OCR closed 2025 with 21 HIPAA settlements and civil monetary penalties, the second-highest annual total on record, totaling roughly $6.6 million, according to HIPAA Journal's tracking of federal HIPAA enforcement. That pace shows no sign of slowing in 2026: the largest fine in HIPAA history remains the $16 million Anthem settlement from 2018, and nearly every recent case traces back to the same root cause, a missing or inadequate risk analysis.
Below is the full year-by-year settlement trend, the largest fines ever issued, the four-tier penalty structure that determines how much a violation actually costs, and why risk analysis failures dominate enforcement.
How many HIPAA settlements happened in 2025?
OCR reached 21 settlements and civil monetary penalties in 2025, the second-highest annual total since HIPAA enforcement began, according to HIPAA Journal. The year's largest single case was Solara Medical Supplies' $3 million settlement, announced January 14, 2025, resolving Security Rule and Breach Notification Rule failures tied to a breach affecting more than 114,000 individuals.
Settlement counts have been volatile rather than steadily rising or falling: OCR closed roughly 11 cases in 2021, 22 in 2022, 11 in 2023, 22 in 2024, and 21 in 2025.
Figure 1: HIPAA settlements and civil monetary penalties per year, 2021 to 2025. Source: HIPAA Journal, compiled from OCR enforcement announcements.
A large share of the 2025 total traces to a single enforcement push. By the end of May 2025, OCR had announced 10 additional financial penalties tied specifically to its Risk Analysis Initiative, launched in late 2024 to target organizations that had never completed a required security risk assessment.
What is the largest HIPAA fine ever issued?
The largest confirmed HIPAA fine remains $16 million, paid by Anthem Inc. in 2018 following a 2015 cyberattack that exposed the electronic protected health information of almost 79 million people, the largest healthcare data breach in US history at the time. The settlement pushed OCR's cumulative HIPAA penalty total past $100 million for the first time. Anthem's total legal exposure from the breach ran far higher than the OCR fine alone, including a separate $115 million multidistrict settlement and $39.5 million paid to attorneys general in 43 states.
| Entity | Year | Amount |
|---|---|---|
| Anthem Inc. | 2018 | $16.00 million |
| Premera Blue Cross | 2020 | $6.85 million |
| Advocate Health Care | 2016 | $5.55 million |
| Excellus Health Plan | 2021 | $5.10 million |
| Montefiore Medical Center | 2024 | $4.75 million |
| Solara Medical Supplies | 2025 | $3.00 million |
Figure 2: The six largest HIPAA settlements and civil monetary penalties on record. Source: HIPAA Journal; HHS Office for Civil Rights press releases.
Every entry in that table shares a common thread with the smaller Solara case: security failures that a risk analysis, had one been properly conducted, would likely have flagged before a breach occurred.
What are the four HIPAA penalty tiers?
HIPAA's civil monetary penalty structure sets four culpability tiers, each with its own per-violation minimum but a shared per-violation maximum and identical annual cap. As of 2026, the ranges run from $145 per violation at the low end of Tier 1 to $73,011 per violation at Tier 4, with a $2,190,294 annual cap per identical violation type across every tier.
| Tier | Culpability level | Per-violation minimum | Per-violation maximum |
|---|---|---|---|
| 1 | Reasonable efforts, violation still occurred | $145 | $73,011 |
| 2 | Reasonable cause, not willful neglect | $1,461 | $73,011 |
| 3 | Willful neglect, corrected within 30 days | $14,602 | $73,011 |
| 4 | Willful neglect, not corrected | $73,011 | $73,011 |
Figure 3: How OCR assigns a HIPAA violation to one of four penalty tiers based on culpability. Source: 45 CFR 160.404, HIPAA civil monetary penalty structure.
Why do risk analysis failures dominate HIPAA enforcement?
Roughly 90% of HIPAA Security Rule enforcement actions cite an inadequate or missing risk analysis, according to OCR's own public statements, making it by far the most common root cause behind a settlement or civil monetary penalty. A risk analysis, a systematic assessment of where an organization's electronic protected health information is vulnerable, is a Security Rule requirement that predates most of the breaches OCR ends up investigating.
