Penalties for Michigan HIPAA violations follow the federal tier structure enforced by the U.S. Department of Health and Human Services, with 2026 civil fines ranging from $145 per violation for unknowing infractions up to $2,190,294 per calendar year for uncorrected willful neglect. Criminal violations can bring fines as high as $250,000 and up to ten years in federal prison. Michigan providers face enforcement from both federal regulators and the state Attorney General, and Michigan has its own privacy statutes that can add liability on top of the federal exposure.
The Four Civil Penalty Tiers for 2026
The HHS Office for Civil Rights (OCR) sets civil monetary penalties based on the entity’s level of culpability. For violations assessed on or after January 28, 2026, the tiers are:1GovInfo. Federal Register Volume 91 Issue 18 – Civil Monetary Penalty Inflation Adjustments
- Tier 1, did not know: the entity was unaware and could not reasonably have discovered the violation. Minimum $145, maximum $73,011 per violation.
- Tier 2, reasonable cause: the violation had a reasonable cause and was not due to willful neglect. Minimum $1,461, maximum $73,011 per violation.
- Tier 3, willful neglect corrected: the entity acted with willful neglect but corrected the problem within 30 days. Minimum $14,602, maximum $73,011 per violation.
- Tier 4, willful neglect not corrected: willful neglect with no timely correction. Minimum $73,011, maximum $2,190,294 per violation.
All four tiers share the same annual cap of $2,190,294 for repeated violations of the same HIPAA provision during a calendar year.1GovInfo. Federal Register Volume 91 Issue 18 – Civil Monetary Penalty Inflation Adjustments The base amounts come from federal statute; HHS adjusts them for inflation each year.2Office of the Law Revision Counsel. 42 USC 1320d-5 – General Penalty for Failure to Comply
One detail matters more than the dollar figures: OCR counts each affected patient record as a separate violation. A breach exposing 5,000 records could theoretically generate penalties in the hundreds of millions before the annual cap applies. Actual OCR settlements usually land between tens of thousands and a few million dollars, but the statutory exposure is enormous.
Criminal Penalties Under 42 U.S.C. ยง 1320d-6
When conduct crosses from negligence into intentional misconduct, the Department of Justice can bring federal criminal charges. These penalties reach any person, not just organizations, so individual employees, executives, and IT administrators can be prosecuted personally. The three tiers escalate with intent:3GovInfo. 42 USC 1320d-6 – Wrongful Disclosure of Individually Identifiable Health Information
- Knowingly obtaining or disclosing PHI in violation of HIPAA: up to $50,000 in fines and one year in prison.
- Committing the offense under false pretenses: up to $100,000 in fines and five years in prison.
- Intent to sell, transfer, or use PHI for commercial advantage, personal gain, or malicious harm: up to $250,000 in fines and ten years in prison.
The classic case is a hospital employee who looks up a celebrity’s or ex-partner’s records and shares what they found. Even without money changing hands, that unauthorized snooping can land the individual in federal court. An organization’s compliance program does not shield a rogue employee from personal criminal liability.
Who Enforces HIPAA Against Michigan Entities
The HHS Office for Civil Rights
OCR is the primary HIPAA enforcement body. It investigates complaints filed by individuals, conducts compliance reviews, and can impose civil monetary penalties or negotiate resolution agreements that typically include multi-year corrective action plans. Most investigations end with technical assistance or voluntary compliance rather than fines, though OCR has increasingly pursued monetary penalties for repeat violations and cases involving willful neglect.
The Michigan Attorney General
The HITECH Act gave every state attorney general the power to bring civil actions in federal court on behalf of state residents harmed by HIPAA violations. The Michigan Attorney General can seek injunctions to stop ongoing violations and recover damages for affected residents. Before filing, the AG must notify HHS at least 48 hours in advance, though emergency situations requiring immediate injunctive relief are exempt from that notice.4HHS.gov. State Attorneys General A single breach can therefore draw enforcement from two independent directions.
Patients Cannot Sue Under HIPAA
Federal courts across multiple circuits have consistently held that HIPAA does not create a private right of action. A patient whose records were improperly disclosed cannot file a HIPAA lawsuit against the provider. Patients can file complaints with OCR or the Michigan Attorney General, and they may pursue separate state-law claims such as negligence, breach of contract, or invasion of privacy that arise from the same facts. The enforcement mechanism for patients is the complaint process, not the courthouse.
