HHS adjusts 2022 HIPAA, certain ACA and MSP monetary penalties 

Calculator - Teal gradient
March 23, 2022

Group health plan sponsors and other entities that violate the privacy, security, breach notification and electronic healthcare transaction rules of the Health Insurance Portability and Accountability Act (HIPAA) now face higher penalties. Inflation adjustments released by the Department of Health and Human Services (HHS) apply to penalties assessed on or after March 17, 2022, for violations occurring on or after Nov. 2, 2015. These penalty increases come on the heels of the last adjustment for penalties assessed on or after Nov. 15, 2021. The adjusted penalties are calculated by multiplying the previous penalties by 1.06222 (the 2022 cost-of-living multiplier), rounded to the nearest dollar. This article highlights the changes of interest to employers sponsoring group health plans.

HIPAA privacy and security


Minimum penalties.
The minimum penalty for each violation of a particular HIPAA requirement or prohibition increases to $127 (up from $120) for a covered entity or business associate that did not know — and could not have known by exercising reasonable diligence — about the violation. For violations due to reasonable cause and not willful neglect, the minimum penalty increases to $1,280 (up from $1,205). For violations due to willful neglect but corrected within 30 days of when the covered entity or business associate knew — or should have known by exercising reasonable diligence — about the violation, the minimum penalty increases to $12,794 (up from $12,045). For violations due to willful neglect and not corrected within 30 days of when the covered entity or business associate knew — or should have known by exercising reasonable diligence — about the violation, the minimum penalty increases to $63,973 (up from $60,226).
 

Maximum penalties. The maximum penalty for each violation of a particular HIPAA requirement or prohibition (except for violations due to willful neglect and not timely corrected) increases to $63,973 (up from $60,226). For violations due to willful neglect and not timely corrected, the maximum penalty increases to $1,919,173 (up from $1,806,757).
 

Calendar-year penalty caps. The calendar-year penalty cap increases to $1,919,173 (up from $1,806,757) for all violations of an identical HIPAA provision. Curiously, the inflation adjustments still do not incorporate the enforcement discretion HHS announced in April 2019, which significantly reduced calendar-year penalty caps for most HIPAA violations except for those due to willful neglect and not timely corrected. Clarification of this issue would be helpful. Here are the penalty caps under the enforcement discretion:

Culpability

Annual limit (amounts do not reflect indexing)

No knowledge

$25,000

Reasonable cause

100,000

Willful neglect — corrected

250,000

Willful neglect — not corrected

1,500,000

 

Affordable Care Act

Though HHS rules directly impact health insurance issuers, employer plan sponsors may be indirectly affected by certain requirements:

  • Summary of benefits and coverage (SBC). The maximum penalty for each failure by a health insurance issuer to provide SBCs to covered individuals increases to $1,264 (up from $1,190).

  • Medical loss ratio (MLR) rules. The maximum penalty for each failure by a health insurance issuer to comply with MLR reporting and rebate regulations increases to $126 (up from $119).

Medicare secondary payer (MSP) rules

Penalties for violations of certain MSP rules increase as follows:

  • Prohibition against financial or other incentives. The maximum penalty for each eligible individual offered financial or other incentives not to enroll in a group health plan that would be primary to Medicare increases to $10,360 (up from $9,753).

  • Nondisclosure. For each failure by an insurer, a third-party administrator or a self-insured/self-administered group health plan's fiduciary to inform HHS about situations in which the plan is or was primary to Medicare, the maximum daily penalty increases to $1,325 (up from $1,247).

Related resources

About the author(s)
Related insights