The maximum penalty for violating HIPAA is currently $1,919,173 (September 2022). However, this figure represents the maximum penalty per violation type, and Covered Entities and Business Associates found guilty of multiple violations can expect to pay much more.

When Congress passed HIPAA in 1996, it set the maximum penalty for violating HIPAA at $100 per violation with an annual cap of $25,000. These limits were applied when the Department of Health & Human Services (HHS) published the Enforcement Rule in 2006 and they stayed in force until the publication of the Final Omnibus Rule in 2013.

Among other changes to HIPAA, the Final Omnibus Rule introduced amendments to the Enforcement Rule attributable to passage of the HITECH Act in 2009. The HITECH Act mandated a four tier penalty structure for HIPAA violations and new minimum and maximum penalties for violating HIPAA. The four tiers were based on the level of culpability associated with the violation:

Tier 1 – Lack of Knowledge:  The person did not know (and, by exercising reasonable diligence, would not have known) that the event was a violation of HIPAA.

Tier 2 – Lack of Oversight: The violation was due to reasonable cause and not willful neglect to comply with the HIPAA regulations.

Tier 3 – Willful Neglect: The violation was due to the willful neglect of the Covered Entity or Business Associate but corrected within 30 days of discovery.

Tier 4 – Willful Neglect, Not Corrected: The violation was due to the willful neglect of the Covered Entity or Business Associate but not corrected within 30 days of discovery.

The Penalties for Violating HIPAA Change after Review

Originally, due to “inconsistent language” of the HITECH Act, HHS interpreted the new Enforcement Rule penalty structure as follows:

However, following a review of the penalty tiers by HHS´ Office of General Counsel, the annual caps were amended in 2019 to align with those mandated by HITECH.

This resulted in the annual limit for a Tier 1 violation being less than the maximum penalty for violating HIPAA in Tier 1 – a situation that has continued as the penalties for violating HIPAA have been adjusted to account for inflation. Additionally, the maximum penalty for violating HIPAA in Tier 4 has also been increased. The current (September 2022) penalties for violating HIPAA are:

The Maximum Penalty for Violating HIPAA is per Violation Type

It is important for Covered Entities and Business Associates to be aware that the maximum penalty for violating HIPAA is per violation type. This mean that (for example), if a Covered Entity fails to conduct a risk assessment, fails to implement measures to prevent a foreseeable breach, and fails to notify patients when a breach occurs, the Covered Entity could be issued the maximum penalty for violating HIPAA three times over.

It is also important to be aware that State Attorneys General have the authority to impose civil money penalties on Covered Entities and Business Associates found to have violated HIPPA. Consequently, what a Covered Entity or Business Associate pays in penalties to HHS´ Office for Civil Rights may be substantially increased – as Anthem Inc. found out following a breach of 78.8 million records in 2015.

In addition to reaching a $16 million settlement with HHS´ Office for Civil Rights, Anthem Inc. was also fined $48.2 million by State Attorneys General in two separate cases. Additionally, a class action was brought against Anthem Inc. by individuals whose data was breached – resulting in a further $115 million settlement. Consequently, if found guilty of a HIPAA violation, the maximum penalty for violating HIPAA could be much more then the figures published annually in the Federal Register.

The post What is the Maximum Penalty for Violating HIPAA? appeared first on HIPAA Journal.

In answer to the question can medical records be subpoenaed; the answer is yes because every type of record can be subpoenaed. Possibly a more relevant question would be “how should healthcare providers respond to a subpoena for medical records”?

In most states, there are three types of subpoenas – a “witness subpoena” that requires an entity to appear in court to give evidence, a “deposition subpoena” that requires an entity to provide copies of records and/or attend a deposition hearing, and a “subpoena duces tecum” that requires an entity to provide copies of records and/or attend a court hearing.

All three types of subpoenas can be used to subpoena medical records or require a healthcare provider to answer questions/testify about a medical record. Although are not exclusive to any particular type of case, a witness subpoena will most likely be used in a legal action where both a patient and a healthcare provider are the parties in a case (i.e., a medical negligence claim).

The other two types of subpoenas will most commonly involve cases in which the healthcare provider is not a party in a civil or criminal action (i.e., an injury compensation claim), but the patient´s medical records are required to support discovery and/or resolve the action. In such cases, it is important to be aware can medical records be subpoenaed in compliance with HIPAA.