Figure 4: Share of HIPAA Security Rule enforcement actions citing a risk analysis failure. Source: HHS Office for Civil Rights public enforcement commentary, as compiled by HIPAA Journal.
Figure 5: Key HIPAA enforcement milestones, 2013 to 2025. Source: HHS Office for Civil Rights; HIPAA Journal.
Any covered entity or business associate that has not documented a current risk analysis is, by OCR's own enforcement pattern, the single most likely target for the next settlement. Documenting data practices clearly is a related but separate obligation: a privacy policy explains what happens to data collected, while a risk analysis addresses how that data is secured, and OCR increasingly expects both from healthcare-adjacent businesses. Financial services regulators expect the same pairing; see 41.8% of Fintech Breaches Trace to Vendors: 2026 Data for how that same risk analysis and disclosure gap shows up in fintech vendor breaches.
The Bottom Line
HIPAA enforcement in 2026 is neither accelerating nor slowing in any clean trend, settlement counts have swung between 11 and 22 a year since 2021, but the underlying cause of most cases has stayed remarkably consistent: a missing risk analysis. The $16 million Anthem case from 2018 still stands as the ceiling nearly a decade later, while smaller cases like Solara's $3 million 2025 settlement show that OCR pursues risk analysis failures at every size of organization, not just the largest breaches. For the broader healthcare privacy landscape these fines sit inside, see 77% Worry About AI and Health Data: 2026 Privacy Data, and for how the same risk analysis gap plays out among smaller organizations generally, see 64% of Small Firms Document Privacy Policies: 2026 Data.
Frequently Asked Questions
How many HIPAA settlements did OCR reach in 2025? 21 settlements and civil monetary penalties, the second-highest annual total on record, totaling roughly $6.6 million, according to HIPAA Journal's tracking of OCR enforcement actions. The year's largest single settlement was Solara Medical Supplies' $3 million payment, announced January 14, 2025.
What is the largest HIPAA fine ever issued? $16 million, paid by Anthem Inc. in 2018 following a 2015 breach that exposed the electronic protected health information of almost 79 million people. It remains the largest HIPAA settlement on record as of 2026, more than double the next-largest confirmed case.
What is the most common reason OCR issues a HIPAA fine? A failure to conduct an adequate risk analysis. OCR has stated that inadequate risk analysis is involved in roughly 90% of its HIPAA Security Rule enforcement actions, and the agency's Risk Analysis Initiative, launched in late 2024, specifically targets organizations that have never completed one.
What are the four HIPAA violation penalty tiers? Tier 1 covers violations where the entity used reasonable diligence but still violated the rule, tier 2 covers violations due to reasonable cause rather than willful neglect, tier 3 covers willful neglect that was corrected within 30 days, and tier 4 covers willful neglect that was not corrected. As of 2026, per-violation penalties range from $145 at the low end of tier 1 to $73,011 per violation at tier 4, with an annual cap of $2,190,294 per identical violation type.
Where the Numbers Come From
- HIPAA Journal. (2026). "2025 Healthcare Data Breach Report." OCR settlement counts and enforcement trend, 2021 to 2025.
- HIPAA Journal. (2026). "HIPAA Violation Fines, Updated for 2026." Penalty tier structure, largest settlements on record.
- HIPAA Journal. "$16 Million Anthem HIPAA Breach Settlement Takes OCR HIPAA Penalties Past $100 Million Mark." Anthem settlement detail.
- Ogletree Deakins. (2025). "2025 Enforcement Trends: Risk Analysis Failures at the Center of HHS's Multimillion-Dollar HIPAA Penalties." Risk Analysis Initiative detail, roughly 90% risk-analysis-failure enforcement pattern.
Note: All figures verified as of September 2026. Settlement counts by year are compiled by HIPAA Journal from OCR's public enforcement announcements and may be revised as OCR finalizes late-year cases; some industry trackers report slightly different annual totals depending on whether they count investigations closed, civil monetary penalties, or settlements only. This post's figures are refreshed at least twice a year.
