When the breach hits,
the lawsuit follows.

Following the January 28, 2026 inflation adjustment published by HHS, the maximum civil monetary penalty per HIPAA violation is $2,190,294 (Tier 4 — willful neglect not corrected). For Tiers 1-3, the maximum per-violation amount is $73,011. The official annual cap per identical provision is also $2,190,294.

The OCR continues to apply lower discretionary caps under its 2019 Notice of Enforcement Discretion — but those caps are not legally binding and can be rescinded at any time. State attorneys general can pursue separate actions under HIPAA and state privacy laws, stacking exposure beyond the federal ceiling.

Under the HIPAA Breach Notification Rule, covered entities must notify affected individuals no later than 60 days after discovery of a breach. Breaches affecting 500 or more individuals must be reported to HHS within the same 60-day window and disclosed to prominent media outlets in the affected jurisdiction.

Smaller breaches (under 500 individuals) must be logged and reported to HHS annually. State-level breach-notification laws — including California's CMIA — often impose shorter or parallel timelines and may apply alongside federal requirements. Organizations operating in multiple states face a stacked notification matrix that's nearly impossible to manage without a pre-built playbook.

HIPAA Security Rule compliance is a federal legal obligation. Every covered entity and business associate must implement the Rule's administrative, physical, and technical safeguards. Failure to comply is a regulatory violation enforceable by OCR.

HITRUST CSF is a private-sector certification framework that maps to HIPAA and dozens of other standards (NIST, ISO 27001, PCI DSS) and provides a third-party assurance report. HIPAA is required. HITRUST is increasingly required by hospital systems, payers, and large enterprises before they will sign a Business Associate Agreement.

Many WatchUr6 healthcare clients pursue HITRUST certification specifically to unlock business with larger healthcare partners that won't sign a BAA without it.

Healthcare directors and officers face escalating personal-liability exposure under the Caremark duty-of-oversight doctrine, which holds that boards must implement reasonable information systems to detect and respond to mission-critical risks — including cybersecurity.

Recent Delaware Court of Chancery decisions have allowed Caremark-based shareholder derivative suits to proceed against directors who failed to oversee cyber risk. Parallel exposure exists in class-action data-breach litigation, where plaintiffs increasingly seek to pierce D&O insurance limits.

Documenting reasonable care — risk analyses, written policies, board-level cybersecurity reporting, vendor risk management — is the single most important defense.

WatchUr6 serves the full healthcare market:

Hospitals and health systems — enterprise-scale engagements with multi-facility coordination.

Multi-location specialty practices — dental, ophthalmology, dermatology, behavioral health, and others operating across multiple sites with shared PHI infrastructure.

Ambulatory surgery centers — facilities subject to Medicare Conditions for Coverage and concentrated regulatory risk.

Healthcare-adjacent organizations — billing companies, revenue-cycle-management firms, third-party administrators, EHR vendors, and other Business Associates that inherit full HIPAA exposure through BAAs.

The regulatory framework applies regardless of size, and so does our methodology.

In the first five months of 2025, OCR announced ten HIPAA resolution agreements — and every single one cited the organization's failure to conduct a "compliant risk analysis" under the HIPAA Security Rule. Penalties ranged from $25,000 to $3 million.

OCR has formally designated risk analysis as an enforcement initiative, and the agency has signaled that risk management — the operational follow-through to risk analysis — will join the initiative in 2026.

Healthcare organizations without a current, documented Security Rule risk analysis are now the highest-likelihood OCR targets. If you don't know when your last risk analysis was performed — or whether it would survive an OCR review — that's the first conversation we'd have.