Understanding HIPAA Privacy Rule ENFORCEMENT
Having a strong compliance program in place may mitigate penalties for a violation.
BY JOHN E. STEINER JR., ESQ.

The HIPAA Privacy Rule has been in effect since April 2003. If your practice uses or discloses protected patient information electronically, you're subject to the Privacy Rule.

The federal government may impose civil or criminal sanctions for violations of the Privacy Rule. Penalties can be serious for "knowing" disclosures of protected health information (PHI). However, if PHI is mistakenly disclosed, covered entities are afforded some protection under the Privacy Rule.

This article highlights key principles related to the Privacy Rule sanctions and closes with practical tips and additional resources. (The article summarizes key legal points from the HIPAA statute, related regulations, and guidance from regulatory agencies. The article doesn't address whether or how a private party might seek to use any HIPAA standards in a private, civil lawsuit; although there is strong speculation that this type of action may occur.)

Enforcing the Rule

The following federal agencies are responsible for HIPAA Privacy enforcement:

► The Office for Civil Rights (OCR) enforces the Privacy Rule civil sanctions

► The Department of Justice (DOJ) enforces the Privacy Rule criminal sanctions.

Consistent with public statements to date from OCR, the federal enforcement authorities are expected to adopt a collaborative and conciliatory enforcement approach with covered entities that demonstrate "good faith" compliance efforts.

Violations Can Be Costly

Privacy Rule civil sanctions are fairly straightforward.

Each violation carries a $100 penalty. But the total amount that may be imposed on a person for all violations of an identical requirement or prohibition during a calendar year may be up to $25,000.

Thus, there is a potential for money penalties to add up, especially for repeated violations.

Mitigating Circumstances

HIPAA does provide opportunities to prevent, mitigate and possibly avoid penalties.

A penalty may not be imposed under the terms above if it's established to the satisfaction of the Secretary of Health and Human Services (HHS) that the person liable for the penalty didn't know, and by exercising reasonable diligence wouldn't have known, that he or she had violated a Privacy Rule provision.

Essentially, a covered entity that can satisfy the OCR that it didn't know -- and by exercising reasonable diligence would not have known -- of a violation of HIPAA, should not be assessed a civil money penalty.

Moreover, even if a covered entity did know, or by exercising reasonable diligence would have known, that it would be in violation, it may still avoid a penalty if the failure to comply wasn't through willful neglect, and if the noncompliance is corrected within 30 days.

In sum, the possibility exists that after receiving a complaint from the OCR, a practice could promptly correct the problem and avoid penalties.

And if HHS determines that a person failed to comply because the person was unable to comply, HHS may provide technical assistance during the 30-day period referenced above. Such assistance shall be provided in any manner determined appropriate by the Secretary of HHS.

Thus, reading all of the regulations together, it's possible that a violation could be corrected without any penalty being imposed by the OCR.

Reducing a Penalty

It's also possible to reduce a monetary penalty under the civil sanction authority.

If the failure to comply is due to reasonable cause and not to willful neglect, any penalty that's not entirely waived under the exceptions listed above may be reduced to the extent that payment of such penalty would be excessive relative to the compliance failure involved.

Imposing Criminal Sanctions

The criminal penalties under HIPAA are for what's termed "Wrongful Disclosure of Individually Identifiable Health Information." A person who knowingly and in violation of this statute uses or causes to be used a unique health identifier, obtains individually identifiable health information relating to an individual, or discloses individually identifiable health information to another person:

► Shall be fined not more than $50,000, imprisoned not more than 1 year, or both.

► If the offense is committed under false pretenses, be fined not more than $100,000, imprisoned not more than 5 years, or both.

► If the offense is committed with intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm, be fined not more than $250,000, imprisoned not more than 10 years, or both.

It's too early to speculate how the DOJ will apply the "knowingly" standard and interpret what is meant by "intent" under HIPAA.

Have a Thorough Compliance Program

Practices should have thorough corporate Privacy Rule compliance programs in place. A proactive approach toward HIPAA privacy can help your practice avoid problems. The following policies can easily be adopted:

Develop a Notice of Privacy Practice (NPP) that's delivered to all patients at their first encounter, and clearly posted in your office. This describes how the patient's medical information may be used and disclosed. It states the patient's legal rights regarding protected health information. Review and revise your NPP as necessary.

Delegate the position and duties of privacy officer to a staffer. This person should assume the responsibilities of keeping current on HIPAA trends, educating other staffers and implementing Privacy Rule changes.

Use reasonable safeguards to keep PHI out of the sight of those not authorized to view it. Only share PHI with other covered entities for purposes of treatment, payment and healthcare operations.

Develop written policies. These should address the handling of confidential information and complaints.

Monitor patient information that's electronically transferred. Monitoring will test whether your compliance policies are being followed.

Implementing these basic policies should serve as a strong foundation for Privacy Rule compliance and stand you in good stead with the authorities if an isolated incident of noncompliance does occur.

John E. Steiner, Jr., Esq., is Chief Compliance Officer & Privacy Official for the Cleveland Clinic Health System.