Jan 23, 2022 · Penalties for HIPAA violations can be issued by Office for Civil Rights and state attorneys general. The maximum fine that can be issued by the Office for Civil Rights is $1.5 million per violation per year, but Covered Entities may also be subject to criminal or civil lawsuits depending on the nature of the violation..