HIPAA Compliance News

December 2020 Healthcare Data Breach Report

2020 ended with healthcare data breaches being reported at a rate of 2 per day, which is twice the rate of breaches in January 2020. Healthcare data breaches increased 31.9% month over month and were also 31.9% more than the 2020 monthly average.

There may still be a handful more breaches to be added to the OCR breach portal for 2020 but, as it stands, 565 healthcare data breaches of 500 or more records have been reported to OCR in 2020. That is more than any other year since the HITECH Act required OCR to start publishing data breach summaries on its website.

2020 Healthcare Data Breaches

December was the second worst month of 2020 in terms of the number of breached records. 4,241,603 healthcare records were exposed, compromised, or impermissibly disclosed across the month’s 62 reported data breaches. That represents a 272.35% increase in breached records from November and 92.25% more than the monthly average in 2020. For comparison purposes, there were 41 reported breaches in December 2019 and 397,862 healthcare records were breached.

healthcare records breached in 2020

Largest Healthcare Data Breaches Reported in December 2020

Name of Covered Entity State Covered Entity Type Individuals Affected Type of Breach Cause
MEDNAX Services, Inc. FL Business Associate 1,290,670 Hacking/IT Incident Phishing attack
Dental Care Alliance, LLC FL Business Associate 1,004,304 Hacking/IT Incident Unspecified hacking incident
Aetna ACE CT Health Plan 484,157 Hacking/IT Incident Phishing attack (business associate)
Allegheny Health Network PA Healthcare Provider 299,507 Hacking/IT Incident Ransomware attack (Blackbaud)
AMITA Health IL Healthcare Provider 261,054 Hacking/IT Incident Ransomware attack (Blackbaud)
Community Eye Care, LLC NC Health Plan 149,804 Hacking/IT Incident Email account breach
GenRx Pharmacy AZ Healthcare Provider 137,110 Hacking/IT Incident Ransomware attack
Wilmington Surgical Associates, P.A. NC Healthcare Provider 114,834 Hacking/IT Incident Ransomware attack
Agency for Community Treatment Services, Inc. FL Healthcare Provider 73,825 Hacking/IT Incident Ransomware attack
Sonoma Valley Healthcare District CA Healthcare Provider 69000 Hacking/IT Incident Ransomware attack

There were two healthcare data breaches reported in December that each impacted more than 1 million individuals. The largest breach was a phishing attack on the Florida-based business associate, MEDNAX Services, Inc. MEDNAX provides revenue cycle management and other administrative services to its affiliated physician practice groups. Hackers gained access to its Microsoft Office 365-hosted email system after employees responded to phishing emails. The compromised accounts contained the protected health information of 1,290,670 patients of its clients.

Dental Care Alliance is a Sarasota, FL-based dental support organization with more than 320 affiliated dental practices in 20 U.S. states. Little information has been released about the exact nature of the cyberattack, other than hackers gaining access to its systems and viewing files containing patient information.

Causes of December 2020 Healthcare Data Breaches

Ransomware gangs continue to target healthcare organizations and attacks have increased considerably in recent months. 5 of the worst data breaches reported in December involved ransomware, as did many of the smaller breaches. Several healthcare providers have only just reported being affected by the ransomware attack on Blackbaud Inc., which was discovered by the cloud service provide in May 2020.

Phishing continues to be a major cause of healthcare data breaches. There were 13 data breaches involving unauthorized accessing of email accounts, the majority of which used credentials stolen in phishing attacks. While most of the month’s breaches involved unauthorized accessing of electronic protected health information, 17.75% of the month’s breaches involved paper records and films, highlighting the importance of also protecting physical records.

cvauses of December 2020 healthcare data breaches

33 hacking/IT incidents were reported to OCR in December 2020. Those incidents accounted for 98.39% of the month’s breached records (4,173,519 records). An average of 126,470 records were breached per incident with a median breach size of 8,000 records per incident.

There were 21 unauthorized access/disclosure incidents reported to OCR which involved a total of 57,837 records. The average breach size was 2,754 records and the median breach size was 1,020 records.

There were 7 theft and loss incidents reported (5 theft/2 loss). The average breach size was 1,392 records and the median breach size was 856 records. There was also one incident involving the improper disposal of 501 records.

Location of PHI in December 2020 healthcare data breaches

Entities Reporting Data Breaches in December 2020

Healthcare providers were the worst affected covered entity in December 2020 with 39 breaches reported, but there was a major increase in data breaches reported by health plans. 17 health plans reported breaches of 500 or more records in December, which is a 183% increase from November.

There were 6 data breaches reported by business associates of HIPAA covered entities, but 40% of the month’s breaches (25) had some business associate involvement. In many cases, the breach was experienced by the business associate but was reported by the covered entity.

December 2020 healthcare data breaches by covered entity type

December 2020 Healthcare Data Breaches by State

HIPAA covered entities and business associates in 58% of U.S. states reported data breaches in December. Florida was the worst affected of the 29 states with 9 reported data breaches. Pennsylvania also had a particularly bad month with 7 reported breaches, followed by Missouri and Texas with 4, and Illinois, North Carolina, and Tennessee with 3.

There were two breaches reported in each of Arizona, Connecticut, Georgia, Massachusetts, Minnesota, Ohio, and Wisconsin, and one breach reported in each of Arkansas, California, Colorado, Delaware, Indiana, Iowa, Kentucky, Louisiana, Maine, Mississippi, Nebraska, Oregon, Utah, Virginia, and West Virginia.

HIPAA Enforcement in December 2020

2020 has been a busy year in terms of HIPAA enforcement. More financial penalties were imposed on HIPAA covered entities and their business associates to resolve potential HIPAA violations in 2020 than in any other year since the HHS was given the authority to enforce HIPAA compliance.  19 settlements were reached to resolve cases where HIPAA Rules appeared to have been violated.

OCR announced one further financial penalty in December – The 13th financial penalty under its HIPAA Right of Access initiative. Peter Wrobel, M.D., P.C., dba Elite Primary Care, agreed to pay OCR a $36,000 to resolve a case involving the failure to provide two patients with timely access to their medical records.

You can read more about 2020 HIPAA enforcement in our end of year summary.

The post December 2020 Healthcare Data Breach Report appeared first on HIPAA Journal.

Excellus Health Plan Settles HIPAA Violation Case and Pays $5.1 Million Penalty

The Department of Health and Human Services’ Office for Civil Rights has announced the health insurer Excellus Health Plan has agreed to pay a $5.1 million penalty to settle a HIPAA violation case stemming from a 2015 data breach that affected 9.3 million individuals.

The breach in question was discovered by Excellus Health Plan in 2015, the same year that massive data breaches were discovered by the health insurers Anthem Inc. (78.8 million records) and Premera Blue Cross (10.6 million records). All three entities have now settled breach investigations with OCR and have paid substantial financial penalties.

Excellus Health Plan, doing business as Excellus BlueCross BlueShield and Univera Healthcare, serves individuals in upstate and western New York. In August 2015, the health insurer discovered hackers had gained access to its computer systems. The breach investigation revealed access to its systems was first gained around December 23, 2013 and continued until May 11, 2015. The breach was reported to OCR on September 9, 2015.

The hackers installed malware on its systems, performed reconnaissance, and were found to have accessed the healthcare data of around 7 million Excellus Health Plan members and approximately 2.5 million members of Lifetime Healthcare, its non-BlueCross subsidiary. The information accessed by the hackers included names, contact information, dates of birth, Social Security numbers, health plan ID numbers, claims data, financial account information, and clinical treatment information.

OCR launched an investigation of the breach in June 2016 to determine whether Excellus Health Plan was in compliance with the HIPAA Privacy, Security, and Breach Notification Rules. The investigation identified five standards of the HIPAA Rules where Excellus was potentially noncompliant.

OCR determined the health plan had failed to conduct an accurate and thorough organization-wide risk analysis to identify risks and vulnerabilities to the confidentiality, integrity, and availability of the electronic protected health information (ePHI) of its members.  Sufficient measures had not been implemented to reduce risks and vulnerabilities to ePHI to a reasonable and appropriate level, and technical policies and procedures that only allow authorized persons and software programs to access systems containing ePHI were insufficient. As a result of these issues, unauthorized individuals gained access to the PHI of 9,358,891 of its members. It took Excellus more than 18 months to discover its systems had been breached. OCR found policies and procedures requiring regular reviews of information system activity to be lacking.

The financial penalty was agreed with OCR to avoid further investigation and formal proceedings, and the settlement was reached with no admission of liability or wrongdoing. In addition to paying the financial penalty, Excellus is required to adopt a corrective action plan that covers all areas of potential noncompliance identified by OCR during the investigation. Excellus will also be monitored closely by OCR for 2 years to ensure continued compliance with the HIPAA Rules.

“Hacking continues to be the greatest threat to the privacy and security of individuals’ health information.  In this case, a health plan did not stop hackers from roaming inside its health record system undetected for over a year which endangered the privacy of millions of its beneficiaries,” said OCR Director Roger Severino. “We know that the most dangerous hackers are sophisticated, patient, and persistent.  Health care entities need to step up their game to protect the privacy of people’s health information from this growing threat.”

This is the second HIPAA enforcement action to be announced by OCR in 2021. Earlier this month, OCR said a $200,000 settlement had been reached with Banner Health to resolve potential HIPAA Right of Access violations. The Excellus settlement comes just a few hours after the 5th Circuit Court of Appeals vacated a $4.3 million Civil Monetary Penalty imposed by OCR on University of Texas M.D. Anderson Cancer Center that stemmed from three incidents involving the loss/theft of portable devices containing ePHI between 2012 and 2013.

The two HIPAA settlements in January follow on from a record year of HIPAA enforcement that saw 19 financial penalties paid by HIPAA covered entities and business associates to resolve potential violations of HIPAA Rules.

The post Excellus Health Plan Settles HIPAA Violation Case and Pays $5.1 Million Penalty appeared first on HIPAA Journal.

What are the Penalties for HIPAA Violations?

The penalties for HIPAA violations include civil monetary penalties ranging from $137 to $68,928 per violation, depending on the level of culpability. Criminal penalties can also be imposed for intentional violations, leading to fines and potential imprisonment.

In addition to financial penalties, corrective action plans may be required to address compliance deficiencies. State attorneys general can also bring civil actions, resulting in monetary damages.  Plus, covered entities may be required to adopt a corrective action plan to bring policies and procedures up to the standards demanded by HIPAA.

Ten Most Common HIPAA ViolationsIn this article, we provide a detailed explanation of penalties for HIPAA violations.

You can also use the article in conjunction with our free HIPAA Violations Checklist to understand what is required to ensure full compliance. Please use the form on this page to arrange for your copy.

HIPAA, PHI & HITECH

The Health Insurance Portability and Accountability Act of 1996 placed a number of requirements on HIPAA-covered entities to safeguard the Protected Health Information (PHI) of patients, and to strictly control when PHI can be divulged, and to whom.

Since the Enforcement Final Rule of 2006, OCR has had the power to issue financial penalties (and/or corrective action plans) to HIPAA-covered entities that fail to comply with HIPAA Rules.

Financial penalties for HIPAA violations were updated by the HIPAA Omnibus Rule, which introduced charges in line with the Health Information Technology for Economic and Clinical Health Act (HITECH). The Omnibus Rule took effect on March 26, 2013.

Since the introduction of the Omnibus Rule, the new penalties for HIPAA violations apply to healthcare providers, health plans, healthcare clearinghouses, and all other covered entities, as well as to business associates (BAs) of covered entities that are found to have violated HIPAA Rules.

Financial penalties are intended to act as a deterrent to prevent the violation of HIPAA laws, while also ensuring covered entities are held accountable for their actions – or lack of them – when it comes to protecting the privacy of patients and the confidentiality of health data and providing patients with access to their health records on request.

The penalty structure for a violation of HIPAA laws is tiered, based on the knowledge a covered entity had of the violation. The OCR sets the penalty based on a number of “general factors” and the seriousness of the HIPAA violation.

Ignorance of HIPAA Rules is no excuse for failing to comply with HIPAA Rules. It is the responsibility of each covered entity to ensure that HIPAA Rules are understood and followed. In cases when a covered entity is discovered to committed a willful violation of HIPAA laws, the maximum fines may apply.

What Constitutes a HIPAA Violation?

What are the penalties for HIPAA ViolationsThere is much talk of HIPAA violations in the media, but what constitutes a HIPAA violation? A HIPAA violation is when a HIPAA-covered entity – or a business associate – fails to comply with one or more of the provisions of the HIPAA Privacy, Security, or Breach Notification Rules.

A violation may be deliberate or unintentional. An example of an unintentional HIPAA violation is when too much PHI is disclosed and the minimum necessary information standard is violated. When PHI is disclosed, it must be limited to the minimum necessary information to achieve the purpose for which it is disclosed. Financial penalties for HIPAA violations can be issued for unintentional HIPAA violations, although the penalties will be at a lower rate for willful violations of HIPAA Rules.

An example of a deliberate violation is unnecessarily delaying the issuing of breach notification letters to patients and exceeding the maximum timeframe of 60 days following the discovery of a breach to issue notifications – A violation of the HIPAA Breach Notification Rule.

Many HIPAA violations are the result of negligence, such as the failure to perform an organization-wide risk assessment. Financial penalties for HIPAA violations have frequently been issued for risk assessment failures.

Penalties for HIPAA violations can potentially be issued for all HIPAA violations, although OCR typically resolves most cases through voluntary HIPAA compliance, issuing technical guidance, or accepting a covered entity or business associate’s plan to address the violations and change policies and procedures to prevent future violations from occurring. Financial penalties for HIPAA violations are reserved for the most serious violations of HIPAA Rules and for when OCR wants to “send a message” about specific violation types.

What Happens if You Violate HIPAA? – HIPAA Violation Classifications

What happens if you violate HIPAA? That depends on the severity of the violation. OCR prefers to resolve HIPAA violations using non-punitive measures, such as voluntary compliance or issuing technical guidance to help covered entities address areas of non-compliance. However, if the violations are serious, have been allowed to persist for a long time, or if there are multiple areas of noncompliance, financial penalties may be appropriate.

The four categories used for the penalty structure are as follows:

  • Tier 1: A violation that the covered entity was unaware of and could not have realistically avoided, had a reasonable amount of care been taken to abide by HIPAA Rules
  • Tier 2: A violation that the covered entity should have been aware of but could not have avoided even with a reasonable amount of care. (but falling short of willful neglect of HIPAA Rules)
  • Tier 3: A violation suffered as a direct result of “willful neglect” of HIPAA Rules, in cases where an attempt has been made to correct the violation
  • Tier 4: A violation of HIPAA Rules constituting willful neglect, where no attempt has been made to correct the violation within 30 days

In the case of unknown violations, where the covered entity could not have been expected to avoid a data breach, it may seem unreasonable for a covered entity to be issued with a fine. OCR appreciates this and has the discretion to waive a financial penalty. The penalty cannot be waived if the violation involved willful neglect of the Privacy, Security, and Breach Notification Rules.

HIPAA Violation Penalty Structure

Each category of violation carries a separate HIPAA penalty. It is up to OCR to determine a financial penalty within the appropriate range. OCR considers a number of factors when determining penalties, such as the length of time a violation was allowed to persist, the number of people affected, and the nature of the data exposed. An organization’s willingness to assist with an OCR investigation is also taken into account. The general factors that can affect the amount of the financial penalty also include prior history, the organization’s financial condition, and the level of harm caused by the violation.

  • Tier 1: Minimum fine of $100 per violation up to $50,000
  • Tier 2: Minimum fine of $1,000 per violation up to $50,000
  • Tier 3: Minimum fine of $10,000 per violation up to $50,000
  • Tier 4: Minimum fine of $50,000 per violation

The above fines for HIPAA violations are those stipulated by the HITECH Act, and these figures are adjusted annually to factor in cost-of-living increases to ensure that the civil monetary penalties continue to serve as an effective deterrent. Under the Federal Civil Penalties Inflation Adjustment Act of 1990, later amended by the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015, cost-of-living increases are stipulated by the Office of Management and Budget (OMB). On January 15 each year,  the multiplier set by OMB should be applied by all federal agencies to their CMPs. This year, the HHS published its annual increases in the Federal Register on October 6, which is also the effective date for the updated civil monetary penalties.

All civil monetary penalties assessed by OCR on or after October 6, 2023, will use the new rates for violations that occurred on or after November 2, 2015.

2023 HIPAA Penalty Structure

Penalty Tier Culpability Minimum Penalty per Violation – Inflation

Adjusted

Max Penalty per Violation – Inflation Adjusted Maximum Penalty Per Year (cap) – Inflation Adjusted
Tier 1 Lack of Knowledge $137 $68,928 $2,067,813
Tier 2 Reasonable Cause $1,379 $68,928 $2,067,813
Tier 3 Willful Neglect $13,785 $68,928 $2,067,813
Tier 4 Willful Neglect (not corrected within 30 days) $68,928 $2,067,813 $2,067,813

OCR 2019 Notice of Enforcement Discretion Applies New Maximum Annual Penalties for HIPAA Violations

What are the penalties for HIPAA Compliance ViolationsThe above table of penalties is still officially in force; however, in 2019, the HHS reviewed the language of the HITECH Act with respect to the required increases for HIPAA violations and determined that the language of the HITECH Act had been misinterpreted and that it did not call for the same maximum annual penalty cap to be applied equally across all four penalty tiers. Instead, the HHS determined that the maximum annual penalty of $1.5 million ($2,067,813 in 2023) should only apply to the most serious Tier 4 violation category.

Rather than issue further rulemaking which would see the new penalty structure changed in the Federal Register, the HHS announced that OCR would be exercising enforcement discretion and would be applying a different penalty structure where each tier had a separate annual penalty cap. A Notice of Enforcement Discretion (NED) was issued in April 2019 which states that OCR will apply penalties according to the table below. These have been adjusted by The HIPAA Journal based on the multipliers set by OMB.

The penalty structure OCR is using is not legally binding, and further rulemaking is required before its new interpretation is set in stone. The NED is still in effect and will remain so indefinitely. Since the NED only applied caps to the annual penalties, this creates an anomaly, as the maximum penalty per violation in Tier 1 is still technically $63,973, which is higher than the annual penalty cap. Therefore the annual penalty cap is shown as the maximum penalty per violation in the table below for tier 1.

Penalty Tier Culpability  Minimum Penalty per Violation Maximum Penalty per Violation Annual Penalty Cap
Tier 1 Lack of Knowledge $137 $34,464 $34,464
Tier 2 Reasonable Cause $1,379 $68,928 $137,886
Tier 3 Willful Neglect $13,785 $68,928 $344,638
Tier 4 Willful neglect (not corrected within 30 days $68,928 $68,928 $2,067,813

*This table was last updated on October 6, 2023, and includes the inflationary updates for 2023. 

Attorneys General Can Also Issue HIPAA Violation Fines

Since the introduction of the HITECH Act (Section 13410(e) (1)) in February 2009, state attorneys general have the authority to hold HIPAA-covered entities accountable for the unauthorized use or disclosure of PHI of state residents and can file civil actions with the federal district courts. HIPAA violation fines can be issued up to a maximum level of $25,000 per violation category, per calendar year. The minimum fine applicable is $100 per violation.

A covered entity suffering a data breach affecting residents in multiple states may be ordered to pay HIPAA violation fines to attorneys general in multiple states. Relatively few states have taken action against HIPAA-regulated entities for violations of the HIPAA Rules – California, Connecticut, Indiana, Massachusetts, Minnesota, New Jersey, New York, Vermont, and the District of Columbia. In recent years attorneys general have joined forces and have pursued penalties for HIPAA violations in response to large-scale data breaches that have affected individuals across the United States, and have pooled their resources and taken a cut of any settlements or civil monetary penalties. While only a small number of states have exercised their authority to issue fines for HIPAA violations, that does not mean HIPAA violations are going unpunished. Many states have pursued financial penalties for equivalent violations of state laws.

Can HIPAA Violations be Criminal?

When a HIPAA-covered entity or business associate violates HIPAA Rules, civil penalties can be imposed. When healthcare professionals violate HIPAA, it is usually their employer that receives the penalty, but not always. If healthcare professionals knowingly obtain or use protected health information for reasons that are not permitted by the HIPAA Privacy Rule, they may be found to be criminally liable for the HIPAA violation under the criminal enforcement provision of the Social Security Act.

Criminal HIPAA violations are prosecuted by the Department of Justice, which is increasingly taking action against individuals who have knowingly violated HIPAA Rules. There have been several cases that have resulted in substantial fines and prison sentences.

Criminal HIPAA violations include theft of patient information for financial gain and wrongful disclosures with intent to cause harm. A lack of understanding of HIPAA requirements may not be a valid defense. When an individual “knowingly” violates HIPAA, knowingly means that they have some knowledge of the facts that constitute the offense, not that they definitely know that they are violating HIPAA Rules.

Criminal Penalties for HIPAA Violations

Criminal penalties for HIPAA violations are divided into three separate tiers, with the term – and an accompanying fine – decided by a judge based on the facts of each individual case. As with OCR, a number of general factors are considered which will affect the penalty issued. If an individual has profited from the theft, access, or disclosure of PHI, it may be necessary for all money received to be refunded, in addition to the payment of a fine.

The tiers of criminal penalties for HIPAA violations are:

Tier 1:   Reasonable cause or no knowledge of violation – Up to 1 year in jail

Tier 2:   Obtaining PHI under false pretenses – Up to 5 years in jail

Tier 3:   Obtaining PHI for personal gain or with malicious intent – Up to 10 years in jail

In recent years, the number of employees discovered to be accessing or stealing PHI – for various reasons – has increased. The value of PHI on the black market is considerable, and this can be a big temptation for some individuals. It is therefore essential that controls are put in place to limit the opportunity for individuals to steal patient data, and for systems and policies to be put in place to ensure improper access and theft of PHI is identified promptly.

All staff likely to come into contact with PHI as part of their work duties should be informed of the HIPAA criminal penalties and that violations will not only result in loss of employment but potentially also a lengthy jail term and a heavy fine.

State attorneys general are cracking down on data theft and are keen to make examples out of individuals found to have violated HIPAA Privacy Rules. A jail term for the theft of HIPAA data is therefore highly likely.

Convictions and Jail Time for HIPAA Violations

Florida Medical Clinic Worker Sentenced to 48 Months in Jail over Theft of PHI

3-Year Jail Term for VA Employee Who Stole Patient Data

Former New York Dental Practice Receptionist Sentenced to 2-6 years for HIPAA Violation

UPMC Patient Care Coordinator Gets 1 Year Jail Term for HIPAA Violation

Employee Sanctions for HIPAA Violations

Not all HIPAA violations are a result of insider theft, and many Covered Entities and Business Associates apply a scale of employee sanctions for HIPAA violations depending on factors such as whether the violation was intentional or accidental, whether it was reported by the employee as soon as the violation was realized,  and the magnitude of the breach. Some Covered Entities also apply employee sanctions for HIPAA violations on employees who were aware a violation (by another employee) had occurred but failed to report it.

Employee sanctions for HIPAA violations vary in gravity from further training to dismissal. The decision should be taken in consultation with HIPAA Privacy and Security Officers, who may have to conduct interviews with the employee, investigate audit trails, and review telephone logs – including the telephone logs of the employee´s mobile phone. Because of the expense and disruption attributable to applying employee sanctions for HIPAA violations, it is worthwhile dedicating more resources to initial employee training in order to prevent HIPAA violations – whether intentional or accidental – from occurring.

Receiving a Civil Penalty for Unknowingly Violating HIPAA

Although it was mentioned above that OCR has the discretion to waive a civil penalty for unknowingly violating HIPAA, ignorance of HIPAA regulations is not regarded as a justifiable excuse for failing to implement the appropriate safeguards. In April 2017, the remote cardiac monitoring service CardioNet was fined $2.5 million for failing to fully understand the HIPAA requirements and subsequently failing to conduct a complete risk assessment.

As a result of the incomplete risk assessment, the PHI of 1,391 individuals was potentially disclosed without authorization when a laptop containing the data was stolen from a car parked outside an employee´s home. Speaking after details of the fine had been announced, OCR Director Roger Severino described the civil penalty for unknowingly violating HIPAA as a penalty for disregarding security.

It may also be possible for a CE or BA to receive a civil penalty for unknowingly violating HIPAA if the state in which the violation occurs allows individuals to bring legal action against the person(s) responsible for the violation. Although HIPAA lacks a private right of action, individuals can still use state regulations to establish a standard of care under common law. Several cases of this nature are currently in progress.

Penalties for Non-Compliance with HIPAA

When deciding on an appropriate settlement, OCR considers the severity of the violation, the extent of non-compliance with HIPAA Rules, the number of individuals impacted, and the impact a breach has had on those individuals. OCR also considers the financial position of the covered entity. Punitive measures may be necessary, but penalties for HIPAA violations should not result in a covered entity being forced out of business.

The purpose of these penalties for HIPAA violations is in part to punish covered entities for serious violations of HIPAA Rules, but also to send a message to other healthcare organizations that noncompliance with HIPAA Rules is not acceptable.

HIPAA Penalties 2023

OCR is expected to continue to aggressively enforce HIPAA compliance in 2023 after a record-breaking year of HIPAA fines and settlements. OCR is continuing to crack down on violations of the HIPAA Right of Access, which has been one of OCR’s main enforcement priority priorities since the agency launched its HIPAA Right of Access initiative in late 2019. The majority of enforcement actions for HIPAA violations in the past two years have been for HIPAA Right of Access violations. OCR has confirmed its intent to continue to enforce this aspect of HIPAA compliance with an early HIPAA penalty in 2023.

In 2018, OCR announced an enforcement action against the University of Texas MD Anderson Cancer Center for a data breach and lack of encryption, but the penalty was overturned on appeal. On January 14, 2021, a three-member panel for the Fifth Circuit Court of Appeals unanimously vacated the $4,348,000 penalty, and since that date, only a handful of HIPAA penalties have been issued for violations of the HIPAA Rules other than HIPAA Right of Access failures. The decision by the Court of Appeals was widely thought to have affected OCR’s willingness to pursue financial penalties for certain HIPAA violations, but in 2022, multiple financial penalties were imposed for other HIPAA violations. OCR now has a new Director, Melanie Fontes Rainer, who was appointed on September 14, 2022, as the successor to Lisa J. Pino. Fontes Rainer will oversee the department’s enforcement activities and is expected to stamp her mark on enforcement, and we may well see a change in the HIPAA violation cases in 2023 that result in financial penalties.

From a compliance perspective, there are several points that are worth making for 2023. HIPAA-covered entities that provide telehealth services need to ensure that when the COVID-19 Public Health Emergency is declared over, the platforms they use for telehealth are HIPAA-compliant, as OCR’s Notice of Enforcement Discretion regarding the good faith provision of telehealth services will also come to an end. OCR issued guidance in 2022 confirming that breach notifications need to be issued within 60 days of the discovery of a data breach, which could indicate this aspect of compliance will be more aggressively enforced, and it is also likely that OCR will be scrutinizing the use of website tracking technologies now that guidance has been issued for healthcare providers confirming patient authorizations and business associate agreements are required.

This post will be updated as and when the 2023 HIPAA penalties are announced and 2023 HIPAA enforcement trends become clear.

2023 HIPAA Fines and Settlements

HIPAA-Regulated Entity Reason Individuals Impacted Amount
St. Joseph’s Medical Center Disclosure of PHI to a reporter 3 $80,000
Doctors’ Management Services Multiple HIPAA Security Rule failures 206,695 $100,000
LA Care Health Plan Multiple HIPAA Security Rule failures 1,498 $1,300,000
UnitedHealthcare HIPAA Right of Access failure 1 $80,000
iHealth Solutions (dba Advantum Health) Unsecured server – Impermissible disclosure of ePHI; risk analysis failure. 267 $75,000
Yakima Valley Memorial Hospital Snooping by security guards – Lack of policies and procedures identified. 419 $240,000
Manasa Health Center, LLC Impermissible disclosure of PHI on an Internet platform, Privacy Rule and Breach Notification Rule policies and procedures 4 $30,000
MedEvolve Inc. Impermissible disclosure, business associate agreement failure, risk analysis incomplete 230,572 $350,000
David Mente, MA, LPC HIPAA Right of Access failure 1 $15,000
Banner Health HIPAA Security Rule Violations 2.81 million $1,250,000
Life Hope Labs, LLC HIPAA Right of Access failure 1 $16,500

2022 HIPAA Fines and Settlements

22 HIPAA enforcement actions in 2022 resulted in financial penalties being imposed. OCR has continued with its 2019 HIPAA enforcement initiative targeting noncompliance with the HIPAA Right of Access, with the 2022 total bringing the number of enforcement actions under this initiative up to 42. Financial penalties were also imposed for impermissible disclosures of patient information on social media websites, inadequate security safeguards to ensure the confidentiality, integrity, and availability of ePHI, inadequate notices of privacy practices, and risk analysis failures.

In January 2021, the HITECH Act was amended to incentivize HIPAA-regulated entities to adopt ‘recognized security practices’ to better protect patient data. While it is not mandatory for recognized security practices to be implemented and maintained, HIPAA-regulated entities that demonstrate that they have implemented recognized security practices that have been in place continuously for the 12 months preceding a data breach will benefit from lower financial penalties, and shorter audits and investigations.

2022 HIPAA Settlements

HIPAA-Regulated Entity Reason Individuals Impacted Amount
Health Specialists of Central Florida Inc HIPAA Right of Access failure 1 $20,000
New Vision Dental Impermissible disclosure of ePHI on Yelp, and notice of privacy practices failure <20 $23,000
Great Expressions Dental Center of Georgia, P.C. HIPAA Right of Access failure (delay + fee) 1 $80,000
Family Dental Care, P.C. HIPAA Right of Access failure 1 $30,000
B. Steven L. Hardy, D.D.S., LTD, dba Paradise Family Dental HIPAA Right of Access failure 1 $25,000
New England Dermatology and Laser Center Improper disposal of PHI, failure to maintain appropriate safeguards 58,106 $300,640
Memorial Hermann Health System HIPAA Right of Access failure 1 $240,000
Southwest Surgical Associates HIPAA Right of Access failure 1 $65,000
Hillcrest Nursing and Rehabilitation HIPAA Right of Access failure 1 $55,000
MelroseWakefield Healthcare HIPAA Right of Access failure 1 $55,000
Erie County Medical Center Corporation HIPAA Right of Access failure 1 $50,000
Fallbrook Family Health Center HIPAA Right of Access failure 1 $30,000
Associated Retina Specialists HIPAA Right of Access failure 1 $22,500
Coastal Ear, Nose, and Throat HIPAA Right of Access failure 1 $20,000
Lawrence Bell, Jr. D.D.S HIPAA Right of Access failure 1 $5,000
Danbury Psychiatric Consultants HIPAA Right of Access failure 1 $3,500
Oklahoma State University – Center for Health Sciences Risk analysis, security incident response and reporting, evaluation, audit controls, breach notifications & an unauthorized disclosure 279,865 $875,000
Dr. Brockley HIPAA Right of Access 1 $30,000
Jacob & Associates HIPAA Right of Access, notice of privacy practices, HIPAA Privacy Officer 1 $28,000
Northcutt Dental-Fairhope Impermissible disclosure for marketing, notice of privacy practices, HIPAA Privacy Officer 5,385 $62,500

2022 Civil Monetary Penalties for HIPAA Violations

HIPAA-Regulated Entity Reason Individuals Impacted Amount
ACPM Podiatry HIPAA Right of Access failure 1 $100,000
Dr. U. Phillip Igbinadolor, D.M.D. & Associates, P.A Impermissible disclosure on social media 1 $50,000

OCR HIPAA Fines 2021

There was a reduction in the number of financial penalties for HIPAA violations in 2021 from the record number of penalties in 2020, with OCR’s decision to finalize penalties potentially being affected by the COVID-19 pandemic. That said, penalties have continued to be imposed at relatively high levels, with most of the recent HIPAA violation cases in 2021 imposed for violations of the HIPAA Right of Access. Out of the 14 HIPAA violation cases in 2021 that have resulted in financial penalties, 12 have been for HIPAA Right of Access violations.

In January 2021, one of the largest ever HIPAA fines was imposed on Excellus Health Plan. The settlement resolved a HIPAA case that stemmed from an investigation of a breach of the PHI of 9,358,891 individuals that was reported to OCR in 2015. Aside from that penalty, most of the settlements and civil monetary penalties have been for relatively small amounts and have resulted from investigations of complaints from patients than reports of data breaches. As well as the 2021 HIPAA fines being lower, there was a much higher percentage of financial penalties imposed on small healthcare providers than in previous years. That trend is likely to continue in 2023.

2021 HIPAA Settlements

HIPAA Regulated Entity Reason Individuals Impacted Amount
Advanced Spine & Pain Management HIPAA Right of Access failure 1 $32,150
Denver Retina Center HIPAA Right of Access failure 1 $30,000
Rainrock Treatment Center LLC (dba monte Nido Rainrock) HIPAA Right of Access failure 1 $160,000
Wake Health Medical Group HIPAA Right of Access failure 1 $10,000
Children’s Hospital & Medical Center HIPAA Right of Access failure 1 $80,000
The Diabetes, Endocrinology & Lipidology Center, Inc. HIPAA Right of Access failure 1 $5,000
AEON Clinical Laboratories (Peachstate) HIPAA Security Rule failures (risk assessment, risk management, audit controls, and documentation of HIPAA Security Rule policies and procedures Unknown $25,000
Village Plastic Surgery HIPAA Right of Access failure 1 $30,000
Arbour Hospital HIPAA Right of Access failure 1 $65,000
Sharpe Healthcare HIPAA Right of Access failure 1 $70,000
Renown Health HIPAA Right of Access failure 1 $75,000
Excellus Health Plan Multiple HIPAA Violations: Risk analysis, risk management, information system activity reviews, technical policies to prevent unauthorized ePHI access, breach of 9,358,891 records. 9,358,891 $5,100,000
Banner Health HIPAA Right of Access failure 2 $200,000

2021 Civil Monetary Penalties for HIPAA Violations

HIPAA-Regulated Entity Reason Individuals Impacted Amount
Dr. Robert Glaser HIPAA Right of Access failure 1 $100,000

OCR HIPAA Fines 2020

2020 saw more financial penalties imposed on HIPAA-covered entities and business associates than in any other year since OCR started enforcing HIPAA compliance. 19 settlements were reached to resolve potential violations of the HIPAA Rules. OCR continued with its HIPAA Right of Access enforcement initiative that commenced in late 2019 and by year-end had settled 11 cases where patients had not been provided with timely access to their medical records for a reasonable cost-based fee.

2020 saw the second-largest settlement to resolve HIPAA violations. The health insurer Premera Blue Cross paid OCR $6,850,000 to resolve potential HIPAA violations discovered during the investigation of its 2015 breach of the ePHI of 10,466,692 individuals.

2020 OCR HIPAA Settlements

HIPAA-Regulated Entity Reason Individuals Impacted Amount
Peter Wrobel, M.D., P.C., dba Elite Primary Care HIPAA Right of Access failure 2 $36,000
University of Cincinnati Medical Center HIPAA Right of Access failure 1 $65,000
Dr. Rajendra Bhayani HIPAA Right of Access failure 1 $15,000
Riverside Psychiatric Medical Group HIPAA Right of Access failure 1 $25,000
City of New Haven, CT Failure to terminate access rights; risk analysis failure; failure to implement Privacy Rule policies; failure to issue unique IDs to allow system activity to be tracked; impermissible disclosure of the PHI of 498 individuals 498 $202,400
Aetna Lack of technical and nontechnical evaluation in response to environmental or operational changes; identity check failure; minimum necessary information failure; impermissible disclosure of 18,849 records; lack of administrative, technical, and physical safeguards 18,849 $1,000,000
NY Spine HIPAA Right of Access failure 1 $100,000
Dignity Health, dba St. Joseph’s Hospital and Medical Center HIPAA Right of Access failure 1 $160,000
Premera Blue Cross Risk assessment failure; risk management failure; insufficient hardware and software controls; unauthorized access to the PHI of 10,466,692 individuals 10,466,692 $6,850,000
CHSPSC LLC Failure to conduct a risk analysis; failures to implement information system activity reviews, security incident procedures, and access controls, and a breach of the ePHI of more than 6 million individuals 6,121,158 $2,300,000
Athens Orthopedic Clinic PA Failure to conduct a risk analysis; lack of risk management and audit controls; failure to maintain HIPAA policies and procedures; business associate agreement failure; and the failure to provide HIPAA Privacy Rule training to the workforce. 208,557 $1,500,000
Housing Works, Inc. HIPAA Right of Access failure 1 $38,000
All Inclusive Medical Services, Inc. HIPAA Right of Access failure 1 $15,000
Beth Israel Lahey Health Behavioral Services HIPAA Right of Access failure 1 $70,000
King MD HIPAA Right of Access failure 1 $3,500
Wise Psychiatry, PC HIPAA Right of Access failure 1 $10,000
Lifespan Health System Affiliated Covered Entity Lack of encryption; insufficient device and media controls; lack of business associate agreements; impermissible disclosure of 20,431 patients’ ePHI 20,431 $1,040,000
Metropolitan Community Health Services dba Agape Health Services Longstanding, systemic noncompliance with the HIPAA Security Rule 1,263 $25,000

OCR HIPAA Fines 2019

HIPAA enforcement continued at a high level in 2019. Eight settlements were reached with HIPAA-covered entities and business associates to resolve HIPAA violations and two civil monetary penalties were issued. The financial penalties were imposed to resolve similar violations of HIPAA Rules as in previous years, but 2019 also saw the first financial penalties issued under OCR’s new HIPAA Right of Access initiative. Two covered entities settled cases over the failure to provide patients with a copy of their medical records, in the requested format, in a reasonable time frame.

2019 OCR HIPAA Settlements

HIPAA-Regulated Entity Reason Individuals Impacted Amount
West Georgia Ambulance Risk analysis failure; no security awareness training program; failure to implement HIPAA Security Rule policies and procedures. 500 $65,000
Korunda Medical, LLC HIPAA Right of Access failure. 1 or more $85,000
Sentara Hospitals Breach notification failure; business associate agreement failure 577 $2,175,000
University of Rochester Medical Center Loss of flash drive/laptop; no encryption; risk analysis failure; risk management failure; lack of device media controls. 43 $3,000,000
Elite Dental Associates Social media disclosure; notice of privacy practices; impermissible PHI disclosure. Unconfirmed $10,000
Bayfront Health St Petersburg HIPAA Right of Access failure 1 $85,000
Medical Informatics Engineering Risk analysis failure; impermissible disclosure of 3.5 million records 3,500,000 $100,000
Touchstone Medical imaging No BAAs; insufficient access rights; risk analysis failure; failure to respond to a security incident; breach notification failure; media notification failure; impermissible disclosure of 307,839 individuals’ PHI. 307,839 $3,000,000

2019 OCR Civil Monetary Penalties

HIPAA-Regulated Entity Reason Individuals Impacted Amount
Texas Department of Aging and Disability Services Risk analysis failure; access control failure; information system activity monitoring failure; impermissible disclosure of 6,617 patients ePHI 6,617 $1,600,000
Jackson Health System Multiple Privacy Rule, Security Rule, and Breach Notification Rule violations 25,661 $2,154,000

OCR HIPAA Fines 2018

There was a year-over-year increase in HIPAA violation penalties in 2018. 11 financial penalties were agreed in 2018: 10 settlements and one civil monetary penalty. Two records were broken in 2018. 2018 saw the largest ever HIPAA settlement agreed – A $16 million financial penalty for Anthem Inc., to resolve HIPAA violations discovered during the investigation of its 78.8 million record breach in 2015. HIPAA-covered entities also paid more in fines than in any other year since OCR started enforcing compliance with HIPAA Rules: $28,683,400.

2018 OCR HIPAA Settlements

HIPAA-Regulated Entity Reason Individuals Impacted Amount
Cottage Health Risk analysis and risk management failures; No BAA 62,500 $3,000,000
Pagosa Springs Medical Center Failure to terminate employee access; No BAA 557+ $111,400
Advanced Care Hospitalists Impermissible PHI Disclosure; No BAA; Insufficient security measures; No HIPAA compliance efforts prior to April 1, 2014 9,255 $500,000
Allergy Associates of Hartford PHI disclosure to a reporter; No sanctions against employees 1 $125,000
Anthem Inc Risk analysis failure; Insufficient reviews of system activity; Failure to respond to a detected breach; Insufficient technical controls to prevent unauthorized ePHI access 78,800,000 $16,000,000
Boston Medical Center Filming patients without consent Unspecified $100,000
Brigham and Women’s Hospital Filming patients without consent Unspecified $384,000
Massachusetts General Hospital Filming patients without consent Unspecified $515,000
Filefax, Inc. Impermissible disclosure of physical PHI – Left unprotected in truck 2,150 $100,000
Fresenius Medical Care North America 5 breaches: Investigation revealed risk analysis failures; Impermissible disclosure of ePHI; Lack of policies covering electronic devices; Lack of encryption; Insufficient security policies; Insufficient physical safeguards 521 $3,500,000

2018 Civil Monetary Penalties for HIPAA Violations

HIPAA-Regulated Entity Reason Individuals Impacted Amount
University of Texas MD Anderson Cancer Center 3 breaches resulting in an impermissible disclosure of ePHI; No Encryption 34,883 $4,348,000

OCR HIPAA Fines 2017

A summary of the 2017 OCR penalties for HIPAA violations.

2017 OCR HIPAA Settlements

HIPAA-Regulated Entity Breach Summary Individuals Impacted Settlement Amount
Memorial Healthcare System Impermissible access of PHI by employees; Impermissible disclosure of PHI to affiliated physicians’ offices 115,143 $5,500,000
Cardionet Theft of an unencrypted laptop computer 1,391 $2,500,000
Memorial Hermann Health System Disclosure of patient’s PHI to the media 1 $2,400,000
21st Century Oncology Multiple HIPAA violations 2,213,597 $2,300,000
MAPFRE Life Insurance Company of Puerto Rico Theft of an unencrypted USB storage device 2,209 $2,200,000
Presense Health Delayed breach notifications 836 $475,000
Metro Community Provider Network Lack of a security management process to safeguard ePHI 3,200 $400,000
Luke’s-Roosevelt Hospital Center Inc. Impermissible disclosure of PHI to the patient’s employer 1 $387,000
The Center for Children’s Digestive Health Lack of a business associate agreement N/A $31,000

2017 Civil Monetary Penalties for HIPAA Violations

HIPAA-Regulated Entity Breach Summary Individuals Impacted Penalty Amount
Children’s Medical Center of Dallas Theft of unencrypted devices 6,262 $3,200,000

OCR HIPAA Fines 2016

2016 was a record year for financial penalties to resolve violations of HIPAA Rules. 2016 saw 12 settlements agreed and one civil monetary penalty issued by OCR.

2016 OCR HIPAA Settlements

HIPAA-Regulated Entity Breach Summary Individuals Impacted Settlement Amount
Feinstein Institute for Medical Research Improper disclosure of research participants’ PHI 13,000 $3,900,000
Advocate Health Care Network Theft of desktop computers; Loss of laptop; Improper accessing of data at a business associate 3,994,175 $5,550,000
University of Mississippi Medical Center Unprotected network drive 10,000 $2,750,000
Oregon Health & Science University Loss of unencrypted laptop; Storage on a cloud server without BAA 4,361 $2,700,000
New York Presbyterian Hospital Filming of patients by a TV crew Unconfirmed $2,200,000
North Memorial Health Care of Minnesota Theft of laptop computer; Improper disclosure to a business associate 299,401 $1,550,000
St. Joseph Health PHI made available through search engines 31,800 $2,140,500
Raleigh Orthopaedic Clinic, P.A. of North Carolina Improper disclosure to a business associate 17,300 $750,000
University of Massachusetts Amherst (UMass) Malware infection 1,670 $650,000
Catholic Health Care Services of the Archdiocese of Philadelphia Theft of mobile device 412 $650,000
Care New England Health System Loss of two unencrypted backup tapes 14,000 $400,000
Complete P.T., Pool & Land Physical Therapy, Inc. Improper disclosure of PHI (website testimonials) Unconfirmed $25,000

 2016 Civil Monetary Penalties for HIPAA Violations

HIPAA-Regulated Entity Breach Summary Individuals Impacted Penalty Amount
Lincare, Inc. Improper disclosure (unprotected documents) 278 $239,800

What are the Penalties for HIPAA Violations? FAQs

What is the maximum penalty for violating HIPAA?

The maximum penalty for violating HIPAA per violation is currently $68,928. However, it is rare that an event that results in the maximum penalty being issued is attributable to a single violation. For example, a data breach could be attributable to the failure to conduct a risk analysis, the failure to provide a security awareness training program, and a failure to prevent password sharing.