What HIPAA Says about Medical Records being Subpoenaed

The relevant parts of HIPAA relating to medical records being subpoenaed can be found in §164.512 of the Privacy Rule – “[Permissible] uses and disclosures for which an authorization [from the patient] or opportunity to agree or object is not required” – specifically the section relating to disclosures for judicial and administrative proceedings (Section C). This section states that healthcare providers can disclose PHI in response to a subpoena provided that:

• Only PHI expressly requested by the subpoena is disclosed and de-identified information could not reasonably have been used.
• The information requested is relevant to a legitimate proceeding and the request is specific and limited in scope.
• The subject of the PHI has been informed about the subpoena or reasonable efforts have been made to notify the individual.
• An objection has not been filed by the subject of the PHI and the time to file an objection has elapsed.
• Any PHI disclosed in response to a subpoena is not used for any purpose other than the purpose for which it was requested.
• The party seeking the disclosure has put in place or requested a protective order to prevent further disclosures.
• Any PHI disclosed in response to the subpoena for medical records will be returned or disposed of at the end of the proceedings for which they were requested.

It is important to be aware that the provisions of Section C do not supersede other provisions of the Privacy Rule. Consequently, it is still necessary to obtain an authorization before disclosing psychotherapy notes or substance abuse disorder medical records, the Minimum Necessary Standard still applies, and Covered Entities have to comply with the provisions of any state laws that pre-empt HIPAA when more stringent privacy protections exist.

Responding to a Subpoena for Medical Records

There are different ways to respond to a subpoena for medical records depending on the type of subpoena (witness, deposition, or duces tecum) and the subpoena issuer. It is important to respond correctly when medical records are subpoenaed because incorrect responses can result in HIPAA violations. For this reason, healthcare providers and administrators should obtain legal advice to find out can medical records be subpoenaed in the specific circumstances of each subpoena.

The significance of the subpoena issuer is that it is not possible to object to a court order, a subpoena signed by a judge, magistrate, or administrative tribunal, or a grand jury subpoena. In such cases, it is necessary to comply with the subpoena for medical records and respond by disclosing the PHI expressly requested by the subpoena – notwithstanding that the content of the subpoena should cover the Privacy Rule provisions listed above (i.e., return or disposal of PHI, etc.).

If a subpoena is signed by a court clerk or attorney, additional assurances may be required by HIPAA. For example, a subpoena requesting medical records relating to substance abuse disorder medical records is invalid unless it is accompanied by a signed court order authorizing the disclosure. Similarly, if patient authorization is required to respond to a subpoena, healthcare providers should use their own authorization form rather than a waiver sent with the subpoena by an attorney.

Objecting to a Subpoena for Medical Records

Healthcare providers can object to a subpoena for medical records when it has been signed by a court clerk or attorney for a variety of reasons. These include (but are not limited to):

• The subpoena does not allow the healthcare provider sufficient time to collate the information requested.
• The subpoena requires the disclosure of PHI requiring an authorization and it has not been possible to obtain an authorization from the patient.
• The subpoena imposes an undue burden on the healthcare provider – typically when the PHI of multiple patients is requested for a class action.
• The subpoena is unreasonable or oppressive, or it is procedurally defective (i.e., no protective order has been requested to prevent further disclosures).

Usually there is a time period for filing an objection to a subpoena, and this can vary according to where the subpoena is issued. Similarly, there may be other reasons for objecting to a subpoena for medical records depending on state law. Consequently, expert and specialist legal advice is needed for the specific circumstances of each subpoena, and healthcare providers and administrators should always obtain legal advice before responding to a subpoena for medical records.

Can Medical Records be Subpoenaed? FAQs

Can courts subpoena medical records?

Yes, but as mentioned above, it is important to establish whether a court-issued subpoena is signed by a judge or a court clerk on behalf of an attorney as this affects the right to object to a subpoena for medical records.

Can an attorney subpoena medical records?

In most states, an attorney can subpoena medical records. However, in some states medical records obtained by an attorney via a deposition subpoena can only be used during the discovery process and are not admissible as evidence in court (also see the next FAQ).

Can a judge subpoena medical records?

Judges can subpoena medical records at any stage of proceedings. They can also subpoena medical records previously subpoenaed by an attorney if the medical records have been obtained via a deposition subpoena and are not admissible in court.

