menu
menu
HIPAA: many people know the acronym, but few know what it stands for, where it comes from or even the multitude of HIPAA penalties that can impact their organization.
HIPAA refers to the Health Insurance Portability and Accountability Act of 1996, which requires healthcare providers to safeguard patients’ Protected Health Information (PHI). Protecting PHI means strictly controlling when and with whom healthcare providers share sensitive information. Any time an organization shares PHI with an unauthorized person or in an unauthorized place (intentionally or otherwise), the Department of Health and Human Services’ Office for Civil Rights (OCR) and state attorneys general can issue a HIPAA violation.
Though these violations do come with financial penalties, fines are just one way OCR enforces HIPAA among healthcare providers, health insurance providers and all other covered entities.
Here’s what organizations need to know about HIPAA violations and what they can do to avoid penalties.
HIPAA penalties aren’t always punitive. In fact, OCR will often issue technical guidance or request compliance to help covered entities address their gaps in meeting HIPAA guidelines. But when violations are serious, OCR does employ more punitive measures, which involve both financial penalties as well as additional operational requirements.
According to OCR, a “serious” violation includes those that last for a long length of time, impact a large number of people or involve especially sensitive patient data. Should an organization violate HIPAA in any of these three ways, OCR can issue a fine according to four different violation tiers; the higher the violation tier, the steeper the HIPAA penalties.
The HITECH Act of 2009 set the maximum penalty at $1.5 million per year, though OCR re-interpreted the HITECH Act in 2019 to set different maximum penalties depending on the tier/level of culpability.
Tier 1 is reserved for organizations that unknowingly violate HIPAA. Though these organizations are ultimately responsible for lapses in PHI standards, they were still taking steps to meet HIPAA standards and could not have realistically avoided the violation.
Tier 1 Definition & Penalties:
The covered entity was unaware of the violation and could not have avoided it. They took a reasonable amount of care to meet HIPAA standards.
Organizations guilty of a Tier 2 violation should have known about their HIPAA violation, but this tier recognizes that the violation was nonetheless unavoidable. In other words, the violation does not rise to the level of willful neglect.
Tier 2 Definition & Penalties:
The covered entity should have been aware of the violation, but did not willfully neglect HIPAA standards.
If an organization committed a Tier 3 violation, it willfully neglected HIPAA standards. The organization can lessen the severity of the violation and, therefore, the HIPAA penalty if they can prove they tried to correct the violation.
Tier 3 Definition & Penalties:
The covered entity willfully neglected HIPAA standards, but tried to correct the violation.
OCR reserves Tier 4 for the most serious violations. Organizations that fall under Tier 4 both willfully neglected HIPAA standards and made no attempt to correct the violation once they became aware of it.
Tier 4 Definition & Penalties:
The covered entity willfully neglected HIPAA standards and did not try to correct the violation.
All employees of covered entities are responsible for reporting HIPAA violations. It’s important that those working in healthcare and healthcare insurance understand when a HIPAA violation occurs and how they can report it internally and to the appropriate governing bodies.
Covered entities should provide HIPAA training to all employees and let them know to whom they should report. This individual will investigate internally and determine whether or not a HIPAA violation has occurred. If it has, they’ll also be the one to escalate the report to OCR.
The HIPAA complaint process goes as follows: anyone can file a complaint via mail, fax, email or the OCR complaint portal. The complaint should name the covered entity or employee and explain the incidents believed to have violated HIPAA. Complaints should be filed within 180 days, although this can be extended if the filer can show “good cause.”
Organizations don’t always knowingly commit HIPAA violations, making it even harder to prevent HIPAA penalties. In fact, many HIPAA violations are unintentional and often due to gaps in data security practices or improper employee training. Regular compliance audits can help organizations identify these gaps in their practices. We've identified these five issues as the most common HIPAA violations:
Preventing a HIPAA violation and avoiding HIPAA penalties doesn’t always require overhauling an organization’s information systems. Though data security should be at the top of the list for any healthcare organization, there are several other things covered entities can incorporate into their governance to reduce the likelihood of a HIPAA violation.
HIPAA violations aren’t a given. Though they’re a risk all healthcare organizations face, there are steps covered entities can take to reduce the chances that they’ll face a HIPAA penalties. The key? A robust governance, risk and compliance (GRC) framework.
Organizations of all sizes can benefit from good governance and an effective board portal, but it’s especially critical for healthcare organizations handling sensitive PHI. It’s important to remember that avoiding HIPAA penalties isn’t just about avoiding fines; it’s about protecting patient rights and privacy. Governance is the best tool healthcare organizations have to do just that.
Learn more about how healthcare organizations can improve their data management, protect patient rights and avoid HIPAA penalties by downloading Curing the Data Deficit: How to Heal Governance Problems in Healthcare from Diligent.
