HIPAA Fines and Penalties in Hawaii: 2026 Amounts and How Enforcement Works

Editor's note: We have rebranded: Intech Hawaii is now Intech Pacific. We updated this post in October 2026.

Last updated: October 2026

HIPAA penalties for Hawaii healthcare organizations are set by federal law and enforced mainly by the HHS Office for Civil Rights (OCR). As of October 2026, civil penalties range from $145 per violation at the lowest tier to $2,190,294 per calendar year for identical violations at the highest tier, after HHS's most recent inflation adjustment. Criminal penalties of up to $250,000 and 10 years in prison apply to intentional misuse of health information.

Hawaii does not have its own separate HIPAA penalty schedule. A Hawaii medical practice, dental office, clinic, or health plan can still face more than one enforcer: OCR, the Department of Justice for criminal cases, the Hawaii Attorney General under federal law, and state penalties under Hawaii's breach notification law. This guide explains each one, what drives the size of a penalty, and what actually reduces your exposure.

How Are HIPAA Penalties Calculated for Hawaii Organizations?

HIPAA civil penalties are calculated by culpability tier, number of violations, and the facts of the case. The statute at 42 U.S.C. 1320d-5 sets four tiers based on what the organization knew and how it responded. HHS then weighs the nature and extent of the violation and the harm that resulted.

The four tiers are:

1. Did not know. The organization did not know about the violation and, with reasonable diligence, would not have known.
2. Reasonable cause. The violation was due to reasonable cause and not willful neglect.
3. Willful neglect, corrected. The violation was due to willful neglect but was corrected within the required time.
4. Willful neglect, not corrected. The violation was due to willful neglect and was not corrected in time.

The statute also gives organizations an important incentive to act fast. If a failure to comply is not due to willful neglect and is corrected within 30 days after the organization knew, or should have known, about it, no civil penalty applies. HHS can extend that window based on the nature of the failure.

What Are the Current HIPAA Penalty Amounts?

The current HIPAA penalty amounts come from HHS's annual inflation adjustment published in the Federal Register on January 28, 2026. As of October 2026, that is the most recent adjustment. The amounts apply to penalties assessed on or after that date for violations that occurred after November 2, 2015.

• Tier 1, did not know: $145 minimum per violation, $73,011 maximum per violation.
• Tier 2, reasonable cause: $1,461 minimum per violation, $73,011 maximum per violation.
• Tier 3, willful neglect, corrected: $14,602 minimum per violation, $73,011 maximum per violation.
• Tier 4, willful neglect, not corrected: $73,011 minimum per violation, $2,190,294 maximum per violation.
• Calendar-year cap for identical violations: $2,190,294 under the adjusted regulation.

The original post listed $100 to $50,000 per violation and a $1.5 million annual maximum. Those are the base amounts written into the statute. They have been adjusted for inflation every year since 2016, so the dollar figures above are the ones that apply now.

How the 2019 Enforcement Discretion Lowers the Annual Caps

HHS uses lower annual caps for the first three tiers under a 2019 Notification of Enforcement Discretion. That notice set annual limits of $25,000 for tier 1, $100,000 for tier 2, $250,000 for tier 3, and $1,500,000 for tier 4, each adjusted for inflation. HHS said it would apply this structure until further notice. It is an enforcement policy, not a change to the regulation, so it could be revised.

What Counts as One Violation

A single incident can produce many violations. A lost laptop with patient records, for example, can involve a missing risk analysis, missing encryption decision, and an impermissible disclosure, and each affected record or each day of noncompliance can be counted separately. This is why settlements often run into six figures even for small organizations.

What Are the Criminal Penalties for HIPAA Violations?

Criminal HIPAA penalties apply to people who knowingly obtain or disclose individually identifiable health information in violation of HIPAA. Under 42 U.S.C. 1320d-6, the Department of Justice prosecutes these cases, and the penalties increase with intent:

• Knowing violation: a fine of up to $50,000, up to 1 year in prison, or both.
• Under false pretenses: a fine of up to $100,000, up to 5 years in prison, or both.
• With intent to sell, transfer, or use the information for commercial advantage, personal gain, or malicious harm: a fine of up to $250,000, up to 10 years in prison, or both.

Criminal cases are rare compared to civil enforcement. They usually involve individuals, such as an employee who sells patient data or uses it for identity theft. OCR can refer a complaint to the Department of Justice when the facts suggest a criminal violation.

Can the Hawaii Attorney General Enforce HIPAA?

Yes. The Hawaii Attorney General can bring a HIPAA civil action in federal district court on behalf of Hawaii residents. Under the state attorney general provision of the HIPAA statute, the state can seek an injunction or statutory damages of up to $100 per violation, capped at $25,000 per calendar year for identical violations, plus costs and attorney fees. The state must notify HHS first and cannot sue while a federal action on the same violation is pending.