Reducing or Avoiding a Penalty
HIPAA’s penalty structure includes a specific affirmative defense. OCR cannot impose a civil monetary penalty if the covered entity or business associate demonstrates that the violation was not caused by willful neglect and was corrected within 30 days of when the entity knew or should have known about it.5eCFR. 45 CFR 160.410 – Affirmative Defenses The Secretary of HHS can extend that correction window based on the nature and complexity of the problem. This is the single most valuable protection available, and it rewards organizations that detect and fix issues quickly.
Outside of the formal defense, OCR weighs several factors when setting penalty amounts: compliance history, financial condition, the seriousness of the violation, and cooperation with the investigation. An organization with a documented risk assessment, current workforce training, and prompt corrective action after a breach will fare much better than one that ignored security until something went wrong. In practice, OCR often enters resolution agreements where the entity pays a reduced settlement and commits to a corrective action plan rather than facing the full statutory penalty.
Breach Reporting Failures Are Their Own Violation
Missing a breach notification deadline can turn a manageable incident into a formal investigation. When a breach of unsecured PHI occurs, a covered entity must notify each affected individual within 60 calendar days of discovery. The notice must be in plain language and describe what happened, the types of information exposed, protective steps the individual should take, what the entity is doing to investigate and prevent recurrence, and contact information including a toll-free phone number.6eCFR. 45 CFR 164.404 – Notification to Individuals
If 500 or more individuals are affected, the entity must also notify HHS and prominent media outlets serving the area within that same 60-day window. Those large breaches are posted on OCR’s public breach portal, where they remain searchable indefinitely.7U.S. Department of Health and Human Services. Breach Notification Rule For breaches affecting fewer than 500 people, the entity must log each incident and submit an annual report to HHS no later than 60 days after the end of the calendar year.
Michigan Laws That Stack on Top of HIPAA
Michigan has its own privacy statutes that apply alongside federal HIPAA, meaning the same conduct can violate both regimes.
Medical Records Access Act
Michigan’s Medical Records Access Act gives patients the right to examine or obtain copies of their medical records. A provider must respond within 30 days of a request, or 60 days if the records are stored off-site. One additional 30-day extension is allowed if the provider sends written notice explaining the delay during the original response period.8Michigan Legislature. Michigan Compiled Laws 333.26265 Copying fees are capped and adjust annually. For 2026, providers may charge up to $1.60 per page for the first 20 pages, $0.80 per page for pages 21 through 50, and $0.32 per page beyond that. Patients requesting their own records cannot be charged the $32.08 initial handling fee that applies to other requesters.9State of Michigan. Medical Records Access Act Fees Missing these timeframes can generate complaints to both state regulators and HHS, since HIPAA’s right of access provisions overlap with the state law.
Identity Theft Protection Act
Michigan’s Identity Theft Protection Act (Act 452 of 2004) requires any entity that owns or licenses data containing personal information to notify affected individuals if a security breach occurs. The Act also requires proper destruction of records containing personal information when disposing of them, and violations of the destruction requirement are a misdemeanor. A single data breach can therefore trigger notification duties under both this Act and the federal Breach Notification Rule.
Who Is Actually on the Hook
HIPAA’s penalty regime applies to “covered entities” (health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically for covered transactions like billing) and to their “business associates.”10eCFR. 45 CFR 160.103 – Definitions Since the HITECH Act, business associates including billing companies, IT vendors, cloud storage providers, and law firms with regular PHI access face direct HIPAA liability, not just contractual liability through their agreements with covered entities.11U.S. Department of Health and Human Services. Business Associate Contracts A Michigan practice that never files electronic claims falls outside HIPAA entirely, though virtually every provider today files electronically.
Why the True Cost Runs Higher Than the Penalty
HIPAA penalties are not tax-deductible. Federal law generally prohibits deducting any amount paid to a government entity in connection with a legal violation.12Office of the Law Revision Counsel. 26 USC 162 – Trade or Business Expenses A narrow exception exists for payments that constitute restitution or amounts spent to come into compliance, but only if the settlement or court order specifically identifies the payment that way. Civil monetary penalties and criminal fines themselves are paid with after-tax dollars, which pushes the true cost of an enforcement action well above the headline number.