HIPAA Penalties Summarized

No doubt, the regulations surrounding the Health Insurance Portability and Accountability Act (HIPAA) can be overwhelming. Not only just trying to make sense of them, but also in deciphering the penalties associated with not meeting them. So we thought we’d write up a quick summary of the penalties in hopes that at least you know what the various categories, or tiers, that are subject to penalties and the dollar figures you might have to part with should you violate them and get fined by auditors.

Over the years, there have been significant updates to HIPAA intended to improve privacy protections and ensure healthcare data is kept secured and to protect patient privacy. This is especially important with regard to ePHI, or electronic personal health information. Those updates include the HIPAA Privacy Rule, the HIPAA Breach Notification Rule, the HIPAA Security Rule, and the HIPAA Omnibus Rule.

Also of note is that the various attorneys general in each state can issue fines for up to $25,000 per violation category each year for violating various state laws. Those are separate from HIPAA auditor findings. That’s not pocket change, especially for small organizations. Also, the Health Information Technology for Economic and Clinical Health (HITECH) falls under HIPAA and deals with the privacy, security, and transfer of electronic health information. All the following penalties max out at $1.5 million in a given year, if fined by the Department of Health and Human Services. If there is disagreement, the fines for settlement can be even higher.

Tier 1: The organization is unaware of the HIPAA violation. Essentially, ignorance is in play. By performing reasonable due diligence, the organization still would not have been aware that a HIPAA violation occurred.

Penalty: $100-50,000 per violation.

Tier 2: Auditors believe with reasonable certainty that the organization did know about the violation or should have known, had it exercised reasonable due diligence.

Penalty: $1,000-50,000 per violation.

Tier 3: A HIPAA rule (or rules) was violated due to willful neglect and it was corrected within 30 days of discovery.

Penalty: $10,000-50,000 per violation

Tier 4: A or multiple HIPAA rules were violated and there was no effort to correct them within 30 days.

Penalty: $50,000

There were some noteworthy penalties within the last year for violation of the regulations including 21^st Century Oncology, which experienced a data breach in 2016, resulting in 2.2 million victims. They paid a settlement of $2.2 million. Memorial Healthcare System, which was nabbed for insufficient ePHI controls, settled for $5.5 million, and New York and Presbyterian Hospital and Columbia University paid $4.8 million for failure to conduct a risk analysis.

Some organizations are large enough that perhaps a multi-million dollar fine is a “drop in the bucket.” However, for a smaller organization, there’s no tolerance. It’s worth it to spend some of the budget to protect the PHI and all sensitive information by implementing perimeter security tools such as firewalls, intrusion detection and prevention systems, email spam filtering, and of course anti-virus.

Then, to help ensure that one person doesn’t expose records by clicking a malicious link in an email message, conduct regular and ongoing cybersecurity awareness training on how to keep that information out of the hands of the bad actors.