HIPAA penalties and responsibilities: what to do after a breach or violation

The Health Insurance Portability and Accountability Act (HIPAA) sets the standard for protecting sensitive patient data in the United States. Organizations that handle protected health information (PHI) must ensure that all the required physical, network, and process security measures are in place and followed. However, if breaches and violations do occur, organizations have a responsibility to contain the incident and may face penalties if the organization is found partially responsible for the incident. 

The difference between a breach and a violation

According to Paubox, “a violation is a failure to comply with HIPAA rules and regulations.” Conversely, a HIPAA breach “happens when someone gets unauthorized access to or discloses personal health information.” 

Go deeper: Understanding HIPAA violations and breaches

HIPAA penalties

The Enforcement Final Rule (2006) grants the Office for Civil Rights (OCR) the power to issue penalties against non-compliant entities. In the event of a violation being discovered during an inquiry, the OCR can impose different repercussions that may even comprise criminal allegations. Therefore, these sanctions function as deterrence while simultaneously ensuring covered bodies are liable for their actions.

According to the HSS Enforcement Results as of April 30, 2024, “to date, OCR settled or imposed a civil money penalty in 145 cases resulting in a total dollar amount of $142,663,772.00. OCR has investigated complaints against many different types of entities including: national pharmacy chains, major medical centers, group health plans, hospital chains, and small provider offices.”

See also: HIPAA Compliant Email: The Definitive Guide

Corrective action plans

A corrective action plan (CAP) aims to determine the causes behind security breaches that occur within an organization. By implementing this plan, healthcare establishments can modify their cyber defense measures and prevent similar incidents from recurring. CAPs may require financial investment along with time and effort on the part of the healthcare entity involved. 

The emphasis of a CAP can vary based on the type of infraction and may center around how a healthcare facility operates, including updating policies and procedures, enhancing employee training programs, and strengthening technological safeguards. In addition to dealing with the particular breach, the objective of a CAP is to create a stronger and more durable system for safeguarding confidential patient data. This comprehensive approach ensures that healthcare organizations remain compliant with HIPAA regulations and better equipped to handle future threats.

A CAP may include: 

• Certain policies and procedures to be implemented and monitored. 
• Evaluation of business contacts.
• Reporting of any failures.
• Additional training for employees.

See also: 

• How to create an effective corrective action plan
• How to avoid a HIPAA corrective action plan

Monetary penalties

HIPAA violations can result in significant monetary penalties, which are categorized into four tiers based on the level of negligence and the organization's awareness and correction of the issue. 

Tier 1: unknowing violation

• Description: The organization was unaware and could not have reasonably avoided the violation.
• Penalty range: $137 to $68,928 per violation.
• Annual maximum: $2,067,813.

Tier 2: reasonable cause

• Description: The organization should have been aware of the violation but lacked intent.
• Penalty range: $1,379 to $68,928 per violation.
• Annual maximum: $2,067,813.

Tier 3: Willful Neglect (Corrected)

• Description: The organization acted with willful neglect but corrected the violation within a reasonable timeframe.
• Penalty range: $10,000 to $68,928 per violation.
• Annual maximum: $2,067,813.

Tier 4: Willful Neglect (Not Corrected)

• Description: The organization acted with willful neglect and failed to make timely corrections.
• Penalty range: $68,928 per violation.
• Annual maximum: $2,067,813.

Criminal penalties

The Enforcement Final Rule has granted OCR the authority to prosecute specific violators, who usually performed deliberate/ conscious criminal offenses. These crimes may include PHI stealing for monetary benefits, revealing PHI maliciously, or non-compliance in executing a CAP within the designated timeframe.

HIPAA responsibilities in case of a breach

A breach is an incident where PHI is accessed, used, or disclosed without authorization. Here's what to do if a breach occurs:

Identify and contain the breach

• Quickly identify the breach.
• Contain it to prevent further unauthorized access.

Conduct a risk assessment

• Evaluate the nature and extent of the breach.
• Assess the sensitivity of the information and potential harm.

Notify affected parties

• Notify affected individuals within 60 days of discovering the breach.
• Provide details about the breach and steps to protect themselves.
• If the breach affects 500 or more individuals, notify the Office for Civil Rights (OCR) and the media within 60 days. For smaller breaches, report to the OCR annually.

Mitigate harm

• Offer services like credit monitoring to affected individuals if necessary.
• Update security measures to prevent future breaches.

Read more: How to respond to a data breach

HIPAA responsibilities in case of a violation

A violation occurs when an organization fails to comply with HIPAA rules. Here's how to handle a violation:

Investigate the violation

• Conduct an internal investigation to determine the cause and extent.
• Document findings and identify areas of non-compliance.

Develop a corrective action plan

• Create a plan to address and correct the violation.
• Implement measures to prevent recurrence and ensure compliance.
• Provide training to employees on HIPAA requirements.

Report the violation

• Report significant violations to the OCR.
• Cooperate with OCR investigations and provide necessary documentation.

Monitor compliance

• Regularly audit and monitor compliance with HIPAA.
• Continuously improve security practices based on findings.

FAQs

What are the notification requirements for a breach?

Organizations must notify affected individuals within 60 days of discovering the breach. If the breach affects 500 or more individuals, the OCR and the media must also be notified within 60 days. Smaller breaches should be reported to the OCR annually.

Go deeper: What are the HIPAA breach notification requirements

What is the HIPAA Enforcement Final Rule?

The HIPAA Enforcement Final Rule, issued in 2006, establishes the procedures and penalties for enforcing compliance with the Health Insurance Portability and Accountability Act (HIPAA). This rule outlines how the Department of Health and Human Services (HHS) handles investigations, imposes penalties, and ensures adherence to HIPAA's privacy and security provisions.

See also: What is the HIPAA Enforcement Rule?

Who investigates HIPAA breaches and violations?

The OCR is entrusted with several crucial responsibilities concerning HIPAA enforcement, such as conducting investigations of possible breaches. Investigations include complaints submitted by individuals, reports from covered entities, or incidents reported by business associates.