How far back can medical records be subpoenaed?

This depends on the purpose of the subpoena and the state in which the subpoena was issued. This is because statutes of limitations exist on certain legal proceedings (i.e., you cannot file a personal injury claim after x years), and because state-mandated retention periods differ from state-to-state.

What is a subpoena duces tecum for healthcare records?

A subpoena duces tecum for healthcare records is a court order requiring a healthcare provider to produce the requested medical records at a deposition or court hearing. Usually, the court order allows the healthcare provider to produce the medical records remotely without an in-person appearance being necessary.

The post Can Medical Records be Subpoenaed? appeared first on HIPAA Journal.

One of the capabilities of many business password managers is the ability to send encrypted messages to any recipient. Often this capability is used to securely share login credentials or other confidential data. But is it okay to share ePHI via a business password manager?

Over the past few years, the capabilities of business password managers – particularly vault-based password managers – have grown significantly. For example, whereas SSO integration was once big news, these days we are talking more about password-less logins and it has been estimated that biometric facial recognition hardware will be present in 90% of smartphones by 2024.

With regards to the ability to send encrypted messages, this first started as a means of sending passwords to users in the same business subscription. It evolved into sending notes, files, and other data to users in the same business subscription, and then further evolved to sending encrypted messages of any kind to any recipient regardless of whether they are using a password manager.

Why Share ePHI via a Business Password Manager?

There are many circumstances when healthcare providers or other members of a Covered Entity´s workforce need to send or request ePHI to or from a colleague or Business Associate. In many cases, the colleague or Business Associate may not be in the same communications network – raising the issue of how to transmit ePHI securely in compliance with the HIPAA Security Rule.

The most common forms of communication – such as SMS, IM, email, etc. – are not suitable because they lack the necessary features to fulfil the requirements of the Technical Safeguards – for example, access controls, automatic logoff, encryption, audit controls, etc. However, most business password managers do have the necessary features to send and receive ePHI compliantly.

These features enable users to share ePHI via a business password manager securely without risking an impermissible disclosure of ePHI and facilitate “the flow of health information needed to provide and promote high-quality healthcare” – a major goal of the HIPAA Privacy Rule. However, in order to share ePHI via a business password manager in full compliance with HIPAA, the vendor of the password manager must sign a Business Associate Agreement. Not all are willing to do so.

Is a Business Associate Agreement Necessary?

In 2016, the Department of Health & Human Services (HHS) published an FAQ regarding whether or not a Cloud Service Provider is excluded from the definition of a Business Associate if the Cloud Service Provider cannot access ePHI stored in the cloud because it is encrypted and the Cloud Service Provider does not have the decryption key.

The answer was that a Cloud Service Provider is not excluded under the “conduit exception rule” because conduits such as the U.S. Postal Service, Fed-Ex, and DHL are transmission services and the temporary storage of PHI while it is in the conduit´s possession is incident to the transmission, while the temporary storage of ePHI with a Cloud Service Provider is persistent.

HHS stated in the FAQ that “a Cloud Service Provider that maintains ePHI for the purpose of storing it will qualify as a Business Associate […] even if the Cloud Service Provider does not actually view the information”. Substitute password manager vendors for Cloud Service Providers, and it is clear a Business Associate Agreement is necessary to share ePHI via a business password manager.

Which Vendors will Sign a Business Associate Agreement?

Not many, despite claiming to have HIPAA-compliant password managers. 1Password and Keeper – the two most popular password managers in the U.S. – both state they do not qualify as Business Associates because of their zero knowledge architectures (which is incorrect). LastPass and NordPass have such incorrect information about HIPAA on their websites that we strongly suspect they don´t understand a Business Associate Agreement is necessary. Most others keep quiet about the issue.

Among those that do publicly state they are willing to sign a Business Associate Agreement, Bitwarden and Zoho Vault are the most well-known. Of the two, Zoho Vault is the most feature-rich; but at nearly 50% more expensive per user than Bitwarden, Zoho Vault could work out to be unnecessarily expensive if you are not going to use all the features you are paying for. Additionally, Bitwarden passed a HIPAA Security Rule Assessment Report conducted by AuditOne in 2020.

