Enforcement of the HIPAA Privacy and Security Rules
Released: 2009-02-03T00:00:00

Introduction

The privacy and security of health information is recognized as a critical element of transforming the health care system through the use of health information technology. As part of H.R. 1 , the American Recovery and Reinvestment Act of 2009, the 111 th Congress is considering legislation to promote the widespread adoption of health information technology (HIT), and the bill includes provisions dealing with the privacy and security of health records, and specifically authorizes state attorneys general to file lawsuits in federal court on behalf of state residents, seeking injunctive relief or civil damages against "any person" who violates HIPAA's privacy provisions.

The Health Insurance Portability and Accountability Act of 1996

In 1996, Congress enacted the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to "improve portability and continuity of health insurance coverage in the group and individual markets." Congress enacted HIPAA to guarantee the availability and renewability of health insurance coverage and limit the use of pre-existing condition restrictions. HIPAA also included tax provisions related to health insurance and administrative simplification provisions requiring issuance of national standards to facilitate the electronic transmission of health information.

National Standards

Part C of HIPAA requires "the development of a health information system through the establishment of standards and requirements for the electronic transmission of certain health information." Such standards are required to be consistent with the objective of reducing the administrative costs of providing and paying for health care.

These Administrative Simplification provisions require the Secretary of HHS to adopt national standards to facilitate the electronic exchange of information for certain financial and administrative transactions; select or establish code sets for data elements; protect the privacy of individually identifiable health information; maintain administrative, technical, and physical safeguards for the security of health information; provide unique health identifiers for individuals, employers, health plans, and health care providers; and to adopt procedures for the use of electronic signatures.

Health plans, health care clearinghouses, and health care providers who transmit financial and administrative transactions electronically are required to use standardized data elements and comply with the national standards and regulations promulgated pursuant to Part C. Failure to comply with the regulations may subject the covered entity to civil or criminal penalties.

Civil Money Penalties

Under HIPAA, the Secretary is required to impose a civil monetary penalty (CMP) on any person failing to comply with the Administrative Simplification provisions in Part C. The maximum civil money penalty (i.e., the fine) for a violation of an administrative simplification provision is $100 per violation and up to $25,000 for all violations of an identical requirement or prohibition during a calendar year.

A number of procedural requirements that are relevant to the imposition of CMP's for violations of the Administrative Simplification standards are incorporated by reference in HIPAA from the general civil money penalty provision in 42 U.S.C. § 1320a-7a. The Secretary may not initiate a CMP action "later than six years after the date" of the occurrence that forms the basis for the CMP action. The Secretary may initiate a CMP by serving notice in a manner authorized by Rule 4 of the Federal Rules of Civil Procedure (Commencement of Action). The Secretary must give written notice to the person on whom he wishes to impose a CMP and an opportunity for a determination to made "on the record after a hearing at which the person is entitled to be represented by counsel, to present witnesses, and to cross-examine witnesses against the person." Judicial review of the Secretary's determination and the issuance and enforcement of subpoenas is available in the United States Court of Appeals.

A CMP may not be imposed with respect to an act that constitutes criminal disclosure of individually identifiable information "if it is established to the satisfaction of the Secretary that the person liable for the penalty did not know, and by exercising reasonable diligence would not have known, that such person violated the provisions"; or if "the failure to comply was due to reasonable cause and not to willful neglect" and is corrected within 30 days after learning of the violation. The Secretary may provide technical assistance during such period. A CMP may be reduced or waived "to the extent that the payment of such penalty would be excessive relative to the compliance failure involved."

Three specific affirmative defenses bar the imposition of civil money penalties: (1) the act is a criminal offense under HIPAA's criminal penalty provision—wrongful disclosure of individually identifiable health information; (2) the covered entity did not have actual or constructive knowledge of the violation; and (3) the failure to comply was due to reasonable cause and not to willful neglect, and the failure to comply was corrected during a 30-day period beginning on the first date the person liable for the penalty knew, or by exercising reasonable diligence would have known, that the failure to comply occurred.

