Download - Allegheny County Medical Society

LEGAL REPORT
administrative, accreditation or financial services to or
for a covered entity where performing those services
involves disclosure of individually identifiable health
information by the covered entity or another business
associate of the covered entity to that person or entity.
Business associates typically enter into a business
associate agreement that spells out its obligations under
the HIPAA Privacy and Security Rules and the
HITECH Act. Moreover, the HIPAA Privacy Rule
requires that a covered entity obtain satisfactory assurances
from its business associate that the business associate
will appropriately safeguard the protected health
information it receives or creates on behalf of the covered
entity, such as in the form of a business associate
agreement.
Prior to the HITECH Act, the HHS secretary could
not impose a penalty of more than $100 for each violation
or $25,000 for all identical violations. A covered
health care provider, health plan or clearinghouse, at the
time, could avoid such penalty by demonstrating that it
did not know that it violated the HIPAA Rules. Now,
there is no such avoidance of penalty under the
HITECH Act.
The HITECH Act imposes both civil and criminal
penalties. Civil penalties range from $100 to $50,000
per violation, with caps of $25,000 to $1,500,000 for all
violations of a single requirement in a calendar year. The
amount of the civil penalty imposed varies depending on
whether: (1) the offender did not know and with the
exercise of reasonable diligence would not have known
of the violation; (2) the violation was due to reasonable
cause and not reasonable neglect; (3) the violation was
due to willful neglect but was corrected; and (4) the
violation was due to willful neglect and was not corrected.
Criminal penalties are up to $50,000 in fines and
one year of imprisonment.
How does the federal government find out about
who is violating HIPAA? (1) Anyone may file a complaint
that there has been a violation of the HIPAA
Privacy or Security Rule with the Office of Civil Rights
(OCR), the enforcement arm of HHS. (2) The
HITECH Act requires certain breach notification
standards. In cases where a breach affects more than 500
individuals, health care providers and other covered
entities are to promptly notify affected individuals of a
breach, as well as the HHS secretary and the media.
Breaches affecting fewer than 500 individuals must be
reported to the HHS secretary on an annual basis.
April 2012 : Bulletin
Further, business associates of covered entities must
notify the covered entity of breaches by the business
associate. (3) The HITECH Act makes HIPAA audit
and enforcement mandatory. The act requires HHS to
provide for periodic audits to ensure that covered entities
and business associates are complying with the
HIPAA Privacy and Security Rules and breach notification
standards. To implement the mandate, OCR is
piloting a program to perform up to 150 audits of covered
entities to assess privacy and security compliance.
In that vein, OCR announced a pilot program to
perform audits of covered entities to assess their HIPAA
Privacy and Security compliance. The covered entities to
be audited include a wide variety of facilities of varying
sizes, including very large health care systems and small
physician practices. These entities will have an extensive
review of their HIPAA Privacy and Security Rule policies
and procedures, operations and documentation. OCR
intends to audit health care providers, health plans,
continued on page 161
159