In conclusion, it is okay to share ePHI via a business password manager, provided that the password manager has been configured to comply with the Technical Safeguards of the Security Rule and the vendor of the password manager has signed a Business Associate Agreement. If the vendor is unwilling to sign a Business Associate Agreement, it is not possible to share ePHI via a business password manager without violating HIPAA.

The post Is it Okay to Share ePHI via a Business Password Manager? appeared first on HIPAA Journal.

What happens after a HIPAA complaint is filed can vary according to who it is filed with, whether or not the complaint is justified, and the nature of the complaint.

When you register with a healthcare provider or become a member of a group health plan, you are given a Notice of Privacy Practices. The Notice of Privacy Practices explains how the healthcare provider or health plan can use or disclose your health information and also what rights you have to restrict specific uses and disclosures and request a copy of any health information held about you.

The Notice of Privacy Practices should also provide details of who you can complain to if you think a healthcare provider or health plan has used or disclosed your health information impermissibly, or if your rights have been violated. Usually, the contact details are those of the organization´s Privacy Office and the Department of Health & Human Services´ Office for Civil Rights.

It is also possible to file a complaint with your State Attorney General. However, the majority of states require that you complain to the organization before filing a complaint with the State Attorney General. For this reason, it is important to keep copies of any correspondence between you and the organization, and records of who you spoke with and when if complaining by phone.

What Happens after a HIPAA Complaint is Filed with an Organization?

There is no HIPAA-mandated process for what happens after a HIPAA complaint is filed with a healthcare provider or health plan, so the process is likely to vary from organization to organization. However, the Privacy Rule states that all complaints have to be documented, so the first thing that will happen is that you will receive an acknowledgement of your complaint.

Healthcare providers and health plans are aware that if they do not respond to your complaint satisfactorily and in a timely manner, you have the right to escalate the complaint to HHS´ Office for Civil Rights or your State Attorney General. Therefore, as regulatory investigations can be disruptive and attract indirect costs, your complaint will be reviewed as a matter of priority.

If the review identifies a potential HIPAA violation, it will be investigated further. An investigation can result in several outcomes.

• If no violation is identified, you should receive a communication explaining why.
• If a minor violation is identified, the organization will likely take steps to rectify it.
• If a more serious violation is identified, the organization may escalate your complaint to HHS´ Office for Civil Rights for technical assistance or to report a data breach.

If you are dissatisfied with the response from your healthcare provider or health plan – or you fail to hear from them in a timely manner – you can escalate the complaint to HHS´ Office for Civil Rights or your State Attorney General. Unlike complaining to a State Attorney General, HHS´ Office for Civil Rights does not require you to have complained to the organization before complaining to them.

What Happens after a HIPAA Complaint is Filed with HHS´ Office for Civil Rights?

When a complaint is filed with HHS´ Office for Civil Rights, the complaint is reviewed to establish the agency has the authority to investigate, the complaint is made within 180 days of the alleged violation, and that the complaint relates to a violation of the Privacy, Security, or Breach Notification Rules. Around two-thirds of complaints are rejected at the review stage because the complaint is made against an organization not subject to HIPAA, is too late, or no violation has occurred.

If a complaint passes the review stage, HHS´ Office for Civil Rights will contact the healthcare provider or health plan to attempt an informal resolution to the complaint – for example, by providing technical assistance. If a more serious violation is identified, HHS´ Office for Civil Rights will conduct a full-scale investigation into the organization´s compliance, with the possible outcomes being technical assistance, a more formal corrective action plan, or a civil money penalty.

The process is much the same when a complaint is filed with a State Attorney General, and both the HHS´ Office for Civil Rights and State Attorneys General will inform a complainant of the outcome of their complaint once it is resolved. The only exception to this process is when a possible criminal violation of HIPAA is identified by either HHS´ Office for Civil Rights – in which case the complaint is escalated to the Department of Justice for investigation.

The post What Happens after a HIPAA Complaint is Filed? appeared first on HIPAA Journal.

Some of the biggest fines for HIPAA violations have been for failing to comply with the medical records destruction rules. Consequently, it is vital Covered Entities and Business Associates are aware how to destruct medical records compliantly.

Each state has its own requirements for retaining medical records; and, in some cases, certain types of medical records have to be retained for longer periods than others. Federal laws can also dictate how long specific records have to be retained (i.e., OSHA 1910.1200(g)), and if these records are maintained in a designated record set, they are considered to PHI and Covered Entities are required to keep them until the retention period expires.

