---
title: "45 CFR 160.420 HIPAA: Notice of proposed determination"
canonical: "https://dposchool.com/hipaa/section/160.420"
source: "https://www.ecfr.gov/current/title-45/section-160.420"
source_note: "Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR."
text_as_of: "2026-10-29"
language: "en"
publisher: "DPO School"
---

45 CFR 160.420 HIPAA · Part 160: GENERAL ADMINISTRATIVE REQUIREMENTS · Subpart D: Imposition of Civil Money Penalties

# 45 CFR 160.420 HIPAA: Notice of proposed determination

eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026.

## Official text

### 45 CFR 160.420(a)

**(a)** If a penalty is proposed in accordance with this part, the Secretary must deliver, or send by certified mail with return receipt requested, to the respondent, written notice of the Secretary's intent to impose a penalty. This notice of proposed determination must include—

#### 45 CFR 160.420(a)(1)

**(1)** Reference to the statutory basis for the penalty;

#### 45 CFR 160.420(a)(2)

**(2)** A description of the findings of fact regarding the violations with respect to which the penalty is proposed (except that, in any case where the Secretary is relying upon a statistical sampling study in accordance with § 160.536 of this part, the notice must provide a copy of the study relied upon by the Secretary);

#### 45 CFR 160.420(a)(3)

**(3)** The reason(s) why the violation(s) subject(s) the respondent to a penalty;

#### 45 CFR 160.420(a)(4)

**(4)** The amount of the proposed penalty and a reference to the subparagraph of § 160.404 upon which it is based.

#### 45 CFR 160.420(a)(5)

**(5)** Any circumstances described in § 160.408 that were considered in determining the amount of the proposed penalty; and

#### 45 CFR 160.420(a)(6)

**(6)** Instructions for responding to the notice, including a statement of the respondent's right to a hearing, a statement that failure to request a hearing within 90 days permits the imposition of the proposed penalty without the right to a hearing under § 160.504 or a right of appeal under § 160.548 of this part, and the address to which the hearing request must be sent.

### 45 CFR 160.420(b)

**(b)** The respondent may request a hearing before an ALJ on the proposed penalty by filing a request in accordance with § 160.504 of this part.

## Source

Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR.

Source credit: \[71 FR 8426, Feb. 16, 2006, as amended at 74 FR 56131, Oct. 30, 2009\]

[45 CFR 160.420 on eCFR](https://www.ecfr.gov/current/title-45/section-160.420)

eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026.

This is reference material, not legal advice.

## Navigation

[HIPAA Navigator](https://dposchool.com/hipaa) / 45 CFR 160.420

Previous: [45 CFR 160.418 HIPAA: Penalty not exclusive](https://dposchool.com/hipaa/section/160.418)

Next: [45 CFR 160.422 HIPAA: Failure to request a hearing](https://dposchool.com/hipaa/section/160.422)

## For AI agents

- Machine-readable index: https://dposchool.com/hipaa/llms.txt
- JSON API: https://dposchool.com/hipaa/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents