HIPAA violations

Can I Be Sued for a HIPAA Violation?

I am asked that question almost weekly. While the answer has traditionally been “no,” the legal landscape is shifting and the risk of being sued continues to increase.

Let’s first start with some background. As some of you may know, HIPAA does not include a “private right of action.” This means that an individual may not file a claim against a covered entity or a business associate in order to enforce HIPAA or seek damages in response to a HIPAA violation. For example, a patient is not able to sue a dentist if the dentist fails to distribute a Notice of Privacy Practices or enter into a business associate agreement. The sole remedy of an aggrieved individual is to file a complaint with the United States Department of Health and Human Services Office for Civil Rights (“OCR”) or, more recently, with a state Attorney General. In addition, in some states, individuals have been able to file complaints regarding generalized privacy concerns with various state regulatory agencies, such as a state health or consumer protection department. With respect to OCR, notification of the right to file a complaint and the process for doing so is generally set forth in a covered entity’s Notice of Privacy Practices.

Since HIPAA was enacted, the lack of a private right of action has provided solace to covered entities and business associates, particularly since complaints tend to be few in number. Moreover, OCR investigations of complaints have often resulted in compliance agreements and consent orders, rather than court actions or civil damages, both of which would require the covered entity or business associate to expend considerable sums on attorney fees, court costs and payment of damages.

While there is no hint at this time that Congress is contemplating including a private right of action in HIPAA (i.e. allowing individuals to sue to enforce HIPAA), aggrieved patients and their counsel have been finding other ways to file claims for HIPAA violations and use HIPAA violations as the basis for seeking monetary damages. For example, in some states, patients have filed suit against health care providers on the grounds of negligence – claiming that the provider was negligent when violating HIPAA and thus must be held liable for damages. A recent example from Connecticut illustrates the way these lawsuits operate:

A physician received a subpoena for medical records. The physician supplied the medical records as requested by the subpoena; however, the subpoena did not comply with HIPAA. The subject of the medical records sued, alleging that HIPAA creates a “standard of care” for all health care providers and that the failure of the physician to adhere to that standard of care was “negligent.” The physician sought to block the suit but the Connecticut Supreme Court allowed it to continue. As of this date, the lawsuit is making its way through the Connecticut state courts. In addition, lawsuits are currently being prepared and filed in response to the recent Anthem breach and many will be claiming negligence or violation of various state privacy or insurance regulations.

These types of lawsuits would have been unheard of even just a few years ago. However, while still not widespread or common, the emergence of these suits poses significant risk management and liability concerns for any health care provider, health insurance company or vendor subject to HIPAA. The risk of a lawsuit is most pertinent to HIPAA violations which may cause financial, reputational or other harm to a party. Hypothetical examples, based upon real life incidents, include:

  • Inappropriate disclosure of medical records in response to a subpoena, which causes a former patient to lose custody of her children.
  • Inappropriate disclosure of a child’s medical record to an estranged parent after the health care provider failed to verify the estranged parent’s authority to access records, which leads to the estranged parent to discover where the child now resides.
  • Inappropriate use of medical records by hospital staff as part of a “hot or not” game which causes severe embarrassment and distress to certain patients. A negligent attorney and an angry patient could potentially make a claim based upon any of the above and may seek a significant financial settlement or payout.

In light of the potential for such lawsuits and the significant damages that may be awarded, covered entities and business associates should consider reviewing their HIPAA compliance programs to identify weaknesses and institute safeguards and protocols to reduce the likelihood of inappropriate disclosures that may lead to a patient filing suit. Such safeguards may include, based upon the above examples, a subpoena review checklist, verification procedures, a reliable reporting protocol or other procedures to allow the entity or its staff to verify that information is being used and disclosed appropriately.

 

The post Can I Be Sued for a HIPAA Violation? appeared first on HIPAA.com.

The Reality of HIPAA Violations and Enforcement

Who is ultimately responsible for enforcement of HIPAA and what types of penalties are levied when a covered entity or business associate is found to be non-compliant with the regulations? Many healthcare offices and their staff don’t know the answer to this question; they have only a vague notion about the enforcement and the consequences of not adhering to the law.

The real HIPAA enforcement agency is the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR). Complaints are filed with the OCR, and they are responsible for administering, investigating and enforcing the HIPAA privacy standards. The Centers for Medicare & Medicaid (CMS) enforce the code set and security standards.

