Quick answer
The fine is the headline, but for a small Texas practice it is usually the smallest of five costs. A breach triggers federal penalties (from $145 up to $2,190,294 per violation category in 2026), a two-to-three-year corrective action plan that consumes the owner’s attention, a separate Texas HB 300 exposure up to $1.5 million per violation category enforced by the state Attorney General, breach notification duties on a 60-day federal clock, and, for the unlucky, a cyber insurance claim denied over an inaccurate attestation. The prevention document that heads most of this off costs $3,500 to $4,500 once.
Practice owners ask what a breach would “cost them” and mentally picture a fine. Here is the honest ledger, in the order the bills arrive.
What does OCR actually charge a small practice?
Less than you fear on the fine, more than you expect everywhere else. The 2026 penalty schedule under Federal Register 2026-01688 runs from $145 per violation at the lowest culpability tier to a $2,190,294 annual cap per violation category, with willful neglect starting at $73,011 per violation. But most small-practice cases resolve by settlement, and the recent record shows the real range: $5,000 (Vision Upright MRI), $10,000 (a Dallas dental practice, over Yelp replies), $25,000 (Comprehensive Neurology, a small New York practice, after ransomware), $90,000 (a county ambulance service, the first Risk Analysis Initiative action), up to $350,000 (Northeast Radiology) and $450,000 (an employer health plan this June).
Notice what nearly every one has in common: OCR cited the missing or inadequate risk analysis, the gap that shows up in roughly 90 percent of its Security Rule enforcement actions.
The corrective action plan is the real sentence
Settlement announcements bury the expensive part in one sentence: “and agreed to a corrective action plan.” A CAP is two to three years of OCR-monitored homework: perform a compliant risk analysis, rewrite policies, retrain and document every workforce member, and report to the government on a schedule. There is no invoice for it, because you pay in the owner’s hours, month after month, with a federal agency reading your submissions. Ask any practice that has lived through one: they describe the CAP, not the check, as the punishment.
Texas sends its own bill
Federal HIPAA is the floor. The Texas Medical Records Privacy Act (HB 300) authorizes state penalties up to $1.5 million per violation category per year, enforced by the Texas Attorney General on a separate track from OCR. Texas also defines covered entity more broadly than federal law, so arrangements that escape HIPAA often do not escape Austin. For a Texas practice, every breach is potentially a two-regulator event, and the state has been the more aggressive mover on medical privacy in recent years.
The clock and the insurance trap
Two more costs arrive uninvited. First, the Breach Notification Rule at 45 CFR 164.400-414 puts you on a 60-day federal clock to notify affected patients, and OCR, for breaches of 500 or more, with local media notice on top. Notification is logistics and money: identifying every affected patient, mailing letters, staffing the phone calls that follow.
Second, the policy you bought for exactly this moment gets stress-tested. Carriers investigate claims against the security attestations on your application, and inaccurate answers void coverage: in the Travelers rescission case, a company that attested to multi-factor authentication it had only partially deployed lost its entire policy after the breach, and with it every dollar of response coverage. Your insurance is only as good as your documentation, and the document that makes your attestations verifiable is the same risk analysis OCR asks for. We covered that collision in how cyber insurance and HIPAA connect now.
What does a breach cost beyond the government?
The line items no settlement announcement mentions are the ones owners describe as the worst part. Every affected patient gets a letter explaining that their information, in a practice built on discretion, got out. Some of them call, and your front desk becomes a breach hotline for weeks while still running the schedule. Some of them leave, and in a referral-driven specialty the quiet damage compounds: the orthodontist who refers to you reads the same local coverage your patients do, because breaches of 500 or more require notifying prominent media in your market. None of this appears on an invoice, all of it costs money, and it keeps costing after the government file closes.
There is also the deal you might not know you are losing. Buyers and private-equity groups run privacy diligence on practices they acquire, and an unresolved breach or an open corrective action plan reads as a contingent liability of unknowable size. We watched the opposite happen at a client: clean risk-analysis documentation carried a med spa through PE diligence in days. A breach record does the reverse, at exactly the moment a practice owner is trying to convert decades of work into a retirement.
So what is the honest total?
For a small Texas practice, a realistic bad-but-survivable breach looks like: a settlement in the five to low six figures, a two-to-three-year CAP consuming hundreds of owner-hours, notification costs scaling with your patient count, possible state exposure, and higher insurance premiums, or no insurance at all if the attestation fails. Against that ledger, the prevention side is almost embarrassing: a documented HIPAA Risk Analysis at $3,500 to $4,500 flat, or a $750 Privacy Exposure Review to find out this week where you actually stand. You can also run our free instant privacy check right now and see three of your risk signals in about a minute.
The practices that end up in OCR’s press releases did not plan to be there. They just never put the first document in place. The math has never been closer to a coin flip than it is to a gamble worth taking.
Last Updated: July 7, 2026