Although HIPAA has document retention requirements, there are no minimum retention periods for medical records. However, the Privacy Rule does require that Covered Entities implement appropriate administrative, technical, and physical safeguards to protect the privacy of medical records for whatever period the records are maintained by the Covered Entity. This requirement also applies to the destruction of medical records.

The HIPAA Medical Records Destruction Rules

Although there are no specific HIPAA medical records destruction rules, the Privacy Rule requires Covered Entities to determine what steps are reasonable to safeguard medical records through the destruction process and develop and implement policies and procedures to carry out those steps. In determining what is reasonable, Covered Entities should assess potential risks to patient privacy in the context of what form the information is in and how it is being destructed

Additionally, the Security Rule requires Covered Entities and Business Associates to develop and implement policies and procedures to facilitate the compliant destruction of electronic PHI and/or media on which it is stored. Any members of the workforce involved in the destruction process, or who supervise other members of the workforce responsible for destructing medical records in compliance with HIPAA must receive training on the PHI destruction policies and procedures.

Failing to implement reasonable safeguards to protect PHI in connection with its destruction could result in impermissible disclosures of PHI, and several Covered Entities have received substantial fines for failing to comply with the HIPAA medical records destruction rules:

• In 2009, CVS Pharmacy Inc. was one of the first Covered Entities to reach a financial settlement for a HIPAA violation – the company agreeing to a $2.25 million settlement for the improper disposal of PHI.
• The following year, the pharmacy chain Rite Aid agreed to pay $1 million to settle a similar HIPAA violation; and, a few years, the independent Cornell Prescription Pharmacy had to pay $125,000 for also disposing of PHI improperly.
• It is not just pharmacies who fail to comply with the HIPAA medical records destruction rules. In 2013, the former owners of a medical billing practice were fined $140,000 for disposing of 67,000 medical records in a public dump.
• More recently, the New England Dermatology and Laser Center agreed to settle an investigation into the improper destruction of medical records for $300,640 and implement a Corrective Action Plan for two years – which will incur further indirect costs.

How to Destruct Medical Records in Compliance with HIPAA

HHS´ Office for Civil Rights has previously released guidance on how to destruct medical records in compliance with HIPAA. With regards to paper records, the agency suggests “shredding or otherwise destroying PHI […]so the PHI is rendered essentially unreadable, indecipherable, and otherwise cannot be reconstructed prior to it being placed in a dumpster or other trash receptacle”.

With regards to the bulk destruction of PHI, the agency suggests depositing PHI in locked dumpsters that are only accessible by authorized persons or maintaining PHI in a secure area until such time as a disposal company removes it to destroy it professionally. In such circumstances, it will be necessary to enter into a Business Associate Agreement with the entity responsible for destructing the records.

With regards to ePHI stored electronically HHS´ Office for Civil Rights advocates clearing and purging electronic media, or destroying the media by disintegration, pulverization, melting, incinerating, or shredding. It is important to note that some clearing and purging techniques are not 100% effective on modern hard drives, and it may be possible to recover deleted data in some cases.

It is also important to note that some states have more stringent medical records destruction rules than HIPAA; and, in some states, any organization that creates, maintains, or transmits personal health information may be subject to medical records destruction rules – not just HIPAA Covered Entities and Business Associates. If you are unsure which medical records destruction rules apply to your organization, it is recommended you seek professional compliance advice.

The post Understanding the HIPAA Medical Records Destruction Rules appeared first on HIPAA Journal.

U.S Department of Health and Human Services Director Xavier Becerra has formally sworn in Melanie Fontes Rainer as the new Director of the HHS’ Office for Civil Rights (OCR).  Fontes Rainer will lead the department’s enforcement of federal civil rights and HIPAA compliance and will direct the department’s policy and strategic initiatives.

