Act promptly to address HIPAA violations

May 19, 2017

Blog Post

If you discover improper use or disclosure of protected health information (PHI) or any vulnerabilities to the privacy or security of PHI, it is crucial to diligently identify and correct any related violation or vulnerability. Prompt correction will go a long way toward minimizing exposure to potential penalties and liabilities, and may even create an affirmative defense to penalties for HIPAA violations.

The HIPAA civil monetary penalty regulations protect a covered entity or business associate from civil monetary penalties for a violation of HIPAA administrative simplification requirements (e.g., the Privacy, Security and Breach Notification Rules) if the violation:

Is not due to willful neglect.
Is corrected within 30 days after the covered entity or business associate knew, or by exercising reasonable diligence should have known, that the violation occurred. This 30 day period may be extended by the Department of Health and Human Services (HHS) Secretary based on the nature and extent of the violation.

In its October 2016 guidance on the use of cloud services providers (CSPs), the HHS Office for Civil Rights (OCR) observed that a covered entity and business associate are required to enter into a business associate agreement before the covered entity’s electronic PHI (ePHI) is stored or transmitted in the business associate’s cloud. The guidance also stated that the CSP is required to comply with the HIPAA Rules even if it has not executed a business associate agreement. (For more information, read our alert OCR addresses business associate concerns for cloud services.) OCR recognized, however, that a CSP could qualify for the affirmative defense by correcting any non-compliance within 30 days (or additional period determined by OCR) of when it first knew or should have known that the covered entity’s ePHI was maintained in its cloud, unless the CSP’s lack of knowledge was due to its willful neglect. The CSP would then need to promptly enter into a business associate agreement and comply with all applicable HIPAA Rules, or securely return or destroy the ePHI.

It is important to keep in mind that the 30 period to correct a violation begins when the covered entity or business associate knew or should have known of the violation. In some cases the 30 day clock may begin to run when the breach is discovered. In other cases, OCR may determine that a violation should have been discovered earlier or only after subsequent investigation.

Even if the affirmative defense regulation is not satisfied, prompt steps to correct a HIPAA violation, address vulnerabilities, and mitigate the harm from any breach are likely to significantly reduce the potential exposure. For example, if OCR determines that a violation is due to willful neglect (and therefore not eligible for the affirmative defense) and the violation is corrected within 30 days, the minimum and maximum civil monetary penalties under the regulations would be drastically reduced - minimums would decrease from $50,000 to $10,000 per violation. Moreover, OCR as well as other potential enforcers are likely to be more lenient if a covered entity or business associate can show that it acted in good faith to address any violations or vulnerabilities upon discovery and to mitigate harmful effects of any breach or violation.

Covered entities that fail to diligently respond to HIPAA violations or vulnerabilities to the privacy or security of PHI face potential financial exposure that has been expanding rapidly in recent years. Already in 2017, OCR has announced seven resolution agreements with covered entities for HIPAA violations, including settlements for $5.5 million with a Florida health system, $2.5 million with a cardiac remote monitoring company, $2.4 million with a Texas health system, and $2.2 million with a life insurance company. Furthermore, on Feb. 1, 2017, OCR announced its imposition of a $3.2 million civil monetary penalty against a Texas children’s hospital for failure to implement recommended safeguards to address known risks.For more information, please contact one of the attorneys listed below.

Over the past 24 months, the U.S. Department of Health and Human Services Office for Civil Rights has brought notable enforcement efforts against several non-profit covered entities and business associates, resulting in instances of six and seven-figure penalties against providers across the county for incidents involving breaches of protected health information.

A new amendment to New York state law, which would have required all healthcare providers to obtain separate consents from patients for treatment and payment is on hold until further guidance is released, according to the New York Department of Health.

On November 1, 2024, the Centers for Medicare & Medicaid Services issued the Medicare Physician Fee Schedule 2025 final rule, which establishes new advanced primary care management billing codes that will expand opportunities for physician practices, federally qualified health centers, rural health clinics and other health care providers to get paid for services provided by clinical staff under the direction of a physician, nurse practitioner or physician assistant beginning January 1, 2025.

Act promptly to address HIPAA violations

Related Services

You may also be interested in