What are the consequences of a HIPAA violation?

The consequences of a HIPAA violation depend on the nature of the violation, the reason(s) behind it, the amount of harm it causes, and the organization´s previous history of compliance. In most cases, HIPAA violations are not attributable to willful neglect and HHS´ Office for Civil Rights will try to resolve first-time HIPAA violations via technical assistance or a corrective action plan.

What is the civil penalty for unknowingly violating HIPAA?

The civil penalty for unknowingly violating HIPAA is no different from knowingly violating HIPAA. As mentioned in the above article, there is no excuse for unknowingly violating HIPAA. The Privacy and Security Rules have been in existence for more than twenty years; and, to quote OCR Director Roger Severino “the civil penalty for unknowingly violating HIPAA is a penalty for disregarding security”.

What are the categories for punishing violations of federal health care laws?

The categories for punishing violations of federal health care laws vary considerably depending on which law is being violated or which section of which law is being violated. For example, with regard to the penalties for HIPAA violations, there are four civil categories for punishing violations and three criminal categories. However, in other federal healthcare laws (for example, the Social Security Act), there can be dozens of categories for punishing violations of federal healthcare laws.

What criminal consequences are possible with a Tier 3 violation?

The criminal consequences possible with a Tier 3 violation – wrongfully and knowingly obtaining PHI for personal gain, commercial advantage, or with malicious intent – are up to ten years in jail and/or a fine of up to $250,000. These penalties are pursued by the Department of Justice rather than HHS´ Office for Civil Rights.

What are the fines for HIPAA violations?

The fines for HIPAA violations (per violation – as of December 2023) are:

Tier 1 – from $137 to $34,464

Tier 2 – from $1,379 to $68,928

Tier 3 – from $13,785 to $68,928

Tier 4 – $68,928 per violation

It is important to be aware that, in addition to the fines for HIPAA violations issued by HHS´ Office for Civil Rights, State Attorneys General can issue additional fines for HIPAA violations. Furthermore, depending on the nature of the violation(s), it may be possible for affected individuals to bring a class action lawsuit against an organization guilty of a HIPAA violation.

What does a corrective action plan consist of?

A corrective action plan consists of measures to address the underlying issue(s) that led to a HIPAA violation(s) and therefore what the action plan consists of will be relevant to the nature of the violation(s). Typically, Covered Entities and Business Associates will be required to develop or revise policies to fill gaps in their compliance; and, when new or revised policies affect the functions of the workforce, provide training on the new or revised policies.

Are penalties for HIPAA violations always related to data breaches?

Penalties for HIPAA violations are not always related to data breaches. As you will see from the tables above, several Covered Entities have been fined or reached settlement resolutions for failing to provide patients with access to healthcare records within the permitted 30 days. One Covered Entity was fined for failing to have a Business Associate Agreement in place before disclosing ePHI to a Business Associate. None of these penalties for HIPAA violations involved a breach of unsecured PHI.

How does the Office for Civil Rights find out about HIPAA violations?

The Office for Civil Rights finds out about HIPAA violations in a number of ways. For example, Covered Entities are required to report breaches of unsecured PHI within 60 days (or annually if the breach involves fewer than 500 patients), patients can use the OCR complaints portal to report a delay or refusal to access health information, and members of Covered Entities´ workforces are granted whistleblower protection for reporting non-compliance.

What if a violation occurs due to a common non-compliant practice?

If a HIPAA violation occurs due to a common non-compliant practice, the penalty will depend on the nature of the violation, the consequences of the violation, and the perpetrator’s previous compliance history. Most often, a penalty will consist of refresher training and a compliance monitoring program – potentially by a third-party organization at the organization´s own cost.

Are HIPAA violations criminal?

HIPAA violations are criminal when an individual knowingly and wrongfully discloses individually identifiable health information. In such cases, a violation can be referred to the Department of Justice for criminal investigation. If the individual is found guilty of a criminal offense under § 1320d-6 of the Social Security Act, they can be fined up to $250,000 and sentenced to up to ten years in jail.

Has anybody ever received a custodial sentence for violating HIPAA?

A custodial sentence for violating HIPAA is rare, but it has happened – for example, when an employee has been found guilty of stealing PHI to commit identity theft or to sell for personal gain. Even when a violation does not result in a custodial sentence, the offending employee will likely be fined, lose their job, and have their license to practice withdrawn. Depending on how the employee accessed the data, Covered Entities, and Business Associates can also be fined for the same violation.

Who issues HIPAA violation fines?

HIPAA violation fines are most often issued by the Department of Health and Human Services’ Office for Civil Rights. However, fines for HIPAA violations can also be issued by State Attorneys General and the Federal Trade Commission; and – when the violation is criminal in nature – the Department of Justice can pursue criminal prosecutions against the perpetrators, which can also result in fines.

The Centers for Medicare and Medicaid Services (CMS) also have the authority to issue fines for violations of the HIPAA Administrative Requirements (45 CFR Part 162). To date, CMS has not exercised this option – preferring instead to resolve violations of Part 162 with technical assistance and corrective action plans.

Are HIPAA breach penalties always financial?

HIPAA breach penalties are not always financial. In fact, HHS’ Office for Civil Rights has only issued financial penalties in around 2% of cases it has investigated for HIPAA breaches – and penalties issued by State Attorneys General and the FTC are even rarer. The majority of HIPAA breaches are resolved via voluntary compliance, technical assistance, or a corrective action plan.

What HIPAA penalties are imposed by the State Attorneys General?

HIPAA penalties can be imposed by state Attorneys General when there is reason to believe residents of the state have been adversely affected by a violation of HIPAA. In such cases, state Attorneys General can bring a civil action on behalf of residents of the state, with penalties ranging from $100 per violation (per affected resident) to $25,000 per violation type (per affected resident).

Can CMS issue fines for HIPAA violations?

CMS can issue fines for HIPAA violations when the violation relates to the HIPAA Administrative Requirements (45 CFR Part 162). As yet, CMS has not exercised its authority to issue fines for HIPAA violations – instead resolving Part 162 complaints via voluntary compliance, technical assistance, and corrective action plans.

When can the FTC issue HIPAA violation penalties?

The FTC can issue HIPAA violation penalties when an individual or organization not covered by HIPAA experiences a data breach of unsecured PHI or fails to notify individuals following a data breach. Typically, organizations that create or maintain health data that is not covered by HIPAA include vendors of personal health appliances and wearables that transmit data to/from the vendor’s servers.

What is the penalty for a HIPAA violation by a hospital volunteer?

The penalty for a HIPAA violation by a hospital volunteer is the same as if the violation was committed by a paid member of the workforce. Similarly, if a patient complains to HHS’ Office for Civil Rights – and the complaint is investigated – the investigation will not consider the employed status of the violator because Covered Entities are required to train all members of the workforce on HIPAA policies and procedures regardless of whether they are volunteers, students, or employees.

How much is a HIPAA violation penalty?

How much a HIPAA violation penalty is depends on the nature of the violation, the consequences of the violation, the perpetrator’s prior compliance history, their willingness to assist any investigation into the violation, and the speed at which measures are put in place to prevent the violation from happening again. It can also be the case that HHS’ Office for Civil Rights uses a HIPAA violation penalty to “send a message” to other Covered Entities.

What are the HIPAA violation consequences for a medical student?

The HIPAA violation consequences for a medical student will depend on the sanctions policy at the healthcare facility where they are working. Usually – unless the HIPAA violation has serious consequences – the medical student will receive a verbal warning. However, the verbal warning will be recorded in their HR file and may affect future employment opportunities.

Who sets HIPAA fines and penalties?

HIPAA fines and penalties actually existed before HIPAA and were originally related to fraudulent claims for treatment made by healthcare providers to federal agencies (i.e., Medicare). The fines and penalties were increased in the text of HIPAA and applied to violations of the Privacy and Security Rules in 2005 when the Department for Health and Human Services (HHS) published the Enforcement Rule.

The HIPAA fines and penalties were subsequently increased by Congress via the HITECH Act 2009, since 2015, the fines and penalties issued by HHS’ Office for Civil Rights have been adjusted annually to account for inflation. There have been no increases in the HIPAA fines and penalties that can be imposed by State Attorneys General since the passage of HITECH nor in the fines and penalties for criminal violations of HIPAA.

Are HIPAA breach fines always the same for each type of violation?

HIPAA breach fines can be the same for each type of violation but – under §160.408 of the Administrative Simplification provisions – the Secretary for Health and Human Services is required to take a number of factors into account when determining the amount of a HIPAA breach fine.

What is the cost of a HIPAA violation?

The cost of a HIPAA violation varies according to the nature of the violation, who is responsible for it, and what the consequences are. For example, a disclosure of more than the minimum necessary PHI by a member of a Covered Entity’s workforce who with no previous record of non-compliance will likely receive a verbal warning and may have to undergo further training.

Conversely, a healthcare organization that willfully and knowingly neglects to implement the Security Rule safeguards, and consequently experiences a data breach affecting thousands of patients, will likely receive a multi-million dollar fine. Between the two extremes, most violations incur some degree of cost – whether it is reported internally or notified to HHS’ Office for Civil Rights.

Can patients claim monetary damages for a HIPAA violation?

Patients cannot claim monetary damages for a HIPAA violation under HIPAA law, but many states have privacy, security, and/or breach notification laws that do allow for a private right of action depending on the nature of the violation and the degree of harm suffered. If individuals feel they have suffered harm due to the negligence of a HIPAA Covered Entity or Business Associate, they should seek independent legal advice from an attorney.

What are HIPAA penalties for non-compliance?

HIPAA penalties for non-compliance vary according to the nature of the violation, which section of HIPAA has been violated, and the consequences of the violation. The HIPAA penalties for non-compliance also vary according to who the non-compliant party is. For example, the penalties for non-compliance by a member of the workforce will likely be a verbal or written warning, while the penalties for non-compliance by a Covered Entity will range from technical assistance to a fine.

What is the fine described by HIPAA/HITECH for companies that accidentally release PHI but perform due diligence?

The fine described by HIPAA/HITECH for companies that accidentally release PHI but perform due diligence is a Tier 1 fine for the “Lack of Knowledge” level of culpability. At present (December 2023), the amount of the fine is between $137 per violation to $34,464 per violation – but these amounts will be adjusted for inflation during 2024.

What is the maximum fine per HIPAA violation according to the Final Omnibus Rule?

The maximum fine per HIPAA violation according to the Final Omnibus Rule is $1.5 million. However, it is important to be aware that the tiered HIPAA penalty structure with the $1.5 million penalty cap was introduced by the HITECH Act in 2009 and adopted by the Final Omnibus Rule in 2013. Additionally, since 2015, the maximum fine per HIPAA violation has been increased each year to account for inflation.

What are the criminal penalties for HIPAA violations?

The criminal penalties for HIPAA violations vary according to the motive for the offense. According to §1177 of the Social Security Act, a person who obtains, discloses, uses – or causes to be used – individually identifiable health information maintained by a Covered Entity can be fined up to $50,000 and/or imprisoned for up to a year.

However, if the offense is committed under false pretenses, the fine increases up to $100,000 and the prison term up to five years; and, if the offense is committed with the intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm, the fine increases up to $250,000 and the jail term up to ten years.

What are the consequences of violating HIPAA for a nurse?

