation caused physical harm;
Whether the violation resulted in financial harm;
Whether the violation resulted in harm to an individual's reputation; and
Whether the violation hindered an individual's ability to obtain health care;
The history of prior compliance with the administrative simplification provisions, including violations, by the covered entity or business associate, consideration of which may include but is not limited to:
Whether the current violation is the same or similar to previous indications of noncompliance;
Whether and to what extent the covered entity or business associate has attempted to correct previous indications of noncompliance;
How the covered entity or business associate has responded to technical assistance from the Secretary provided in the context of a compliance effort; and
How the covered entity or business associate has responded to prior complaints;
The financial condition of the covered entity or business associate, consideration of which may include but is not limited to:
Whether the covered entity or business associate had financial difficulties that affected its ability to comply;
Whether the imposition of a civil money penalty would jeopardize the ability of the covered entity or business associate to continue to provide, or to pay for, health care; and
The size of the covered entity or business associate; and
Such other matters as justice may require.
Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR.
Source credit: [78 FR 5691, Jan. 25, 2013]
eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026.
This is reference material, not legal advice.