The annual penalty limit is “per violation”. Consequently, if a covered entity or business associate has failed to comply with multiple HIPAA standards (i.e., failure to train, failure to conduct a risk assessment, failure to implement safeguards, etc.), multiple fines could be imposed by the HHS´ Office for Civil Rights. However, this is a rare occurrence that only impacts the worst offenders. Most investigations into violations of the HIPAA privacy guidelines result in smaller financial penalties, technical assistance, and/or corrective action plans.