Each year, HHS publishes indexing for penalties and non-grandfathered out-of-pocket (OOP) maximums. The newest numbers published provide:
For 2026:
- Increased HIPAA penalties ranging from $145 to $73,011; to a calendar year cap of $2,190,294
- $1,443 per failure to provide a Summary of Benefits and Coverage (SBC)
- $11,823 per failure to comply with Medicare Secondary Payer rules
For 2027:
- Non-grandfathered in-network OOP limits increase to $12,000 per person, $24,000 per family, which are up from $10,600/$21,200 in 2026
- §4980H(a) penalty of $3,780 ($315.00/month), up from $3,340 ($278.33/month) in 2026
- §4980H(b) penalty of $5,670 ($472.50/month), up from $5,010 ($417.50/month) in 2026
Who this applies to:
- Employers of all sizes may be subject to potential penalties for HIPAA, SBC, MSP, and OOP violations.
- §4980H penalties apply to Applicable Large Employers (ALEs), which are those averaging 50 or more full-time and equivalent employees the previous calendar year, including rules that require combining counts within a Controlled Group or Affiliated Service Group of employers under common ownership or control.
Compliance update brought to you by Benefit Compliance Solutions (BCS) in partnership with Nava Benefits. The information contained in this update, including any attachments, is presented solely in the capacity of Nava as compliance consultants. Nothing contained herein should be construed as tax or legal advice or opinion or used as a substitute for consultation with professional legal counsel. Nava is not authorized to practice law, is not an attorney or law firm, and is not rendering legal advice. Communications with Nava are not subject to attorney-client privilege.