Share this article on:
Penalties for HIPAA violations can be issued by the Department of Health and Human Services’ Office for Civil Rights (OCR) and state attorneys general. In addition to financial penalties, covered entities are required to adopt a corrective action plan to bring policies and procedures up to the standards demanded by HIPAA.
The Health Insurance Portability and Accountability Act of 1996 placed a number of requirements on HIPAA-covered entities to safeguard the Protected Health Information (PHI) of patients, and to strictly control when PHI can be divulged, and to whom.
Since the Enforcement Final Rule of 2006, OCR has had the power to issue financial penalties (and/or corrective action plans) to covered entities that fail to comply with HIPAA Rules.
Financial penalties for HIPAA violations were updated by the HIPAA Omnibus Rule, which introduced charges in line with the Health Information Technology for Economic and Clinical Health Act (HITECH). The Omnibus Rule took effect from March 26, 2013.
Since the introduction of the Omnibus Rule, the new penalties for HIPAA violations apply to healthcare providers, health plans, healthcare clearinghouses and all other covered entities, as well as business associates (BAs) of covered entities that are found to have violated HIPAA Rules.
Financial penalties are intended to act as a deterrent to prevent the violation of HIPAA laws, while also ensuring covered entities are held accountable for their actions – or lack of them – when it comes to protecting the privacy of patients and the confidentiality of health data, and providing patients with access to their health records on request.
The penalty structure for a violation of HIPAA laws is tiered, based on the knowledge a covered entity had of the violation. The OCR sets the penalty based on a number of “general factors” and the seriousness of the HIPAA violation.
Ignorance of HIPAA Rules is no excuse for failing to comply with HIPAA Rules. It is the responsibility of each covered entity to ensure that HIPAA Rules are understood and followed. In cases when a covered entity is discovered to committed a willful violation of HIPAA laws, the maximum fines apply.
What Happens if HIPAA is Violated? – HIPAA Violation Classifications
What happens if HIPAA is violated? That depends of the severity of the violation. OCR prefers to resolve HIPAA violations using non-punitive measures, such as with voluntary compliance or issuing technical guidance to help covered entities address areas of non-compliance. However, if the violations are serious, have been allowed to persist for a long time, or if there are multiple areas of noncompliance, financial penalties may be appropriate.
The four categories used for the penalty structure are as follows:
- Category 1: A violation that the covered entity was unaware of and could not have realistically avoided, had a reasonable amount of care had been taken to abide by HIPAA Rules
- Category 2: A violation that the covered entity should have been aware of but could not have avoided even with a reasonable amount of care. (but falling short of willful neglect of HIPAA Rules)
- Category 3: A violation suffered as a direct result of “willful neglect” of HIPAA Rules, in cases where an attempt has been made to correct the violation
- Category 4: A violation of HIPAA Rules constituting willful neglect, where no attempt has been made to correct the violation
In the case of unknown violations, where the covered entity could not have been expected to avoid a data breach, it may seem unreasonable for a covered entities to be issued with a fine. OCR appreciates this, and has the discretion to waive a financial penalty. The penalty cannot be waived if the violation involved willful neglect of Privacy, Security and Breach Notification Rules.
HIPAA Violation Penalty Structure
Each category of violation carries a separate HIPAA penalty. It is up to OCR to determine a financial penalty within the appropriate range. OCR considers a number of factors when determining penalties, such as the length of time a violation was allowed to persist, the number of people affected and the nature of the data exposed. An organization´s willingness to assist with an OCR investigation is also taken into account. The general factors that can affect the level of financial penalty also include prior history, the organization’s financial condition and the level of harm caused by the violation.
- Category 1: Minimum fine of $100 per violation up to $50,000
- Category 2: Minimum fine of $1,000 per violation up to $50,000
- Category 3: Minimum fine of $10,000 per violation up to $50,000
- Category 4: Minimum fine of $50,000 per violation
The fines are issued per violation category, per year that the violation was allowed to persist. The maximum fine per violation category, per year, is $1,500,000.
A data breach or security incident that results from any violation could see separate fines issued for different aspects of the breach under multiple security and privacy standards. A fine of $50,000 could, in theory, be issued for any violation of HIPAA rules; however minor.