What Hawaii State Law Adds: Breach Notification Penalties

Hawaii's security breach notification law, HRS chapter 487N, adds state-level exposure when personal information is involved. Under HRS 487N-3, a business that violates the chapter can face penalties of up to $2,500 per violation in an action brought by the Attorney General or the executive director of the Office of Consumer Protection. A business can also be liable to an injured person for actual damages, and the court may award attorney fees.

There is an important connection to HIPAA. Under HRS 487N-2(g), a health plan or health care provider that is subject to and in compliance with HIPAA's privacy and security standards is deemed to comply with the state notification section. The key phrase is "in compliance." A provider with an incomplete risk analysis or missing safeguards may not be able to rely on that provision. For the rest of Hawaii's breach law, including what counts as personal information, see our guide to data privacy compliance in Hawaii.

How OCR Enforcement Actually Works

Most HIPAA cases start with a complaint or a breach report, not a random audit. OCR reviews the evidence, and if it finds noncompliance, it usually tries to resolve the case through voluntary compliance, corrective action, or a resolution agreement, according to HHS's description of how OCR enforces the HIPAA rules. If the matter is not resolved, OCR can impose civil money penalties. The organization can request a hearing before an HHS administrative law judge.

A few points that clear up common confusion:

• Complaints go to OCR. A person who believes their health information rights were violated files with OCR, and must generally do so within 180 days of learning about the issue. OCR can extend that period for good cause.
• Penalties go to the U.S. Treasury. The person who complained does not receive a share.
• Breaches trigger their own clock. Under the HIPAA Breach Notification Rule, covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach. Breaches affecting 500 or more people must also be reported to HHS within 60 days, and to prominent media when more than 500 residents of a state are affected.
• Resolution agreements include monitoring. A settlement often comes with a corrective action plan and OCR oversight, typically for a period of years. The cost of that work frequently exceeds the payment itself.

In recent years, OCR has paid particular attention to whether organizations completed an accurate and thorough Security Rule risk analysis. In March 2025, for example, OCR announced a $227,816 settlement with Health Fitness Corporation as the fifth action under its Risk Analysis Initiative. For more on where enforcement and rulemaking are heading, see our update on HIPAA changes for Hawaii healthcare.

Common HIPAA Violations That Lead to Penalties

The violations I see create the most risk for Hawaii practices are ordinary, not exotic. They include:

• No current risk analysis, or one that is generic and not tied to the actual systems in use.
• Lost or stolen devices such as laptops, phones, or USB drives holding unencrypted patient information.
• Snooping, where staff look up records of family, neighbors, or public figures without a work reason. In a close-knit place like Hawaii, where it seems everyone knows each other, this temptation is real.
• Misdirected email or faxes that send patient information to the wrong person.
• Late or missing breach notifications.
• Denied or delayed patient access to their own records.
• Missing business associate agreements with IT, billing, cloud, or transcription vendors.

How to Reduce Your HIPAA Penalty Exposure

The most effective way to reduce HIPAA penalty exposure is to show reasonable diligence before anything goes wrong. Tier, correction time, and the quality of your documentation drive the outcome more than anything you say after an incident. Here is the checklist I use with healthcare clients:

1. Complete and update a written risk analysis. Base it on an inventory of where patient data lives and how it moves. Update it after major changes and at least annually.
2. Keep a risk management plan. For each risk, document what you decided, who owns it, and the target date.
3. Write policies that match reality. A policy that says you encrypt laptops when you do not is worse than no policy, because it shows you knew.
4. Encrypt portable devices and backups. Encryption is addressable under the current rule, but encrypted data that is lost generally does not count as a reportable breach.
5. Turn on MFA for email, remote access, and the EHR. Account takeover through business email compromise is one of the most common threats I see against Hawaii businesses.
6. Train staff at hire and at least annually, and keep attendance records.
7. Review access logs and remove access promptly when staff leave or change roles.
8. Keep signed business associate agreements for every vendor that handles patient information.
9. Practice your breach response. Know who decides whether an incident is a breach, who drafts notices, and how you will meet the 60-day deadline.
10. Fix problems quickly and document the fix. Correcting a problem within 30 days, when it is not willful neglect, can avoid a civil penalty altogether.

Why Documentation Decides HIPAA Outcomes

Documentation is what separates reasonable cause from willful neglect. When I worked with hedge funds and investment advisors in New York, regulators expected you to show your work, and firms learned that documentation and reporting were not optional. Healthcare has historically faced lighter enforcement, and many practices have not built that habit. The most common gap I find is an information security plan that is missing, generic, or not detailed enough to reflect how the organization actually operates.

The second lesson is about ownership. IT can implement safeguards, but HIPAA compliance has to be driven by leadership or it fails. Leaders set the budget, accept the risks, and sign off on the policies. When an investigator asks who decided not to encrypt a device, the answer should be a person with authority and a written reason.

Talk to Intech Pacific About HIPAA Compliance

If you want to know how your practice would look to an investigator today, start with the risk analysis and the documents behind it. Intech Pacific helps Hawaii healthcare organizations assess HIPAA gaps, document safeguards, and build the evidence that shows reasonable diligence. Learn more about our IT compliance services.