What of the following are categories for punishing violations of federal health care laws?

For information on the history of and details about each of the HIPAA Rules, please visit https://www.hhs.gov/hipaa/for-professionals/index.html and click on “Privacy,” “Security,” or “Breach Notification” from the left-hand toolbar.

Enforcement Results as of August 31, 2022

Since the compliance date of the Privacy Rule in April 2003, OCR has received over 306,862 HIPAA complaints and has initiated over 1,143 compliance reviews.  We have resolved ninety-seven percent of these cases (297,607).

OCR has investigated and resolved over 29,727 cases by requiring changes in privacy practices and corrective actions by, or providing technical assistance to, HIPAA covered entities and their business associates.  Corrective actions obtained by OCR from these entities have resulted in change that is systemic and that affects all the individuals they serve.  OCR has successfully enforced the HIPAA Rules by applying corrective measures in all cases where an investigation indicates noncompliance by the covered entity or their business associate.  To date, OCR settled or imposed a civil money penalty in 123 cases resulting in a total dollar amount of $133,384,272.00.  OCR has investigated complaints against many different types of entities including: national pharmacy chains, major medical centers, group health plans, hospital chains, and small provider offices.

In another 14,060 cases, our investigations found no violation had occurred. 

Additionally, in 51,820 cases, OCR intervened early and provided technical assistance to HIPAA covered entities, their business associates, and individuals exercising their rights under the Privacy Rule, without the need for an investigation.

In the rest of our completed cases (202,000), OCR determined that the complaint did not present an eligible case for enforcement. These include cases in which:

• OCR lacks jurisdiction under HIPAA.  For example, in cases alleging a violation by an entity not covered by HIPAA;
• The complaint is untimely, or withdrawn by the filer; and
• The activity described does not violate the HIPAA Rules.  For example, in cases where the covered entity has disclosed protected health information in circumstances in which the Privacy Rule permits such a disclosure.  

From the compliance date to the present, the compliance issues most often alleged in complaints are, compiled cumulatively, in order of frequency:

• Impermissible uses and disclosures of protected health information;
• Lack of safeguards of protected health information;
• Lack of patient access to their protected health information;
• Lack of administrative safeguards of electronic protected health information; and 
• Use or disclosure of more than the minimum necessary protected health information.

The most common types of covered entities that have been alleged to have committed violations are, in order of frequency:

• General Hospitals;
• Private Practices and Physicians;
• Pharmacies;
• Outpatient Facilities; and
• Community Health Centers.

Referrals

OCR refers to the Department of Justice (DOJ) for criminal investigation appropriate cases involving the knowing disclosure or obtaining of protected health information in violation of the Rules.  As of the date of this summary, OCR made 1,521 such referrals to DOJ.

Watch for monthly updates reporting the number of cases received, investigated, or resolved.

U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) is responsible for enforcing the HIPAA Privacy and Security Rules.

OCR enforces the Privacy and Security Rules in several ways:

• Investigating complaints filed with it
• Conducting compliance reviews to determine if covered entities are in compliance
• Performing education and outreach to foster compliance with the rules' requirements

OCR reviews the information that it gathers. In some cases, it may determine that the covered entity did not violate the requirements of the Privacy and Security Rules. In the case of noncompliance, OCR will attempt to resolve the case with the covered entity by obtaining:

• Voluntary compliance
• Corrective action and/or
• Resolution agreement

Failure to comply with HIPAA can also result in civil and criminal penalties. If a complaint describes an action that could be a violation of the criminal provision of HIPAA, OCR may refer the complaint to the Department of Justice (DOJ) for investigation.

Civil violations

Civil violations

In cases of noncompliance where the covered entity does not satisfactorily resolve the matter, OCR may decide to impose civil money penalties (CMPs) on the covered entity.

CMPs for HIPAA violations are determined based on a tiered civil penalty structure. The secretary of HHS has discretion in determining the amount of the penalty based on the nature and extent of the violation and the nature and extent of the harm resulting from the violation. The secretary is prohibited from imposing civil penalties (except in cases of willful neglect) if the violation is corrected within 30 days (this time period may be extended at HHS’ discretion).

Penalties for civil violations

Penalties for civil violations

HIPAA violation: Unknowing Penalty range: $100 - $50,000 per violation, with an annual maximum of $25,000 for repeat violations

HIPAA violation: Reasonable Cause Penalty range: $1,000 - $50,000 per violation, with an annual maximum of $100,000 for repeat violations

HIPAA violation: Willful neglect but violation is corrected within the required time period Penalty range: $10,000 - $50,000 per violation, with an annual maximum of $250,000 for repeat violations

HIPAA violation: Willful neglect and is not corrected within required time period Penalty range: $50,000 per violation, with an annual maximum of $1.5 million

Criminal penalties

Criminal penalties

Criminal violations of HIPAA are handled by the DOJ. As with the HIPAA civil penalties, there are different levels of severity for criminal violations.

Covered entities and specified individuals, as explained below, who "knowingly" obtain or disclose individually identifiable health information, in violation of the Administrative Simplification Regulations, face a fine of up to $50,000, as well as imprisonment up to 1 year.

Offenses committed under false pretenses allow penalties to be increased to a $100,000 fine, with up to 5 years in prison.

Finally, offenses committed with the intent to sell, transfer or use individually identifiable health information for commercial advantage, personal gain or malicious harm permit fines of $250,000 and imprisonment up to 10 years.

Covered entities

Covered entities

Criminal penalties for HIPAA violations are directly applicable to covered entities (CE) including:

• Health plans
• Health care clearinghouses
• Health care providers who transmit claims in electronic form
• Medicare prescription drug card sponsors

Individuals such as directors, employees or officers of the CE (where the CE is not an individual) may also be directly criminally liable under HIPAA in accordance with "corporate criminal liability." Where an individual of a CE is not directly liable under HIPAA, they can still be charged with conspiracy or aiding and abetting.

Interpreting “knowingly”

Interpreting “knowingly”

The DOJ interpreted the "knowingly" element of the HIPAA statute for criminal liability as requiring only knowledge of the actions that constitute an offense. Specific knowledge of an action being in violation of the HIPAA statute is not required.

Exclusion from Medicare

Exclusion from Medicare

HHS has the authority to exclude from participation in Medicare any CE that was not compliant with the transaction and code set standards by Oct. 16, 2003 (where an extension was obtained and the CE is not small) (68 FR 48805).

• HIPAA enforcement
• HIPAA security rule compliance
• Top tips for physicians (PDF)

This resource is provided for informational and reference purposes only and should not be construed as the legal advice of the American Medical Association. Specific legal questions regarding this information should be addressed by one's own counsel.

Which of the following are common causes of breaches ?\?

Which one of the following are common causes of breaches?

Which of the following would be a violation of the HIPAA privacy Rule?

Which are the following are breach prevention best practices?