Cecily Zamora
HIPAA, or the Health Insurance Portability and Accountability Act, establishes the first national standard for the protection of personal health information. It is a constant area of concern for healthcare providers, who must ensure that their employees are adequately trained to avoid HIPAA violations. Violations can occur due to carelessness or ignorance of HIPAA laws, and can result in civil and criminal penalties. For example, a violation of the Privacy Rule can result in a criminal penalty of up to $50,000 and up to one year of imprisonment. Patients who believe their rights under HIPAA have been violated can file a complaint with the OCR, which will investigate the matter and determine the appropriate course of action.
| Characteristics | Values |
|---|---|
| Who can violate HIPAA laws? | Covered entities, specified individuals, directors, employees, officers of the CE, business associates, law enforcement and military agencies, healthcare workers, doctors, employers, organizations, vendors, subcontractors |
| Who enforces HIPAA laws? | OCR, DOJ, HHS, state attorneys general |
| Penalties | Civil and criminal penalties, fines, imprisonment, tiered civil penalty structure, CMPs, multi-state and class action lawsuits, corrective actions, policy changes, staff training, operational and IT infrastructure changes |
| Preventative measures | HIPAA compliance training, organization-wide risk analysis, regular risk assessments, encryption, security measures, reporting breaches, audits, policies to address areas of concern, storing records of employee training |
Explore related products
![The Penalty [Blu-ray]](https://m.media-amazon.com/images/I/91fZ8MEHZ4L._AC_UY218_.jpg)
What You'll Learn
Covered entities and specified individuals
Covered entities are groups that are bound by HIPAA Privacy Rules for their own activities and those of the organisations with which they contract for essential functions. These include health care providers such as physicians, dentists, psychiatrists, hospitals, clinics, pharmacies, and laboratories. They are also referred to as "business associates".
Covered entities must comply with the HIPAA Privacy and Security Rules. In the case of noncompliance, the Office for Civil Rights (OCR) will attempt to resolve the case with the covered entity. Failure to comply with HIPAA can also result in civil and criminal penalties. If a complaint describes an action that could be a violation of the criminal provision of HIPAA, OCR may refer the matter to the Department of Justice (DOJ) for investigation.
OCR can only investigate complaints that allege an action or omission that fails to comply with the Privacy or Security Rules. For example, a doctor can send your medical test results to another doctor without your permission if the doctor needs the information to treat you; this is not a violation of the Privacy Rule, so OCR would not investigate a complaint that described this situation.
Covered entities must also ensure that any business associates they engage with to carry out their healthcare activities and functions have a written contract that establishes specifically what the business associate has been engaged to do and requires them to comply with the Rules' requirements to protect the privacy and security of protected health information.
Specified individuals, such as directors, employees, or officers of a covered entity, may also be directly criminally liable under HIPAA in accordance with "corporate criminal liability". Where an individual of a covered entity is not directly liable under HIPAA, they can still be charged with conspiracy or aiding and abetting.
Insider Trading Laws: Exempt Congress?
You may want to see also
Explore related products
Law enforcement and military agencies
The HIPAA Privacy Rule includes an exception for law enforcement purposes, allowing covered entities to disclose PHI to law enforcement officials without patient authorization in specific situations. These situations include executing a court order, subpoena, or administrative request, identifying or locating individuals involved in a case, responding to requests for information about victims or suspected victims, alerting law enforcement of a death suspected to be caused by criminal activity, and disclosing evidence of a crime that occurred on the organization's premises.
Military agencies also have exceptions and considerations under HIPAA. The Military Command Exception states that protected health information (PHI) of Armed Forces members can be disclosed for activities deemed "necessary by appropriate military command authorities to assure the proper execution of the military mission." This exception allows care providers to share PHI with military personnel to determine fitness for duty or a specific mission. Military personnel who violate HIPAA rights may face disciplinary, administrative, or other actions, and members can file HIPAA complaints with the DoD entity, DHA Privacy Office, or HHS.
It's important to note that while law enforcement and military agencies have specific considerations under HIPAA, they are still subject to penalties and complaints if they misuse or disclose protected health information inappropriately.
Attorneys: Partners in Multiple Law Firms?
You may want to see also
Explore related products
Business associates
Covered entities must have a written contract or arrangement with their business associates that outlines the specific tasks they have been engaged to perform. This contract must also require business associates to comply with the Rules' requirements to protect the privacy and security of protected health information. For example, the contract must describe the permitted and required uses of protected health information by the business associate and require them to use appropriate safeguards to prevent unauthorized use or disclosure.
It is important to note that not all entities are required to comply with the Privacy and Security Rules under HIPAA. Only covered entities and their business associates are subject to these requirements. OCR can only investigate complaints that allege an action or omission that fails to comply with the Privacy or Security Rules.
Surviving the Wild: Keeping Your Book of Law Safe
You may want to see also
Employers and employees
The Health Insurance Portability and Accountability Act (HIPAA) is a law enacted in 1996 to prevent patients' protected health information (PHI) from being released without their permission or knowledge. Compliance is required by covered entities, including healthcare providers and health insurers, as well as their business associates such as transcriptionists and health care clearinghouses.
Employers
In most cases, the Privacy Rule does not apply to the actions of an employer. The Privacy Rule controls how a health plan or a covered health care provider shares an individual's protected health information with an employer. However, if an employer asks an employee's healthcare provider directly for information about them, the provider cannot give the employer the information without the employee's authorization unless other laws require them to do so.
An employer HIPAA violation occurs when the employer retaliates against an individual who has made a complaint using the employer's complaint process. If the HHS finds that an employer has violated the anti-retaliation rules, the organization is subject to civil monetary penalties and corrective action plans. HHS may permit an organization to settle for a specified amount instead of imposing civil monetary penalties.
Employees
HIPAA violations can occur due to a lack of compliance training and failing to perform an organization-wide risk analysis. Employees need to be aware of the law and how to protect themselves and their careers. This includes being prepared for audits and having policies in place to address areas of concern in the risk analysis.
Employees have the right to report suspected violations without facing retaliation from employers. While HIPAA does not provide the right to sue for damages, state laws often prohibit retaliatory actions by employers, including those related to reporting concerns about HIPAA compliance. Covered entities and specified individuals who "knowingly" obtain or disclose individually identifiable health information face a fine of up to $50,000, as well as imprisonment of up to one year.
Equality Under Canadian Law: What Does It Mean?
You may want to see also
Patients
If a patient suffers harm following a privacy breach, they may have some options to recover damages. However, patients cannot sue covered entities for violations of HIPAA alone. Lawsuits involving HIPAA stem from OCR and state attorneys general who take action against violators.
Citizens' Power: Repealing Unjust Laws
You may want to see also
Frequently asked questions
Covered entities and specified individuals can violate HIPAA laws. Covered entities include organisations and business associates that are required by law to comply with the Privacy and Security Rules. Business associates are restricted from disclosing protected information unless it is necessary to provide contracted services to the covered entity.
Examples of common HIPAA violations include lack of compliance training, failure to perform an organisation-wide risk analysis, losing a device or record that exposes patient records, and failure to notify affected individuals of a data breach within 60 days.
Violating HIPAA laws can result in civil and criminal penalties. Civil penalties are usually issued when the offender was unaware they were committing a violation, while criminal penalties are imposed when the violation is committed "knowingly". Fines can range from $100 to $250,000 per violation, with an annual maximum of $1.5 million for repeat violations. Imprisonment can range from one to ten years.
Patients cannot sue covered entities for violations of HIPAA alone. However, they can bring a case against a provider on a related issue when they suffer provable injuries.