The American Recovery and Reinvestment Act of 2009 created a tiered penalty configuration for HIPAA violations. But it is the OCR that determines the amount of each penalty, and it is dependent upon the nature and extent of harm that results from the breach. For example:

  • The fine for a first time infringement by someone who did not know they violated HIPAA could be as low as $100 or as high as $50,000.
  • The fine for a violation due to willful neglect, but corrected within the required time period, is a minimum of $10,000 per violation with a maximum of $50,000.
  • The fine when the willful neglect violation is not corrected increases from $10,000 to $50,000.

However, whenever there is a violation that is not considered willful neglect and it is corrected within 30 days of notice, the OCR cannot impose the civil penalty.

A Privacy Rule infraction can be considered criminal and may lead to prosecution by the Department of Justice if someone deliberately acquires or discloses a person’s health information; the fine is $50,000 and up to one year in jail. Whenever an offense is committed through deception, the fine is $100,000 and the jail time is 5 years. And, if person’s health information was sold, transferred or used for profit-making, or any type of personal gain or intent to harm, the fines can go as high as $250,000 with imprisonment for up to 10 years.

Knowing that enforcement of HIPAA is real and that the penalties can be financially and professionally devastating, healthcare offices need to prioritize their training efforts for all of their staff. There truly is no excuse for any healthcare office not to be thoroughly trained in HIPAA law, because if they are found to be out of compliance HHS will not accept ignorance of the law as a defense.

The post The Reality of HIPAA Violations and Enforcement appeared first on HIPAA.com.

Maryland’s Cignet Health Hit with $4.3 Million Fine for HIPAA Violations

The Obama administration has promised to be tougher when it comes to enforcing HIPAA laws. This week a Maryland health service company gained the dubious honor of being the first company or entity to be assessed a Department of Health and Human Services CMP – Civil Money Penalty. And with that penalty assessed at $4.3 million, obviously this should be a sign to all connected with HIPAA transactions that yes, this administration does mean business.

Cignet Health failed to honor the access to medical records requests of 41 of their patients between September 2008 and October of 2009. The company’s failure to cooperate with the subsequent investigation by HHS OCR (Office of Civil Rights) officials earned them another $3 million in fines at the end of the day. According to the official press release about the matter it was the HHS’s position that Cignet had displayed a willful neglect to the basic privacy rules laid down by HIPAA.

“Ensuring that Americans’ health information privacy is protected is vital to our health care system and a priority of this administration,” Health and Human Services Secretary Kathleen Sebelius said in a statement.

Common Misconceptions About HIPAA Heard at Smaller Medical Faculties

If you are a fully trained HIPAA professional whose day to day existence revolves around maintaining compliance this post is not for you. If on the other hand you are a busy member of staff at a doctors office or other smaller medical facility it probably is, since even after all these years there is still a huge amount of confusion about what does and does not constitute a HIPAA violation. Here are some of the most common myths about HIPAA compliance that are heard in medical facilities across the country over and over again:

HIPAA only regulates electronically transmitted data – Oh if only it were so, the life of a HIPPA compliance officer (and anyone else in the medical field) would be so much easier. But no, HIPAA applies to all forms of communication: written, verbal and any form of electronic transmission, including personal e mail notes and social networking posts.

If improperly released information is not exploited, there is no violation of the law – In many of the cases of improperly released PI that have hit the headlines over the last several years no one had any way of telling how and if patient data had been been exploited after the release of information but they still got hit with the big fines and penalties. It is the act of improperly releasing the information that is the violation.

Dentists, optometrists, nurses, and pharmacists are exempted from HIPAA regulations – We actually heard this one – from an individual employed in one of the aforementioned professions -and were flabbergasted. HIPAA governs anyone and everyone who creates or handles patient records – right down to the high school kid who works part time filing charts. Hopefully the professional who was under this misguided impression has now taken a serious crash course in HIPAA compliance.

Little HIPAA violations don’t matter, no one will ever find out – This is unfortunately the mentality of many employees in smaller medical offices. In fact though all it takes is one patient complaint and the whole office will be under serious scrutiny. And just as a reminder, the maximum fines and penalties for failure to comply with the HIPAA laws are $250,000 and 10 years imprisonment. Not to mention the damage the resultant inevitable bad publicity will have on any practice in both the short and the long term.