The Office of Civil Rights (OCR) in HHS is responsible for enforcing the Privacy Rule. OCR has said that any civil penalties imposed will only affect covered entities; in other words, a member of a workforce who is not a covered entity appears not to be subject to civil sanctions by OCR.

Criminal Penalties

HIPAA establishes criminal penalties for any person who knowingly and in violation of the Administrative Simplification provisions of HIPAA uses a unique health identifier or obtains or discloses individually identifiable health information. Enhanced criminal penalties may be imposed if the offense is committed under false pretenses, with intent to sell the information or reap other personal gain.

The penalties include (1) a fine of not more than $50,000 and/or imprisonment of not more than 1 year; (2) if the offense is "under false pretenses," a fine of not more than $100,000 and/or imprisonment of not more than 5 years; and (3) if the offense is with intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm, a fine of not more than $250,000 and/or imprisonment of not more than 10 years. These penalties do not affect any other penalties that may be imposed by other federal programs.

Scope of Criminal Enforcement

In 2005, the Justice Department Office of Legal Counsel (OLC) addressed which persons may be prosecuted under HIPAA. Based on its reading of the plain terms of the statute, the privacy regulations, and Executive Order 13,141 (To Protect the Privacy of Protected Health Information in Oversight Investigations), OLC concluded that only a covered entity could be criminally liable "in violation of this part." Because Part C applies only to covered entities and mandates compliance only by covered entities, OLC concluded that direct liability for violations of section 1320d-6 was limited to covered entities (health plans, health care clearinghouses, those health care providers specified in the statute, and Medicare prescription drug card sponsors); and depending on the facts of a given case, certain directors, officers, and employees of these entities may be liable directly under section 1320d-6, based on general principles of corporate criminal liability. Other persons who obtain protected health information in a manner that causes a covered entity to release the information in violation of HIPAA, including recipients of protected information, may not be liable directly. The liability of persons for conduct that may not be prosecuted directly under section 1320d-6 is to be determined by principles of aiding and abetting liability under 18 U.S.C. § 2 and of conspiracy liability under 18 U.S.C. § 371. OLC also noted that such conduct may also be punishable under other federal laws, such as the identity theft under 18 U.S.C. § 1028 and fraudulent access of a computer under 18 U.S.C. § 1030.

The Office of Legal Counsel also considered what the "knowingly" element of the offense requires and concluded that the "knowingly" element is best read, consistent with its ordinary meaning, to require only proof of knowledge of the facts that constitute the offense.

The HIPAA Privacy Rule

To carry out the requirements of Part C, the HIPAA Privacy Rule, 45 C.F.R. Parts 160 and 164, was adopted as the national standard for the protection of individually identifiable health information. Enforcement of the Privacy Rule began on April 14, 2003, except that for small health plans with annual receipts of $5 million or less enforcement began April 2004. The Office of Civil Rights (OCR) in HHS is responsible for enforcing the Privacy Rule. The Centers for Medicare and Medicaid Services (CMS) has delegated authority to enforce the non-privacy HIPAA standards, including the Security Rule.

Because of the explicit language of HIPAA, the Privacy Rule applies only to a specified set of "covered entities": (1) health plans, (2) health care clearinghouses, and (3) health care providers who transmit information in electronic form in connection with standard transactions governed by the Administrative Simplification provisions. Medicare prescription drug sponsors were added to the list of "covered entities" in 2003. Excluded from the definition of covered entities are employees of covered entities. Business associates of covered entities are subject to certain aspects of the Privacy Rule.

The Privacy Rule applies to protected health information that is individually identifiable health information "created or received by a health care provider, health plan, or health care clearinghouse" that "[r]elates to the ... health or condition of an individual" or to the provision of or payment for health care.

