Cleveland Clinic Health System Obligated Group - FMSbonds.com

These new rules required the implementation of new policies and procedures by health care providers forcoding, maintaining, storing and transmitting medical information, as well as policies and procedures designed toprotect the security, data integrity and confidentiality of patient medical information and to permit patients toexercise their specific rights under HIPAA. The Obligated Issuers have made significant expenditures to date andanticipate the need for substantial additional expenditures to ensure compliance with all of these requirements.The penalty for violating HIPAA’s administrative simplification requirements includes imposition of civilmonetary penalties of not more than $100 per person, per violation, up to a maximum of $25,000 for violation of thesame standard within any calendar year. Criminal penalties may also be imposed on any person who knowinglyobtains or discloses protected health information in violation of HIPAA. These penalties range from up to $50,000and one year in prison for obtaining or disclosing protected health information; up to $100,000 and up to five yearsin prison for obtaining or disclosing protected health information under “false pretenses;” and up to $250,000 and upto 10 years in prison for obtaining protected health information with the intent to sell, transfer or use it forcommercial advantage, personal gain or malicious harm. The Secretary of DHHS and the Secretary’s designeeshave the authority to conduct compliance reviews to determine whether any covered entity is complying withHIPAA requirements, and to investigate complaints filed by any person who believes a covered entity is notcomplying with those requirements. HIPAA requires the Secretary of DHHS, however, to the extent practicable, toseek cooperation in obtaining compliance prior to formal action for civil monetary or criminal penalties. Except forthe privacy rule, which is enforced by the Office for Civil Rights of DHHS, the standards promulgated pursuant toHIPAA’s administrative simplification provisions are enforced by CMS.The Obligated Issuers maintain formal plans for compliance with all applicable HIPAA requirements, havetrained their staff and employees in these requirements and maintain specified HIPAA Compliance Officers forPrivacy and Security who have been provided the authority to supervise, update and enforce policies and proceduresdesigned to assure HIPAA compliance.While Management of the Obligated Issuers believes it has taken reasonable and appropriate steps in thedesign of policies and procedures and in its supervision so as to maintain material compliance with HIPAA’sadministrative simplification provisions, it cannot be predicted when or to what extent complaints may be filed orinvestigations undertaken, which could involve the expenditure of possibly substantial sums to defend, and thepossibility of fines or other penalties, should DHHS determine that any covered component of the Obligated Issuers’operations is not in compliance with HIPAA requirements.State Laws and RegulationsLegislation may be introduced from time to time in the Ohio General Assembly and the Florida Legislaturerelating to the operations and reimbursement of health care providers, including hospitals. Changes in thegovernmental regulations concerning the treatment of patients, the referral of patients and services, certificate ofpublic need requirements and regulations, licensure, medical malpractice damage limitations and a tax-exemptorganization’s qualification for tax-exempt treatment under state law all could have a significant effect on theObligated Issuers. No precise determination can be made at this time whether the bills that have been or may beintroduced or the regulations which may be proposed for the purpose of containing costs, improving quality of careor otherwise affecting hospital revenues or increasing the competition among hospitals, will be enacted or, ifenacted, whether and to what degree such legislation will affect the financial condition or results of operations of theObligated Issuers or their ability to make future capital expenditures.38