The consequences of violating HIPAA for a nurse most often depend on the nature of the violation, the impact of the violation, the nurse’s previous compliance record, and the content of the Covered Entity’s sanctions policy. Typically, a first offense with a minor impact will result in a verbal warning and/or refresher training. However, the consequences of violating HIPAA for a nurse could escalate for a serious or repeated offense to a written warning, a suspension, or termination of employment.

Are there HIPAA violation fines for individuals?

There are no HIPAA violation fines for individuals unless an individual qualifies as a HIPAA Covered Entity or Business Associate (i.e., a freelance counselor) and they violate HIPAA in their role as such. Individuals employed by Covered Entities or Business Associates cannot be fined for civil violations but could be fined if a violation is considered criminal and referred to the Department of Justice.

What is the minimum fine for intentional and uncorrected release of PHI?

The minimum fine for intentional and uncorrected release of PHI is currently $68,928 if the offender is a Covered Entity or Business Associate. If the offender is a member of a Covered Entity’s or Business Associate’s workforce, and they violate HIPAA intentionally with criminal intent, there is no set minimum fine. The Courts can decide on a fine of up to $250,000.

What are HIPAA civil monetary penalties?

HIPAA civil monetary penalties are fines sometimes imposed on HIPAA Covered Entities and Business Associates for violations of HIPAA. The term can sometimes be shortened to HIPAA penalties, or HIPAA settlements when the perpetrator negotiates a settlement with HHS’ Office for Civil Rights to avoid a lengthy – and potentially costly – dispute over how the civil monetary penalties should be.

Are HIPAA violations sanctioned differently in different states?

HIPAA violations are not sanctioned differently in different states; although, in some areas, State Attorneys General are more willing to pursue HIPAA violation sanctions against a Covered Entity than in other states. This may be because the state has more stringent privacy or data security regulations than HIPAA, or because a significant number of state residents are impacted by HIPAA violations.

The post What are the Penalties for HIPAA Violations? appeared first on HIPAA Journal.

M.D. Anderson Cancer Center Has $4.3 Million OCR HIPAA Fine Overturned on Appeal

The U.S. Court of Appeals for the Fifth Circuit has overturned a $4,348,000 HIPAA violation penalty imposed on University of Texas M.D. Anderson Cancer Center by the Department of Health and Human Services’ Office for Civil Rights.

The Civil Monetary Penalty was imposed on M.D. Anderson in 2018 following an investigation of three data breaches that were reported to the Office for Civil Rights between 2013 and 2014 that involved the loss/theft of unencrypted devices between 2012 and 2013. Two unencrypted flash drives containing the ePHI of 2,264 and 3,598 patients were lost, and an unencrypted laptop computer containing the ePHI of 29,021 patients was stolen.

The Office for Civil Rights investigation concluded that M.D. Anderson was in violation of two provisions of the HIPAA Rules. The first violation was the failure to implement encryption or adopt an alternative and equivalent method to limit access to ePHI stored on electronic devices, and the second prohibits unauthorized disclosures of ePHI.

HIPAA penalties are tiered and are based on the level of culpability, with the Office for Civil Rights determining M.D. Anderson had reasonable cause to know it was in violation of the HIPAA Rules. OCR calculated the appropriate penalties to be $1,348,000 for the of lack of encryption and $1.5 million per year for the impermissible disclosures of ePHI.

M.D. Anderson contested the financial penalties and after two unsuccessful reviews, OCR imposed the civil monetary penalties on the Texas healthcare provider in June 2018. M.D. Anderson then petitioned the 5th Circuit Court of Appeals to review the ruling in April 2019.

M.D. Anderson maintained that the HHS’ Office for Civil Rights is a federal agency and exceeded its authority by imposing the civil monetary penalties, since M.D. Anderson is a state agency and is therefore not a ‘person’ covered by the Enforcement Provision of the Health Insurance Portability and Accountability Act. M.D. Anderson also alleged the financial penalty was excessive. At the time it was the third largest HIPAA penalty to be imposed on a single covered entity for violations of the HIPAA Rules.

The two failed reviews resulted in the case going before an Administrative Law Judge (ALJ) who refused to rule on whether HIPAA, the HITECH Act, any other statute applied, nor whether the civil monetary penalty was arbitrary or capricious.

The 5th Circuit explained, “For the sake of today’s decision, we assume that M.D. Anderson is such a “person” and that the enforcement provision therefore applies. The petition for review nonetheless must be granted for an independent reason: the CMP violates the Administrative Procedure Act (“APA”).”

After reviewing the financial penalty, the Court of Appeals ruled that the Office for Civil Rights had acted arbitrarily, and its decision was capricious and contrary to law for at least four independent reasons. As required by HIPAA, M.D. Anderson had implemented a mechanism for encryption as early as 2006, but the Office for Civil Rights failed to demonstrate that M.D. Anderson had not done enough to secure the ePHI of its patients. It was only possible to demonstrate that three employees had failed to abide by M.D. Anderson’s encryption policies.

The Court of Appeals also found issue with the impermissible disclosure aspect of the decision. The HIPAA definition of disclosure suggests an affirmative act rather than a passive loss of information, and also that ePHI would need to be disclosed to someone outside the covered entity, when that could not be determined in this case.

The Court of Appeals also found the decision to fine some covered entities for loss/theft incidents and not others was inconsistent. Regarding the penalty amount, under the “reasonable cause” penalty tier, the maximum fine for violations of an identical provision during a calendar year may not exceed $100,000. The ALJ and the Departmental Appeals Board nevertheless determined that the per-year statutory cap was $1,500,000.

Following the petition to the Court of Appeals, the HHS’ Office for Civil Rights conceded that the $4,348,000 financial penalty could not be justified and asked the Court of Appeals to reduce the fine by a factor of ten to $450,000.

The Court of Appeals concluded that the Government had offered no lawful basis for the civil monetary penalties, vacated the CMP order, and remanded the matter for further proceedings consistent with the court’s opinion.

The post M.D. Anderson Cancer Center Has $4.3 Million OCR HIPAA Fine Overturned on Appeal appeared first on HIPAA Journal.

2020-2021 HIPAA Violation Cases and Penalties

The Department of Health and Human Services’ Office for Civil Rights (OCR) settled 19 HIPAA violation cases in 2020. More financial penalties were issued in 2020 than in any other year since the Department of Health and Human Services was given the authority to enforce HIPAA compliance. $13,554,900 was paid to OCR to settle the HIPAA violation cases. 2021 saw a slight reduction in the number of settlements and fines for HIPAA violations, with 14 enforcement actions announced by OCR. Even so, 2021 had the second-highest number of HIPAA fines of any year since OCR started enforcing compliance with the HIPAA Rules.

While the number of penalties was still high in 2021, there was a sizeable reduction in penalty amounts which totaled $5,982,150 for the year, and $5,100,000 of that total came from just one enforcement action. The reason for this is that most of the penalties were for violations of the HIPAA Right of Access, and were in response to investigations of complaints filed by patients who had not been provided with timely access to their medical records, rather than penalties for violations of multiple HIPAA Rules that impacted large numbers of individuals. The $5,100,000 penalty, imposed on Excellus Health Plan, was so large because there were multiple violations of the HIPAA Rules, over multiple years, that led to a breach of the ePHI of 9,358,891 individuals.

Penalties for Noncompliance with the HIPAA Right of Access

In late 2019, OCR announced a new HIPAA enforcement initiative to tackle non-compliance with the Right of Access standard of the HIPAA Privacy Rule. Since then, OCR has been rigorously enforcing compliance with the HIPAA Right of Access and as of December 2021, has imposed 25 penalties for HIPAA Right of Access violations totaling $1,564,650. The fines range from $3,500 to $200,000. There have been 24 settlements and one civil monetary penalty, with many of the fines imposed on small healthcare providers.

The HIPAA Right of Access standard – 45 C.F.R. § 164.524(a) – gives patients the right to access, inspect, and obtain a copy of their own protected health information in a designated record set.  When a request is received from an individual or their personal representative, the records must be provided within 30 days. A reasonable, cost-based fee may be charged for providing a copy of the requested records. A request for access to an individual’s health records may be denied, but only in very limited circumstances.

OCR investigates complaints from individuals who allege they have been denied access to their health records, have not received records within 30 days, or have been charged excessive amounts for copies of their records. The financial penalties imposed by OCR in 2020 for HIPAA Right of Access violations ranged from $15,000 to $160,000 and stemmed from refusals to provide copies of records or long delays. In many cases, records were only provided after OCR intervened.

2021 HIPAA Right of Access Enforcement Actions

Covered Entity Penalty Outcome
Banner Health 200,000 Settlement
Rainrock Treatment Center LLC (dba monte Nido Rainrock) 160,000 Settlement
Dr. Robert Glaser 100,000 Civil Monetary Penalty
Children’s Hospital & Medical Center 80,000 Settlement
Renown Health 75,000 Settlement
Sharpe Healthcare 70,000 Settlement
Arbour Hospital 65,000 Settlement
Advanced Spine & Pain Management 32,150 Settlement
Denver Retina Center 30,000 Settlement
Village Plastic Surgery 30,000 Settlement
Wake Health Medical Group 10,000 Settlement

Other 2021 HIPAA Violation Penalties

Covered Entity Penalty Outcome
Excellus Health Plan $5,100,000 Settlement
AEON Clinical Laboratories (Peachstate) $25,000 Settlement

Only two HIPAA enforcement actions in 2021 were not the result of HIPAA Right of Acess violations.

Excellus Health Plan

Rochester, New York-based Excellus Health Plan, a member of the Blue Cross Blue Shield Association, was investigated to identify potential HIPAA compliance issues following a report of a data breach of 9,358,891 records in 2015. It was one of three mega data breaches to be reported by health plans that year, Anthem Inc and Premera Blue Cross being the other two, both of which had settled their cases and paid sizeable penalties.

Excellus discovered the breach in August 2015, with its investigation revealing hackers had access to its systems between December 23, 2013, and May 11, 2015. The breach was reported to OCR on September 9, 2015. Malware had been installed which allowed the hackers to exfiltrate the data of around 7 million Excellus Health Plan members and approximately 2.5 million members of Lifetime Healthcare, its non-BlueCross subsidiary, which included names, contact information, dates of birth, Social Security numbers, health plan ID numbers, claims data, financial account information, and clinical treatment information.

OCR’s investigation uncovered multiple HIPAA violations, including the failure to conduct an accurate and thorough organization-wide risk analysis, the failure to reduce risks and vulnerabilities to ePHI to a reasonable and appropriate level, and a lack of technical policies and procedures to limit data access to authorized persons and software programs. Excellus chose to settle the case and paid a $5,100,000 penalty and agreed to implement a comprehensive Corrective Action Plan to address all areas of non-compliance.

Peachstate Health Management LLC, dba AEON Clinical Laboratories

The enforcement action against Peachstate Health Management is notable because this was the first OCR investigation to result in a financial penalty for HIPAA violations identified in a company that was not the initial subject of the investigation.

OCR launched an investigation after receiving a report from the Department of Veteran Affairs in 2015 about a data breach involving its business associate, Authentidate Holding Corporation (AHC). AHC managed the VA’s Telehealth Services Program and suffered a data breach. While investigating, OCR learned that AHC had entered into a reverse merger with Peachstate Health Management on January 27, 2016, which saw Peachstate acquired by AHC. Peachstate is a CLIA-certified laboratory that provides clinical and genetic testing services through its publicly traded parent company, AEON Global Health Corporation (AGHC).