Fontes Rainer previously served as Acting Director, replacing Lisa J. Pino who left the post in July 2022 after 11 months as Director. Prior to joining OCR, Fontes Rainer served as Counselor to Secretary Becerra and provided strategy guidance on issues pertaining to civil rights, patient privacy, reproductive health, the Affordable Care Act (ACA), competition in healthcare, equity, and the private insurance market. In that role, she led the implementation of the No Surprises Act, which has helped to improve the transparency of medical billing and save consumers money. Fontes Rainer sits on the White House Task Force on Reproductive Healthcare Access, and recently advised the Secretary and the Administration on how best to respond to the Supreme Court decision on Dobbs v. Jackson Women’s Health Organization. Fontes Rainer has also served as the Secretary’s designee on the White House Competition Council, leading cross-cutting Department work and a whole-of-Government approach on price transparency, costs, and competition to benefit American consumers.

Prior to joining the Biden-Harris Administration, Fontes Rainer served as Special Assistant to the Attorney General and Chief Health Care Advisor at the California Department of Justice. In that role, she led a national team to save the Affordable Care Act and protect healthcare coverage for more than 133 million Americans. In her role as Special Assistant, Fontes Rainer assisted with the creation of the Health Care Rights and Access – a new office devoted to proactively advancing laws pertaining to health care civil rights, privacy, competition, and consumer protection. Fontes Rainer has also served in the U.S. Senate as a Senior Aide and Women’s Policy Director to Chair Patty Murray on the Health, Education, Labor and Pensions and the Budget Committees, where she helped pass several transformative health care laws, including the 21st Century Cures Act, Every Student Succeeds Act, and the Justice for Victims of Trafficking Act, among other laws and led the Senate’s work on the Affordable Care Act, reproductive rights, and gender equity.

“Melanie has devoted her entire professional career to public service and has worked tirelessly to ensure that health care is accessible, affordable, and available to all, no matter where you live or who you are,” said Secretary Becerra. “As one of my longtime senior aides, I can say with certainty that Melanie will vigorously protect and enforce the healthcare and civil rights of Americans across the country. Melanie’s commitment and expertise are vital to implementing the health and human services priorities of the Biden-Harris Administration as we work to ensure families across the country know that we have their back.”

The post Melanie Fontes-Rainer Appointed Director of the HHS’ Office for Civil Rights appeared first on HIPAA Journal.

Massachusetts-based New England Dermatology P.C., dba New England Dermatology and Laser Center (NDELC), has agreed to settle a HIPAA violation case with the HHS’ Office for Civil Rights (OCR) and has paid a $300,640 penalty to resolve alleged violations of the HIPAA Privacy Rule.

On May 11, 2021, NDELC notified OCR about a privacy breach involving the protected health information of 58,106 patients. On March 31, 2021, NDELC disposed of empty specimen containers in a regular dumpster in the MDELC parking lot. The containers had labels that included patients’ names, dates of birth, sample collection date, and the names of the providers that took the specimens. OCR investigated the incident and NDELC revealed it was a standard practice to dispose of empty specimen containers with regular waste, and that practice had been in effect from February 4, 2011, until March 31, 2021.

The administrative safeguards of the HIPAA Privacy Rule – 45 C.F.R. § 164.530(c) – require appropriate administrative, technical, and physical safeguards to be implemented to protect the privacy of protected health information. Covered entities must reasonably safeguard protected health information to limit incidental uses or disclosures, and must reasonably safeguard protected health information from any intentional or unintentional use or disclosure. When protected health information no longer needs to be legally retained it must be disposed of securely, which means protected health information must be essentially rendered unreadable, indecipherable, and otherwise cannot be reconstructed prior to disposal.

In addition to a violation of 45 C.F.R. § 164.530(c), OCR determined there had been an impermissible disclosure of PHI to unauthorized individuals, in violation of 45 C.F.R. § 164.502(a). NDELC chose to settle the case with no admission of liability. In addition to paying a financial penalty, NDELC has agreed to implement a corrective action plan, which includes two years of monitoring.

“Improper disposal of protected health information creates an unnecessary risk to patient privacy,” said Acting OCR Director Melanie Fontes Rainer. “HIPAA regulated entities should take every step to ensure that safeguards are in place when disposing of patient information to keep it from being accessible by the public.” Rainer replaced Lisa J. Pino in July 2022. Pino held the post of OCR Director for 10 months.

It has been a busy year of HIPAA enforcement for OCR. In 2022, 17 HIPAA cases have been resolved with financial penalties, just two short of the record of 19 financial penalties set in 2020.

The post Improper Disposal of PHI Results in $300,640 HIPAA Penalty appeared first on HIPAA Journal.