HIPAA has real consequences for organizations and individuals. Knowing how violations are handled — and how to report a problem — protects patients, your organization and you.
Who enforces HIPAA
- The HHS Office for Civil Rights (OCR) enforces the Privacy, Security and Breach Notification Rules. It investigates complaints from patients and others, reviews breach reports, and carries out compliance reviews.
- Most OCR cases end with the organization correcting the problem. In serious cases OCR can enter a resolution agreement with a payment and a multi-year corrective action plan, or impose civil money penalties.
- State attorneys general can also bring civil actions for HIPAA violations affecting residents of their state.
- Criminal cases are handled by the U.S. Department of Justice (DOJ).
Civil penalties
Civil money penalties are set in four tiers, based on the level of fault:
- the organization did not know of the violation and, with reasonable diligence, would not have known;
- the violation was due to reasonable cause, not willful neglect;
- willful neglect that was corrected within 30 days of when the organization knew or should have known;
- willful neglect that was not corrected within 30 days.
Each tier has a minimum and a maximum per violation and a maximum for identical violations in a calendar year. The higher the tier, the higher the penalty. The dollar amounts are adjusted for inflation every year and published by HHS, so check the current figures on hhs.gov or in the Federal Register rather than relying on a number from memory.
Criminal penalties
A person who knowingly obtains or discloses individually identifiable health information in violation of HIPAA can be prosecuted. Under federal law (42 U.S.C. 1320d-6) the maximum penalties rise with the seriousness of the conduct:
- knowingly obtaining or disclosing — fines up to $50,000 and up to 1 year in prison;
- under false pretenses — up to $100,000 and up to 5 years;
- with intent to sell, transfer or use the information for commercial advantage, personal gain or malicious harm — up to $250,000 and up to 10 years.
Individual workforce members have been prosecuted — for example, for selling patient information or looking up records to harm someone.
Consequences at work
Covered entities must have and apply sanctions against workforce members who violate privacy policies. Depending on the violation, sanctions range from retraining and warnings to suspension and termination. Professional licensing boards may act too.
Reporting incidents
Every covered entity must name a privacy officer and a security officer (sometimes the same person). Report to them, or through the channel your organization sets up, whenever you see or cause:
- a misdirected fax, email or letter;
- a lost or stolen laptop, phone, badge or paper records;
- a clicked phishing link or shared password;
- someone looking at records they do not need;
- PHI left in public view or thrown in ordinary trash.
Report promptly, even if you are not sure it is a violation and even if you made the mistake. The organization must assess the event, mitigate harmful effects as far as practicable, and meet deadlines that may already be running. Do not investigate on your own, delete evidence or contact the people affected unless you are told to.
No retaliation
A covered entity may not intimidate, threaten, discriminate against or retaliate against anyone for exercising their HIPAA rights, filing a complaint, or taking part in an investigation. Workforce members can also complain directly to OCR. Honest, prompt reporting is what the rules expect of you — hiding a mistake is what makes it worse.
Scenarios
A late-night mistake. At the end of a long shift you realize you printed a patient list and left it in a public restroom. Go back, collect it if you can, and report it. Owning the mistake quickly gives the organization the best chance to limit harm.
Pressure not to report. A supervisor tells you to "keep quiet" about a misdirected fax so the unit does not look bad. HIPAA expects incidents to be reported and assessed. Use another channel — the privacy officer, a compliance hotline or OCR — and remember that retaliation for reporting is prohibited.
A patient's complaint. A patient tells you she wants to complain about how her information was handled. Tell her she can complain to the organization (give her the privacy officer's contact details from the Notice of Privacy Practices) and to OCR. Never discourage a complaint.
Key points
- OCR enforces the HIPAA rules; DOJ prosecutes criminal cases; state attorneys general can sue too.
- Civil penalties come in four tiers by level of fault, with amounts adjusted for inflation every year.
- Knowingly obtaining or disclosing PHI can be a federal crime; selling it carries up to 10 years.
- Report incidents promptly to your privacy or security officer; retaliation for reporting is prohibited.