Penalties for HIPAA Violations Increase Significantly
The Facts
On October 30, 2009, the U.S. Department of Health and Human Services issued an Interim Final Rule (the Rule) to amend the existing administrative simplification enforcement regulations adopted pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The Rule implements amendments to HIPAA made by the Health Information Technology for Economic and Clinical Health Act (HITECH Act) enacted as part of the American Recovery and Reinvestment Act of 2009. Prior to enactment of the HITECH Act, covered entities under HIPAA (health care providers that conduct certain transactions in electronic form, health plans and health care clearinghouses) were subject to HIPAA civil money penalties of up to $100 per violation, with an annual cap of $25,000 for identical violations within a calendar year. The Rule preserves this structure for violations occurring prior to February 18, 2009. Violations occurring on or after February 18, 2009 are subject to a new penalties scheme, which ranges from a minimum per-offense penalty of $100 to $50,000, depending on the level of culpability. The Rule also increases the annual cap for identical violations from $25,000 to $1.5 million, and alters the available affirmative defenses to a HIPAA enforcement action. Business associates are directly subject to the new enforcement scheme beginning February 17, 2010. HIPAA’s criminal penalties remain unchanged.
What’s at Stake
The new HIPAA civil money penalties scheme that will be enforced under the Rule substantially increases the potential penalties for HIPAA violations by covered entities occurring on or after February 18, 2009. Business associates will be directly subject to HIPAA, including the new enforcement scheme, for the first time beginning February 17, 2010. Prior to February 17, 2010, business associates are only subject to HIPAA requirements through contracts with covered entities.
Steps to Consider
Covered entities and business associates should review their current HIPAA compliance policies and procedures to ensure they are meeting amended requirements. Business associates that previously lacked HIPAA privacy and security policies and procedures should implement policies and train their work force. McDermott has prepared HIPAA privacy policies and forms for covered entities and business associates. A preview of the manual's table of contents for covered entities can be viewed here, and the business associates table of contents can be viewed here.
