HHS Announces Final Rule on Civil Monetary Penalties for HIPAA, MSP, and SBC Violations

Effective November 15, 2021, the Department of Health and Human Services (HHS) announced a final rule finalizing the provisions of the September 6, 2016, interim final rule that adjusted the maximum civil monetary penalty (CMP) amounts, for inflation, for all agencies within the Department of Health and Human Services.

These include penalties that apply to violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as well as the Medicare Secondary Payer statute. The latest amounts are based on a cost-of-living increase of 1.01182%.

The following are highlights of the adjustments potentially affecting employer-sponsored health plans:

*HIPAA Administrative Simplification.

HIPAA administrative simplification incorporates standards for privacy, security, breach notification, and electronic health care transactions. There are four tiers of violations for different levels of culpability representing mental states ranging from a lack of knowledge to willful neglect.

Each tier has minimum and maximum penalty amounts and an annual cap on penalties for multiple violations of an identical provision. These indexed penalty amounts for each violation of a HIPAA administrative simplification provision are as follows:

  • Tier 1—lack of knowledge: The minimum penalty is $120 (up from $119); the maximum penalty is $60,226 (up from $59,522); and the calendar-year cap is $1,806,757 (up from $1,785,651).
  • Tier 2—reasonable cause and not willful neglect: The minimum penalty is $1,205 (up from $1,191); the maximum penalty is $60,226 (up from $59,522); and the calendar-year cap is $1,806,757 (up from $1,785,651).
  • Tier 3—willful neglect, corrected within 30 days: The minimum penalty is $12,045 (up from $11,904); the maximum penalty is $60,226 (up from $59,522); and the calendar-year cap is $1,806,757 (up from $1,785,651).
  • Tier 4—willful neglect, not corrected within 30 days: The minimum penalty is $60,226 (up from $59,522); the maximum penalty is $1,806,757 (up from $1,785,651); and the calendar-year cap is $1,806,757 (up from $1,785,651). [EBIA Comment: It is unclear why HHS continues to use the $1,500,000 base for the calendar-year caps for Tiers 1–3 since the enforcement discretion announced in April 2019 significantly reduces the unindexed penalty amounts for those tiers (see our article). Further guidance from HHS would be welcome.]

*Medicare Secondary Payer.

The Medicare Secondary Payer statute prohibits a group health plan from “taking into account” the Medicare entitlement of a current employee or a current employee’s spouse, or family member, and imposes penalties for violations.

The indexed amounts for violations applicable to employer-sponsored health plans are as follows:

  • Violations, related to offering incentives to Medicare-eligible individuals not to enroll in a plan that is otherwise primary, have an indexed amount of $9,753 (up from $9,639).
  • Violations, related to the failure of responsible reporting entities to provide information identifying situations where the group health plan is primary, have an indexed amount of $1,247 (up from $1,232).

*Summary of Benefits and Coverage (SBC).

An insurer must provide an SBC to participants and beneficiaries before enrollment or re-enrollment in a group health plan. The penalty for a health insurer’s or non-federal governmental health plan’s willful failure to provide an SBC is $1,190 (up from $1,176) for each failure.


These adjustments are effective for penalties assessed on or after November 15, 2021, for violations occurring on or after November 2, 2015. The annual adjustments to penalties are designed to preserve their deterrent effect, accounting for the effects of inflation.

Although HHS is required to make “annual” adjustments by January 15th of each year, the agency has made them at irregular intervals. For example, the preceding adjustment happened in January 2020. In effect, HHS missed the January 15, 2021, adjustment.

HBL has experience in all areas of benefits and employment law, offering a comprehensive solution to all your business benefits and HR/employment needs. We help ensure you are in compliance with the complex requirements of ERISA and the IRS code, as well as those laws that impact you and your employees. Together, we reduce your exposure to potential legal or financial penalties. Learn more by calling 470-571-1007.


The following two tabs change content below.

Hall Benefits Law, LLC

HBL offers employers comprehensive legal guidance on benefits in mergers and acquisitions, Employee Stock Ownership Plans (ESOPs), executive compensation, health and welfare benefits, healthcare reform, and retirement plans. We counsel a wide spectrum of clients including small, mid-sized, and large companies, 401(k) investment advisors, health insurance brokers, accountants, attorneys, and HR consultants, just to name a few. HBL is passionate about advising clients, and we are dedicated to our mission: to provide comprehensive, personalized, and practical ERISA and benefits legal solutions that exceed client expectations.

Latest posts by Hall Benefits Law, LLC (see all)

%d bloggers like this: