Penalties for HIPAA violations are tiered based on the level of negligence and can range from $100 to $50,000 per violation, with a maximum annual penalty of $1.5 million. Violations can also lead to criminal charges, with fines up to $250,000 and imprisonment for up to 10 years.