A fine may also be applied on a daily basis. For example, if a covered entity has been denying patients the right to obtain copies of their medical records, and had been doing so for a period of one year, the OCR may decide to apply a penalty per day that the covered entity has been in violation of the law. The penalty would be multiplied by 365, not by the number of patients that have been refused access to their medical records.
Attorneys General Can Also Issue HIPAA Fines
Since the introduction of the HITECH Act (Section 13410(e) (1)) in February 2009, state attorneys general have the authority to hold HIPAA-covered entities accountable for the exposure of the PHI of state residents and can file civil actions with the federal district courts. Statutory damages can be issued up to a maximum level of $25,000 per violation category, per calendar year. The minimum fine applicable is $100 per violation.
A covered entity suffering a data breach affecting residents in multiple states may be ordered to pay fines to attorneys general in multiple states. At present only a few U.S states – Connecticut, Massachusetts, Indiana, Vermont and Minnesota – have so far taken action against HIPAA offenders, but since attorneys general offices are able to retain a percentage of the fines issued, more attorneys general may decide to issue penalties for HIPAA violations.
Criminal Penalties for HIPAA Violations
In addition to civil financial penalties for HIPAA violations, criminal charges can be filed against the individual(s) responsible for a breach of PHI. Criminal penalties for HIPAA violations are divided into three separate tiers, with the term – and an accompanying fine – decided by a judge based on the facts of each individual case. As with OCR, a number of general factors are considered which will affect the penalty issued. If an individual has profited from the theft, access or disclosure of PHI, it may be necessary for all moneys received to be refunded, in addition to the payment of a fine.
The tiers for criminal penalties for HIPAA violations are:
Tier 1: Reasonable cause or no knowledge of violation – Up to 1 year in jail
Tier 2: Obtaining PHI under false pretenses – Up to 5 years in jail
Tier 3: Obtaining PHI for personal gain or with malicious intent – Up to 10 years in jail
In recent months, the number of employees discovered to be accessing or stealing PHI – for various reasons – has increased. The value of PHI on the black market is considerable, and this can be a big temptation for some individuals. It is therefore essential that controls are put in place to limit the opportunity for individuals to steal patient data, and for systems and policies to be put in place to ensure improper access and theft of PHI is identified promptly.
All staff likely to come into contact with PHI as part of their work duties should be informed of the penalties for HIPAA violations and that violations will not only result in loss of employment, but potentially also a lengthy jail term and a heavy fine.
State attorneys general are cracking down on data theft and are keen to make examples out of individuals found to have violated HIPAA Privacy Rules. A jail term for the theft of HIPAA data is therefore highly likely.
HIPAA Compliance Audits are Likely to Result in Penalties for HIPAA Violations
If a CE or BA is found not to have complied with HIPAA regulations, OCR has the authority to issue penalties for HIPAA noncompliance – even if there has been no breach of PHI or no complaint.
After much delay, OCR is now conducting the second phase of HIPAA compliance audits. The audits are not being conducted specifically to find HIPAA violations and to issue financial penalties, although if serious violations of HIPAA Rules are discovered, financial penalties may be deemed appropriate.
The first phase of HIPAA compliance audits was conducted in 2011/2012 and revealed many covered entities were struggling with compliance. OCR provided technical assistance to help those entities correct areas of noncompliance and no penalties for HIPAA violations were issued.
Now, 5 years on, covered entities have had ample time to develop their compliance programs. This time around, OCR is not expected to be so lenient.
One of the biggest areas of noncompliance with HIPAA Rules discovered during the first phase of compliance audits was the failure to conduct a comprehensive, organization-wide risk assessment.
The risk assessment is fundamental to developing a good security posture. If a risk assessment is not conducted, a covered entity will be unaware whether any security vulnerabilities exist that pose a risk to the confidentiality, integrity, and availability of ePHI. Those risks will therefore not be managed and reduced to an acceptable level.
A look at the penalties for HIPAA violations issued by OCR shows just how common risk assessment violations occur. Risk assessment failures frequently attract financial penalties.
The failure to complete Business Associate Agreements (BAAs) with third-party service providers can attract penalties for HIPAA noncompliance. Several covered entities have been fined for failing to revise BAAs written before September 2014, when all existing contracts were invalidated by the Final Omnibus Rule. In September 2016, the Care New England Health System was fined $400,000 for HIPAA noncompliance that included the failure to revise a BAA originally signed in March 2005.
