There are four tiers of increasing penalty amounts that correspond to the levels of culpability associated with the HIPAA violation:
- (lowest category) Situations where the covered entity or business associate did not know, and by exercising reasonable diligence would not have known of a violation
- Violations due to reasonable cause and not to willful neglect
- Violations due to willful neglect corrected within a certain time period
- (highest category) Violations due to willful neglect that are not corrected