OCR then launched an investigation of Peachstate to assess HIPAA Privacy and Security Rule compliance and found multiple violations of the HIPAA Rules. OCR identified multiple HIPAA Security Rule failures, including risk assessment, risk management, audit controls failures, as well as the failure to maintain documentation of HIPAA Security Rule policies and procedures. The case was settled for $25,000, and a corrective action plan was agreed to resolve the HIPAA violations.

2020 HIPAA Right of Access Enforcement Actions

Covered Entity Penalty Outcome
Dignity Health, dba St. Joseph’s Hospital and Medical Center $160,000 Settlement
NY Spine $100,000 Settlement
Beth Israel Lahey Health Behavioral Services $70,000 Settlement
University of Cincinnati Medical Center $65,000 Settlement
Housing Works, Inc. $38,000 Settlement
Peter Wrobel, M.D., P.C., dba Elite Primary Care $36,000 Settlement
Riverside Psychiatric Medical Group $25,000 Settlement
Dr. Rajendra Bhayani $15,000 Settlement
All Inclusive Medical Services, Inc. $15,000 Settlement
Wise Psychiatry, PC $10,000 Settlement
King MD $3,500 Settlement

Other 2020 HIPAA Violation Penalties

The remaining HIPAA violation penalties issued in 2020 were issued for non-compliance with several provisions of the HIPAA Rules. The penalty amounts reflect the seriousness of the violations, the harm caused, the number of individuals affected, the level of cooperation with OCR, the voluntary actions taken to address the violations, and the ability of the entity to pay. In each of the HIPAA violation cases below, OCR discovered multiple violations of the HIPAA Rules.

Covered Entity Amount Outcome
Premera Blue Cross $6,850,000 Settlement
CHSPSC LLC $2,300,000 Settlement
Athens Orthopedic Clinic $1,500,000 Settlement
Lifespan Health System Affiliated Covered Entity $1,040,000 Settlement
Aetna $1,000,000 Settlement
City of New Haven, CT $202,400 Settlement
Steven A. Porter, M.D $100,000 Settlement
Metropolitan Community Health Services dba Agape Health Services $25,000 Settlement

Second Largest HIPAA Violation Penalty for Premera Blue Cross

The largest HIPAA violation penalty of 2020 was imposed on the health insurer Premera Blue Cross. Premera Blue Cross was investigated over a data breach in which the protected health information of 10,466,692 individuals was obtained by hackers.

During the investigation, OCR discovered multiple potential violations of the HIPAA Security Rule. Premera Blue Cross had failed to conduct a comprehensive risk analysis, had not reduced risks to the confidentiality, integrity, and availability of ePHI to a reasonable and appropriate level, and had implemented insufficient hardware and software controls.

Premera Blue Cross agreed to pay a financial penalty of $6,850,000 to resolve the case and adopted a corrective action plan to address all areas of noncompliance.

In addition to the OCR penalty, Premera Blue Cross settled a multi-state action for $10 million and a class action lawsuit filed on behalf of victims of the breach for $74 million.

The financial penalty was the second-largest ever to be issued by OCR. The largest HIPAA violation penalty – $16 million – was paid by Anthem Inc. in 2018 and resolved an investigation into its 78.8 million record data breach that was discovered in 2015. Following on from that settlement, in 2020 Anthem Inc settled a multi-state action and paid $48.2 million in penalties. Anthem also settled a class action lawsuit filed on behalf of victims of the breach in 2018 for $115 million.

CHSPSC LLC

CHSPSC LLC, a Tennessee-based management company that provides services to many subsidiary hospital operator companies and other affiliates of Community Health Systems, suffered a cyberattack in April 2014 in which compromised admin credentials were used by hackers to gain access to its systems. The hackers stole the ePHI of 6,121,158 individuals.

OCR investigated and found systemic noncompliance with the HIPAA Security Rule. CHSPSC had failed to conduct a comprehensive risk analysis, was not conducting information system activity reviews, and had implemented insufficient access controls and security incident response procedures. When notified about the cyberattack by the FBI, it took CHSPSC two months to respond.

CHSPSC LLC settled the case, paid a $2,300,000 penalty, and adopted a corrective action plan to address all areas of noncompliance. Community Health Systems and CHSPSC LLC also settled a multi-state action with 28 state Attorneys General over the breach for $5,000,000.

Athens Orthopedic Clinic

The Athens, GA-based healthcare provider Athens Orthopedic Clinic suffered a cyberattack in 2016 in which a hacker stole a database containing the PHI of 208,557 patients and demanded payment not to release the stolen data. When payment was not received the database was published.

OCR’s investigation into the breach uncovered systemic noncompliance with the HIPAA Rules. Athens Orthopedic Clinic had failed to conduct a comprehensive risk analysis, had not implemented security procedures to reduce risks to ePHI to a reasonable and appropriate level, had failed to implement appropriate hardware, software, and procedures for recording and analyzing information system activity, and did not implement HIPAA policies until August 2016.

OCR also found the clinic had not entered into business associate agreements with three vendors and did not provide HIPAA Privacy Rule training to the entire workforce until January 15, 2018.

Athens Orthopedic Clinic agreed to settle the case, paid a $1.5 million penalty, and adopted a corrective action plan to address all areas of noncompliance.

Lifespan Health System Affiliated Covered Entity

Lifespan Health System Affiliated Covered Entity is a Rhode Island not-for-profit health system with many healthcare provider affiliates in the state. In February 2017, an unencrypted laptop computer was stolen from an employee’s vehicle. The laptop contained the ePHI of 20,431 patients.

OCR investigated the breach and discovered systemic noncompliance with the HIPAA Rules. Lifespan had conducted a risk analysis and determined encryption was required for its mobile devices due to the high risk of data exposure but failed to implement encryption on mobile devices. The movement of the devices in and out of its facilities was not tracked and there was no comprehensive inventory of mobile devices. OCR also found that there was no business associate agreement between Lifespan Corporation and Lifespan ACE.

Lifespan ACE agreed to settle the case, paid a $1,040,000 penalty, and adopted a corrective action plan to address all areas of noncompliance.

Aetna

Aetna Life Insurance Company and its affiliated covered entity (Aetna) were investigated by OCR after reporting three data breaches in 2017. The first breach involved the exposure of the protected health information of 5,002 plan members over the Internet, and the other two breaches involved mailings in which sensitive PHI could be viewed through the windows of the envelopes. In the first mailing to 11,887 individuals the words ‘HIV medication’ could be viewed through the windows of the envelopes. In the second mailing to 1,600 individuals, the name and logo of an atrial fibrillation study could be viewed.

OCR determined Aetna had not performed periodic technical and non-technical evaluations of operational changes affecting the security of their ePHI, procedures had not been implemented to verify the identity of individuals or entities looking to access their ePHI, disclosures of ePHI had not been limited to the minimum necessary information to achieve the purpose for the disclosures, and there was a lack of appropriate administrative, technical, and physical safeguards to ensure the privacy of ePHI.

Aetna agreed to settle the case, paid a $1 million penalty, and agreed to adopt a corrective action plan to address all areas of noncompliance.

Other penalties related to be breach include a $1.15 million settlement with the New York Attorney General, a $935,000 settlement with the California Attorney General, and similar settlements with Connecticut ($99,959), the District of Columbia ($175,000), and New Jersey ($365,211.59). A class action lawsuit filed on behalf of victims of the breach was settled for $17.2 million.

City of New Haven, CT

In January 2017, the City of New Haven in Connecticut reported a data breach of the ePHI of 498 individuals to OCR. The city had terminated an employee in 2016 during her probationary period. The former employee returned to the New Haven Health Department with her union representative after she had been terminated, used her work key to access her old office, and locked herself inside. She used her login credentials to access a work computer and copied data onto a USB drive before leaving.

In addition to failing to terminate the former employee’s access rights, OCR discovered a comprehensive risk analysis had not been performed, the city had failed to implement HIPAA Privacy Rule policies, and had not issued unique IDs to allow system activity to be tracked.

The City of New Haven settled the case, paid a $202,400 financial penalty, and agreed to adopt a corrective action plan to address all areas of noncompliance.

Steven A. Porter, M.D

The medical practice of Steven A. Porter, M.D in Ogden, UT provides gastroenterological services to more than 3,000 patients. On November 13, 2013, OCR received a breach notification alleging Dr. Porter’s electronic medical record company was impermissibly using patients’ electronic medical records by blocking the practice’s access to ePHI until a $50,000 bill was paid.

OCR investigated and found serious violations of the HIPAA Security Rule at the practice. At the time of the investigation, a risk analysis had never been performed and risks to the confidentiality, integrity, and availability of ePHI had not been managed and reduced to a reasonable and acceptable level. The practice had also allowed Dr. Porter’s EHR company to create, receive, maintain, or transmit ePHI on behalf of the practice, without entering into a business associate agreement.

Dr. Porter settled the case, paid a $100,00 financial penalty, and agreed to adopt a corrective action plan to address all areas of noncompliance.

Metropolitan Community Health Services / Agape Health Services

Metropolitan Community Health Services is a Washington, NC-based Federally Qualified Health Center that provides integrated medical, dental, behavioral health & pharmacy services for adults and children. Operating as Agape Health Services, Metro provides discounted medical services to the underserved population in rural North Carolina.

In June 2011, Metro notified OCR about a breach of the PHI of 1,263 patients. OCR conducted a compliance review and identified longstanding, systemic noncompliance with the HIPAA Security Rule.

Prior to the breach, Metro had not implemented HIPAA Security Rule policies and procedures, had failed to conduct an accurate risk analysis, and had not provided security awareness training to its workforce for more than 16 years.

Metro settled the case, paid a $25,000 penalty, and agreed to adopt a corrective action plan to address all areas of noncompliance.

Further information on HIPAA Penalties

You can view a summary of the HIPAA violation penalties in previous years on this link.

The post 2020-2021 HIPAA Violation Cases and Penalties appeared first on HIPAA Journal.

OCR Continues HIPAA Right of Access Crackdown with $200,000 Fine

The HHS’ Office for Civil Rights (OCR) is continuing to crackdown on healthcare providers that are not providing patients with timely access to their medical records. Yesterday, OCR announced a settlement had been agreed with Banner Health to resolve a HIPAA Right of Access investigation. Banner Health agreed to pay $200,000 to settle the case.

The HIPAA Privacy Rule gives individuals the right to access, inspect, and obtain a copy of their own protected health information. When a request is received, HIPAA-covered entities are required to provide a copy of the requested records within 30 days.

In late 2019, OCR announced it was cracking down on noncompliance with this important provision of HIPAA. Since then, 14 financial penalties have been imposed on covered entities that have failed to provide patients with timely access to their medical records.

Phoenix, AZ-based Banner Health is one of the largest health care systems in the United States. The non-profit health system operates 30 hospitals and many primary care, urgent care, and specialty care facilities.

OCR received two complaints from patients of Banner Health affiliated covered entities alleging long delays receiving copies of medical records. The first patient submitted a request to Banner Estrella Medical Center in December 2017 and was not provided with the requested records until May 2018. A second complaint was received alleging another patient had to wait 5 months for an electronic copy of his records. The request was submitted to Banner Gateway Medical Center in September 2019 and he did not receive the records until February 2020.

