HHS Federal Register notice October 21, 2026; Becker's Hospital Review report October 23, 2026
HHS Freezes HIPAA Penalties at 2025 Levels for 2026, Because the Shutdown Erased the Inflation Data
The Department of Health and Human Services will keep HIPAA civil monetary penalties at 2025 levels and skip the annual inflation adjustment for 2026, the department said in an October 21 Federal Register notice, Becker's Hospital Review reported on October 23. The reason is mechanical rather than a policy change in enforcement posture: the adjustment is calculated from October consumer price index data, and the Bureau of Labor Statistics did not produce October 2025 data during the federal government shutdown and lapse in appropriations from October 1 to November 12, 2025, so no 2026 multiplier exists. The Office of Management and Budget canceled the 2026 adjustments for federal agencies in an April 17 memo, which the HHS notice cites. For HIPAA, the top penalty stays at about 2.2 million dollars per violation for willful neglect not corrected within 30 days, an amount that is also the calendar-year cap for violations of an identical provision, while per-violation minimums range from 145 dollars for a violation an organization did not know about to 73,011 dollars for uncorrected willful neglect, and lower annual caps apply to less serious violations under a 2019 enforcement policy. The freeze covers other HHS civil monetary penalties as well, including the Office of Inspector General information blocking penalty, which stays at 1.3 million dollars per violation for health IT developers and health information exchanges and networks. HHS last raised its penalties in a January 28 final rule that increased them about 2.6 percent based on October 2024 data, and the current HIPAA ceiling sits about 46 percent above the 1.5 million dollar cap set under the 2009 HITECH Act.
Executives
A freeze is not a discount and not a signal about enforcement appetite: every penalty amount your risk models already carry stays exactly in force, and the Office for Civil Rights continues to settle cases at these levels. The accurate board summary is that one line in the financial exposure table does not move this year, for an administrative reason that has nothing to do with healthcare policy.
CIO / CISO
Update the numbers wherever they are recorded: compliance registers, board reporting, and cyber insurance submissions that assumed a 2026 inflation uplift should cite the October 21 notice and hold the 2025 figures, including the 145 dollar to 73,011 dollar per-violation minimum range and the roughly 2.2 million dollar top figure. Keep the distinction clear in those records between the per-violation maximum and the calendar-year cap for identical violations, because the two are routinely conflated.
Engineers
Nothing technical changes, and that is the point worth recording: safeguard requirements, breach notification clocks, and the evidence your systems must produce are untouched by a penalty arithmetic freeze. If your compliance tooling auto-updates penalty tables from a feed, verify it has not applied a phantom 2026 increase, so internal reporting matches the notice.
Everyone (non-IT)
If you work with patient information, your daily duties are unchanged: handle records the same way, report suspected incidents the same way, on the same timelines. This story is about the size of fines on paper, not about any rule being relaxed.