BAAs are a key area that OCR will be keeping an eye on throughout its audit program. BAAs – contracts that lay out the permitted uses and allowable disclosures of PHI – should be signed with every third party service provider with whom PHI is disclosed (including lawyers).
Recent Penalties for HIPAA Violations
The first five months of 2017 have seen several penalties for HIPAA violations issued by the Office for Civil Rights. Between January and March, OCR agreed eight settlements to resolve HIPAA violations discovered during investigations of data breaches and complaints. One civil monetary penalty has also been issued.
When deciding on an appropriate settlement, OCR considers the severity of the violation, the extent of noncompliance with HIPAA Rules, the number of individuals impacted and the impact a breach has had on those individuals. OCR also considers the financial position of the covered entity. Punitive measures may be necessary, but penalties for HIPAA violations should not result in a covered entity being forced out of business.
The purpose of these penalties for HIPAA violations is in part to punish covered entities for serious violations of HIPAA Rules, but also to send a message to other healthcare organizations that noncompliance with HIPAA Rules is not acceptable.
A summary of the 2017 penalties for HIPAA violations are detailed below:
2017 OCR HIPAA Settlements (January to August)
|Covered Entity||Breach Summary||Individuals Impacted||Settlement Amount|
|Memorial Healthcare System||PHI impermissibly accessed by employees and impermissibly disclosed to affiliated physicians’ offices||115,143||$5.5 million|
|Cardionet||Theft of an unencrypted laptop computer||1,391||$2.5 million|
|Memorial Hermann Health System||Disclosure of patient’s PHI to the media||1||$2.4 million|
|MAPFRE Life Insurance Company of Puerto Rico||Theft of an unencrypted USB storage device||2,209||$2.2 million|
|Presense Health||Delayed breach notifications||836||$475,000|
|Metro Community Provider Network||Lack of a security management process to safeguard ePHI||3,200||$400,000|
|Luke’s-Roosevelt Hospital Center Inc.||Impermissible disclosure of PHI to patient’s employer||1||$387,000|
|The Center for Children’s Digestive Health||Lack of a business associate agreement||N/A||$31,000|
2017 Civil Monetary Penalties for HIPAA Violations
|Covered Entity||Breach Summary||Individuals Impacted||Penalty Amount|
|Children’s Medical Center of Dallas||Theft of unencrypted devices||6,262||$3.2 million|
2016 was a record year for settlements with covered entities for violations of HIPAA Rules. 2016 saw 12 settlements agreed and one civil monetary penalty issued by OCR.
2016 OCR HIPAA Settlements
|Covered Entity||Breach Summary||Individuals Impacted||Settlement Amount|
|Feinstein Institute for Medical Research||Improper disclosure of research participants’ PHI||13,000||$3,900,000|
|Advocate Health Care Network||Theft of desktop computers, loss of laptop, improper access of data at business associate||3,994,175||$5,550,000|
|University of Mississippi Medical Center||Unprotected network drive||10,000||$2,750,000|
|Oregon Health & Science University||Loss of unencrypted laptop / Storage on cloud server without BAA||4,361||$2,700,000|
|New York Presbyterian Hospital||Filming of patients by TV crew||Unconfirmed||$2,200,000|
|North Memorial Health Care of Minnesota||Theft of laptop computer / Improper disclosure to business associate (discovered during investigation)||299,401||$1,550,000|
|St. Joseph Health||PHI made available through search engines||31,800||$2,140,500|
|Raleigh Orthopaedic Clinic, P.A. of North Carolina||Improper disclosure to business associate||17,300||$750,000|
|University of Massachusetts Amherst (UMass)||Malware infection||1,670||$650,000|
|Catholic Health Care Services of the Archdiocese of Philadelphia||Theft of mobile device||412||$650,000|
|Care New England Health System||Loss of two unencrypted backup tapes||14,000||$400,000|
|Complete P.T., Pool & Land Physical Therapy, Inc.||Improper disclosure of PHI (website testimonials)||Unconfirmed||$25,000|
2016 Civil Monetary Penalties for HIPAA Violations
|Covered Entity||Breach Summary||Individuals Impacted||Penalty Amount|
|Lincare, Inc.||Improper disclosure (unprotected documents)||278||$239,800|