The $200,000 financial penalty is the largest HIPAA fine imposed on a HIPAA-covered entity by OCR under its HIPAA Right of Access enforcement initiative. In addition to paying the financial penalty, Banner Health has agreed to adopt a corrective action plan that includes reviewing and revising written policies on health record access, implementing those policies, and providing training to staff on the new policies.  OCR will monitor Banner Health for 2 years to ensure compliance.

“This first resolution of the year signals that our Right of Access Initiative is still going strong and that providers of all sizes need to respect the right of patients to have timely access to their medical records,” said OCR Director Roger Severino.

The post OCR Continues HIPAA Right of Access Crackdown with $200,000 Fine appeared first on HIPAA Journal.

HITECH Act Amendment Creating Cybersecurity Safe Harbor Signed into Law

On January 5, 2020, President Trump added his signature to a bill (HR 7898) that amends the Health Information Technology for Economic and Clinical Health Act (HITECH Act) and creates a safe harbor for companies that have implemented recognized security best practices prior to experiencing a data breach.

While the bill does not go as far as preventing the Department of Health and Human Services’ Office for Civil Rights from imposing financial penalties for HIPAA compliance issues that contributed to a data breach, the amendment requires OCR to take into consideration the security measures that were in place to reduce cybersecurity risk in the 12 months prior to a data breach.

The main aim of the bill is to incentivize healthcare organizations to adopt an established, formalized, and recognized cybersecurity framework and adhere to industry security best practices, as doing so will provide a degree of insulation against regulatory enforcement actions.

The bill requires the HHS to consider an entity’s use of recognized security best practices when investigating reported data breaches and considering HIPAA enforcement penalties or other regulatory actions. If an entity has adopted the NIST Cybersecurity Framework or HITRUST CSF for example, it will be taken into consideration when calculating fines related to security breaches. Adoption of security best practices will mitigate remedies that would otherwise be agreed between an entity and the HHS to resolve potential violations of the HIPAA Security Rule.

The bill also requires the HHS to decrease the extent and length of audits if an entity is determined to have achieved industry-standard security best practices and makes it clear that the HHS is not authorized to increase fines for entities found not to have adhered to recognized security practices.

Recognized security practices are defined as “the standards, guidelines, best practices, methodologies, procedures, and processes developed under section 2(c)(15) of the National Institute of Standards and Technology (NIST) Act, the approaches promulgated under section 405(d) of the Cybersecurity Act of 2015, and other programs and processes that address cybersecurity and that are developed, recognized, or promulgated through regulations under other statutory authorities. Such practices shall be determined by the covered entity or business associate, consistent with the HIPAA Security Rule.”

The healthcare industry is extensively targeted by hackers and healthcare data breaches are becoming much more common. Each year, the number of successful cyberattacks on healthcare organizations and their business associates increases and 2020 was no exception. 2020 was the worst ever year for healthcare industry data breaches by far. It is also worth noting that 2020 saw more HIPAA penalties imposed on HIPAA covered entities and business associates by the HHS’ Office for Civil Rights than any other year since the HHS was given the authority to impose financial penalties for HIPAA violations.

Healthcare organizations and HIPAA business associates that have not yet adopted a common cybersecurity framework or other recognized security practices should consider doing so now. Adoption of recognized security practices will help to reduce the risk of a data breach as well as the negative consequences if a data breach does occur.

The post HITECH Act Amendment Creating Cybersecurity Safe Harbor Signed into Law appeared first on HIPAA Journal.

OCR Announces its 19th HIPAA Penalty of 2020

The Department of Health and Human Services’ Office for Civil Rights (OCR) has settled a HIPAA Right of Access compliance case with Peter Wrobel, M.D., P.C., doing business as Elite Primary Care.

Elite Primary Care is a provider of primary health services in Georgia. OCR launched a compliance investigation following receipt of a compliant from an Elite Primary Care patient on April 22, 2019 who alleged he had been denied access to his health records. OCR contacted the practice and provided technical assistance on the HIPAA Right of Access on May 2, 2019. OCR advised the practice to review the facts of the request and provide access to the requested records if the request met the requirements of the HIPAA Privacy Rule.

The patient subsequently submitted a request for access in writing which was received by the practice on June 5, 2019. The patient filed a second complaint with OCR on October 9, 2019, as the practice continued to deny him access to his requested records.

Elite Primary Care sent the patient’s medical records to his new healthcare provider on November 21, 2019 and provided the patient with a copy of those records on May 8, 2020.

OCR concluded the delay in providing the patient with a copy of his requested records was in violation of the HIPAA Right of Access (45 C.F.R. § 164.524).

Under the terms of the settlement, Elite Primary Care will pay a financial penalty of $36,000 and adopt a corrective action plan that includes developing, implementing, maintaining, and revising, as necessary, written policies and procedures related to the HIPAA Right of Access provision of the HIPAA Privacy Rule. Once those policies and procedures have been checked by OCR, training will be provided to relevant members of its workforce.

The settlement was agreed with no admission of liability. OCR will monitor Elite Primary Care for 2 years to ensure continued compliance.

This is the thirteenth settlement to be announced by OCR under its HIPAA Right of Access enforcement initiative and the nineteenth HIPAA financial penalty to be announced in 2020.

“OCR created the Right of Access Initiative to address the many instances where patients have not been given timely access to their medical records.  Health care providers, large and small, must ensure that individuals get timely access to their health records, and for a reasonable cost-based fee,” said OCR Director Roger Severino.

The post OCR Announces its 19th HIPAA Penalty of 2020 appeared first on HIPAA Journal.

November 2020 Healthcare Data Breach Report

For the second successive month, the number of reported healthcare data breaches has fallen; however, it should be noted that the number of breaches reported in October 2020 was almost three times the average monthly number due, in a large part, to the ransomware attack on the cloud service provider Blackbaud.

November saw 47 data breaches of 500 or more healthcare records reported to the HHS’ Office for Civil Rights by HIPAA-covered entities and business associates, 25.39% fewer than October. Even with that reduction, breaches are still well above the 12-month average of 41 data breaches a month (Median = 38 breaches).

 

The number of healthcare records exposed in healthcare data breaches similarly fell for the second successive month. In November, 1,139,151 healthcare records were exposed or impermissibly disclosed, a 54.73% fall from October. The average number of monthly breached healthcare records over the past 12 months is 1,885,959 records and the median is 1,101,902 records.

Exposed healthcare records past 12 months

Largest Healthcare Data Breaches Reported in November 2020

Name of Covered Entity State Covered Entity Type Individuals Affected Type of Breach Cause
AspenPointe, Inc. CO Healthcare Provider 295,617 Hacking/IT Incident Ransomware attack
Lawrence General Hospital MA Healthcare Provider 176,587 Hacking/IT Incident Unspecified data security incident
Alamance Skin Center NC Healthcare Provider 100,000 Loss Ransomware attack
Mercy Iowa City IA Healthcare Provider 92,795 Hacking/IT Incident Phishing
Bayhealth Medical Center, Inc. DE Healthcare Provider 78,006 Hacking/IT Incident Blackbaud ransomware attack
Tufts Health Plan MA Health Plan 60,545 Hacking/IT Incident Phishing attack on vendor
Bruce L. Boros, M.D., P.A. DBA Advanced Urgent Care FL Healthcare Provider 58,823 Unauthorized Access/Disclosure Ransomware attack
Methodist Hospital of Southern California CA Healthcare Provider 39,881 Hacking/IT Incident Blackbaud ransomware attack
One Touch Point WI Business Associate 28,658 Unauthorized Access/Disclosure unknown
People Incorporated MN Healthcare Provider 27,500 Hacking/IT Incident phishing
Chesapeake Regional Healthcare VA Healthcare Provider 24,000 Hacking/IT Incident Blackbaud ransomware attack
Seeley Enterprises Company OH Healthcare Provider 16,196 Hacking/IT Incident Ransomware attack
Golden Gate Regional Center CA Business Associate 11,315 Hacking/IT Incident Ransomware attack
Galstan & Ward Family and Cosmetic Dentistry VA Healthcare Provider 10,759 Hacking/IT Incident Ransomware attack
Kaiser Foundation Health Plan of Georgia, Inc. GA Health Plan 10,205 Unauthorized Access/Disclosure Unknown

Causes of November 2020 Healthcare Data Breaches

Hacking/IT incidents continue to dominate the breach reports, both in terms of the number of breaches and the number of breached records. There were 23 hacking/IT incidents reported in November – 48.94% of all breaches reported in the month. 867,983 records were exposed or stolen in those breaches – 76.2% of all records breached in November. The average breach size was 37,738 records and the median breach size was 8,000 records.

There were 19 data breaches classed as unauthorized access/disclosure incidents – 40.43% of the month’s data breaches. 166,115 healthcare records were improperly accessed or impermissibly disclosed in those incidents – 14.58% of the breached records in November. The average breach size was 8,723 records and the median breach size was 3,557 records.

There were 4 loss/theft incidents (2/2) reported in November involving 103,053 records – 8.51% of the month’s breaches and 103,053 healthcare records were exposed or stolen in those incidents – 9.05% of records breached in November. The average breach size was 25,763 records and the median breach size was 1,265 records. There was one incident involving the improper disposal of paperwork that contained the PHI of an estimated 2,000 individuals.

 

The chart below shows the location of breached protected health information. Up until September 2020, email was the most common location of breached patient data, with the majority of those breaches the result of phishing attacks. That changed in September due to the ransomware attack on Blackbaud. Entities impacted by that data breach continue to submit breach reports, albeit at a low level, with network server incidents remaining high due to the healthcare industry continuing to be targeted by ransomware gangs. Phishing attacks continue to be a problem in healthcare, with 13 large data breaches reported involving PHI stored in email accounts.

Healthcare Data Breaches by Covered Entity Type

Healthcare providers were the worst affected covered entity in November. 34 healthcare providers reported data breaches and 6 data breaches were reported by health plans.

7 data breaches were reported by business associates of HIPAA covered entities; however, 16 breaches in total had some business associate involvement, with 9 of those breaches reported by the covered entity.

Healthcare Data Breaches by State

The November data breaches were reported by HIPAA-covered entities and business associates in 23 states and the District of Columbia. Ohio was the worst affected state with 5 breaches reported, followed by Georgia and Maine with 4, and California, Florida, and Texas with 3 breaches.

Two healthcare data breaches of 500 or more records were reported by entities based in Arkansas, Delaware, Illinois, Kentucky, Maryland, Michigan, and Virginia. One breach was reported in each of Alabama, Colorado, Iowa, Idaho, Louisiana, Minnesota, North Carolina, New Mexico, Pennsylvania, Wisconsin, and the District of Columbia.

HIPAA Enforcement Activity in November 2020

There were three HIPAA enforcement actions announced by the HHS’ Office for Civil Rights in November, all of which were part of its HIPAA Right of Access enforcement initiative. OCR announced the new enforcement initiative in 2019 to crack down on healthcare providers that fail to provide patients with timely access to their health records for a reasonable cost-based fee.

In all three cases, the healthcare providers did not provide a copy of the requested records within the 30-day time frame demanded by the HIPAA Privacy Rule.

University of Cincinnati Medical Center settled with OCR and paid a $65,000 penalty, Riverside Psychiatric Medical Group paid a $25,000 penalty, and Dr. Rajendra Bhayani paid a $15,000 penalty. Under this enforcement initiative, OCR has imposed 12 financial penalties on covered entities, 10 of which have been in 2020.

The post November 2020 Healthcare Data Breach Report appeared first on HIPAA Journal.