HHS Penalties Increase for 2023
The Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015 (the “Inflation Adjustment Act”) directs federal agencies to adjust the civil monetary penalties for inflation. On October 6, 2023, the Department of Health and Human Services (“HHS”) issued final rules adjusting civil monetary penalties for inflation.
The adjusted penalties are applicable to penalties assessed on or after October 6, 2023 (assuming the violation occurred on or after November 2, 2015, when the Inflation Adjustment Act was enacted).
Updated Penalties
The following chart contains the updated penalties applicable to group health plans:
| Description | 2022 Penalty (Prior) | 2023 Penalty (New) |
|---|---|---|
| Pre-February 18, 2009 violation of HIPAA administrative simplification provision | $174 per violation $43,678 annual cap | $187 per violation $47,061 annual cap |
| February 18, 2009 or later violation of HIPAA administrative simplification provision without knowledge | $127 min. $63,973 max. $1,919,173 annual cap | $137 min. $68,928 max. $2,067,813 annual cap |
| February 18, 2009 or later violation of HIPAA administrative simplification provision with reasonable cause and not due to willful neglect | $1,280 min. $63,973 max. $1,919,173 annual cap | $1,379 min. $68,928 max. $2,067,813 annual cap |
| February 18, 2009 or later violation of HIPAA administrative simplification provision due to willful neglect AND corrected during 30-day period | $12,794 min. $63,973 max. $1,919,173 annual cap | $13,785 min. $68,928 max. $2,067,813 annual cap |
| February 18, 2009 or later violation of HIPAA administrative simplification provision due to willful neglect AND corrected during 30-day period | $12,794 min. $63,973 max. $1,919,173 annual cap | $13,785 min. $68,928 max. $2,067,813 annual cap |
| February 18, 2009 or later violation of HIPAA administrative simplification provision due to willful neglect AND NOT corrected during 30-day period | $63,973 min. $1,919,173 max. $1,919,173 annual cap | $68,928 min. $2,067,813 max. $2,067,813 annual cap |
| Failure to provide the Summary of Benefits and Coverage (“SBC”) | $1,264 | $1,362 |
| Penalty for an employer or other entity to offer financial or other incentive to individual entitled to Medicare/Medicaid benefits not to enroll under a group health plan that would be primary | $10,360 | $11,162 |
| Penalty for entity serving as insurer, TPA, or fiduciary for a group health plan that fails to provide information to HHS Secretary identifying when the plan was primary payer to Medicare | $1,325 | $1,428 |
Employer Action
Covered entities (health care plans, health care clearinghouses and health care providers) must ensure proper application and compliance with HIPAA’s Privacy and Security Rules.
Employers should avoid using incentives to discourage Medicare/Medicaid eligible employees from enrolling in the employer’s health plan.
Employers should be aware of the SBC disclosure requirement and ensure employees receive SBCs in a timely fashion (e.g., in connection with open enrollment).
