--- title: "45 CFR 160.410 HIPAA: Affirmative defenses" canonical: "https://dposchool.com/hipaa/section/160.410" source: "https://www.ecfr.gov/current/title-45/section-160.410" source_note: "Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR." text_as_of: "2026-10-29" language: "en" publisher: "DPO School" --- 45 CFR 160.410 HIPAA · Part 160: GENERAL ADMINISTRATIVE REQUIREMENTS · Subpart D: Imposition of Civil Money Penalties # 45 CFR 160.410 HIPAA: Affirmative defenses eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. ## Official text ### 45 CFR 160.410(a) **(a)** The Secretary may not: #### 45 CFR 160.410(a)(1) **(1)** Prior to February 18, 2011, impose a civil money penalty on a covered entity or business associate for an act that violates an administrative simplification provision if the covered entity or business associate establishes that the violation is punishable under 42 U.S.C. 1320d-6. #### 45 CFR 160.410(a)(2) **(2)** On or after February 18, 2011, impose a civil money penalty on a covered entity or business associate for an act that violates an administrative simplification provision if the covered entity or business associate establishes that a penalty has been imposed under 42 U.S.C. 1320d-6 with respect to such act. ### 45 CFR 160.410(b) **(b)** For violations occurring prior to February 18, 2009, the Secretary may not impose a civil money penalty on a covered entity for a violation if the covered entity establishes that an affirmative defense exists with respect to the violation, including the following: #### 45 CFR 160.410(b)(1) **(1)** The covered entity establishes, to the satisfaction of the Secretary, that it did not have knowledge of the violation, determined in accordance with the Federal common law of agency, and by exercising reasonable diligence, would not have known that the violation occurred; or #### 45 CFR 160.410(b)(2) **(2)** The violation is— ##### 45 CFR 160.410(b)(2)(i) **(i)** Due to circumstances that would make it unreasonable for the covered entity, despite the exercise of ordinary business care and prudence, to comply with the administrative simplification provision violated and is not due to willful neglect; and ##### 45 CFR 160.410(b)(2)(ii) **(ii)** Corrected during either: ###### 45 CFR 160.410(b)(2)(ii)(A) **(A)** The 30-day period beginning on the first date the covered entity liable for the penalty knew, or by exercising reasonable diligence would have known, that the violation occurred; or ###### 45 CFR 160.410(b)(2)(ii)(B) **(B)** Such additional period as the Secretary determines to be appropriate based on the nature and extent of the failure to comply. ### 45 CFR 160.410(c) **(c)** For violations occurring on or after February 18, 2009, the Secretary may not impose a civil money penalty on a covered entity or business associate for a violation if the covered entity or business associate establishes to the satisfaction of the Secretary that the violation is— #### 45 CFR 160.410(c)(1) **(1)** Not due to willful neglect; and #### 45 CFR 160.410(c)(2) **(2)** Corrected during either: ##### 45 CFR 160.410(c)(2)(i) **(i)** The 30-day period beginning on the first date the covered entity or business associate liable for the penalty knew, or, by exercising reasonable diligence, would have known that the violation occurred; or ##### 45 CFR 160.410(c)(2)(ii) **(ii)** Such additional period as the Secretary determines to be appropriate based on the nature and extent of the failure to comply. ## Source Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR. Source credit: \[78 FR 5692, Jan. 25, 2013\] [45 CFR 160.410 on eCFR](https://www.ecfr.gov/current/title-45/section-160.410) eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. This is reference material, not legal advice. ## Navigation [HIPAA Navigator](https://dposchool.com/hipaa) / 45 CFR 160.410 Previous: [45 CFR 160.408 HIPAA: Factors considered in determining the amount of a civil money penalty](https://dposchool.com/hipaa/section/160.408) Next: [45 CFR 160.412 HIPAA: Waiver](https://dposchool.com/hipaa/section/160.412) ## For AI agents - Machine-readable index: https://dposchool.com/hipaa/llms.txt - JSON API: https://dposchool.com/hipaa/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents