Right of Access enforcement is climbing and fast. Last week, OCR announced its 9th Right of Access resolution this year and its 11th such resolution since the Right of Access enforcement initiative began in 2019. Right of Access enforcement is swift, driven by patient complaints and has cost provider 9 providers a combined total of nearly half a million in settlement costs this year.
Category Archives: HIPAA Enforcement
Historically, it often takes the Department of Health and Human Services’ Office for Civil Rights (OCR) five or more years to complete an investigation, bring an enforcement action and announce a resolution. That’s changing.
Less than a month after announcing five right of access enforcement action resolutions in one day, the Office for Civil Rights (OCR) announced two more last week.
In just one week, OCR announced settlements totaling $10.6 million with three organizations for alleged systemic HIPAA Security Rule violations. In each of the three cases, the entity self-reported a hacking incident. Combined, the hacking incidents compromised the health information of more than 16 million people. While it’s not common to see three large settlements in one week, enforcement for HIPAA Security Rule non-compliance is not new and likely will continue with increasing intensity.
Today, OCR announced its largest HIPAA enforcement settlement so far this year. An orthopedic clinic agreed to pay $1.5 million and to adopt a corrective action plan after a 2016 hacking incident that compromised over 200,000 patient records. OCR’s investigation revealed systemic HIPAA Privacy and Security Rule issues. This settlement confirms that HIPAA Security Rule violations remain an important enforcement focus, that post-incident compliance will not excuse pre-incident noncompliance and that seven figure settlements are not reserved just for large hospital systems.
Today, OCR announced five new settlements under its “HIPAA Right of Access Initiative,” making right of access the most prominent area of HIPAA enforcement so far this year. In 2019, OCR indicated that it would prioritize claims involving individuals’ right to receive timely access to their health records at a reasonable cost under the HIPAA Privacy Rule. And it is making good on its promise. All providers must pay special attention to this issue as patient complaints in this area are high and provider compliance typically is not strong.
HIPAA breaches happen. So long as humans are involved in handling protected health information (PHI), there will be mistakes that result in a breach (and, of course, this does not include hacking incidents or bad actor breaches). For compliance purposes, the response to a breach is key. Providers that respond swiftly, implement corrective measures and timely notify affected patients and file a thorough breach report with the Department of Health and Human Services (DHHS) are far more likely to avoid scrutiny.
Less than one week after its last announced settlement, the Office for Civil Rights announced its first seven-figure HIPAA settlement of 2020. A non-profit healthcare system in Rhode Island, Lifespan, agreed to pay $1,040,000 for alleged systemic HIPAA violations. A 2017 breach involving an unencrypted stolen laptop triggered the investigation. OCR found HIPAA Security Rule violations and the lack of a business associate agreement with its parent corporation, which reported the 2017 breach.
Today, the Office for Civil Rights (OCR) announced a $25,000 settlement with a small federally qualified health center (FQHC) for systemic HIPAA Security Rule violations. Over 9 years ago, the FQHC reported a disclosure of patient information to an unknown email account affecting 1,263 patients. This breach report prompted an investigation revealing a near complete failure to comply with the HIPAA Security Rule.
It’s now a familiar scene. News coverage regularly includes video footage capturing exhausted healthcare workers, lifeless bodies in hospital beds and COVID-19 treatment areas. OCR reminds healthcare providers that allowing media access to patient care areas without patient authorization violates HIPAA, regardless of the COVID-19 public health emergency. In the past, hospitals have paid millions of dollars in settlements for permitting access without proper authorization and increased enforcement on this issue may be on the horizon.