The HIPAA Privacy Rule governs the use and disclosure of protected health information by HIPAA-covered entities (health plans, health care providers, and health care clearinghouses). The Rule requires a covered entity to obtain the individual's written authorization for any use or disclosure of protected health information that is not for treatment, payment or health care operations or otherwise permitted or required by the Privacy Rule. A covered entity is required to disclose protected health information in two situations: (1) to individuals when they request access to or an accounting of disclosures of their protected health information; and (2) to HHS for compliance review or enforcement action. The HIPAA Privacy Rule permits use and disclosure of protected health information, without an individual's authorization or consent, for 12 national priority purposes.

The HIPAA Security Rule

Regulations governing security standards under HIPAA require health care covered entities to maintain administrative, technical, and physical safeguards to ensure the confidentiality, integrity, and availability of electronic protected health information; to protect against any reasonably anticipated threats or hazards to the security or integrity of such information, as well as protect against any unauthorized uses or disclosures of such information. The Centers for Medicare and Medicaid Services (CMS) has been delegated authority to enforce the HIPAA Security Standard.

Effective on February 16, 2006, the Department of Health and Human Services delegated to CMS the authority and responsibility to interpret, implement, and enforce the HIPAA Security Rule provisions; to conduct compliance reviews and investigate and resolve complaints of HIPAA Security Rule noncompliance; and to impose civil monetary penalties for a covered entity's failure to comply with the HIPAA Security Rule provisions.

The Security Rule applies only to protected health information in electronic form (EPHI), and requires a covered entity to ensure the confidentiality, integrity, and availability of all EPHI the covered entity creates, receives, maintains, or transmits. Covered entities must protect against any reasonably anticipated threats or hazards to the security or integrity of such information, and any reasonably anticipated uses or disclosures of such information that are not permitted or required under the Privacy Rule; and ensure compliance by its workforce.

The Security Rule allows covered entities to consider such factors as the cost of a particular security measure, the size of the covered entity involved, the complexity of the approach, the technical infrastructure and other security capabilities in place, and the nature and scope of potential security risks. The Rule establishes "standards" in three categories—administrative, physical, and technical—that covered entities must meet, accompanied by implementation specifications for each standard.

The Security Rule requires covered entities to enter into agreements with business associates who create, receive, maintain or transmit EPHI on their behalf. Under such agreements, the business associate must: implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of the covered entity's electronic protected health information; ensure that its agents and subcontractors to whom it provides the information do the same; and report to the covered entity any security incident of which it becomes aware. The contract must also authorize termination if the covered entity determines that the business associate has violated a material term. A covered entity is not liable for violations by the business associate unless the covered entity knew that the business associate was engaged in a practice or pattern of activity that violated HIPAA, and the covered entity failed to take corrective action.

The HIPAA Administrative Simplification Enforcement Rule

On February 16, 2006, HHS published the Final Enforcement Rule, with both procedural and substantive provisions, applicable to all HIPAA administrative simplification standards in Part C. The final rule went into effect March 16, 2006. The following discussion summarizes the main provisions of the Enforcement rule.

Voluntary Cooperation

With respect to ascertaining compliance with and enforcement of the administrative simplification provisions, the Secretary of HHS is to seek the voluntary cooperation of covered entities. Enforcement and other activities to facilitate compliance include the provision of technical assistance, responding to questions, providing interpretations and guidance, responding to state requests for preemption determinations, and investigating complaints and conducting compliance reviews.

Complaints to the Secretary

The Privacy Rule permits any person to file an administrative complaint for violations. It did not create a private right of action for individuals to sue to remedy privacy violations. Individuals must direct their complaints to the HHS Office for Civil Rights (OCR) or to the covered entity. An individual may file a compliant with the Secretary if the individual believes that the covered entity is not complying with the administrative simplification provisions. Complaints to the Secretary may be filed only with respect to alleged violations occurring on or after April 14, 2003. The Secretary's investigation may include a review of the policies, procedures, or practices of the covered entity, and of the circumstances regarding the alleged acts or omissions.

Compliance Reviews

The Secretary is also authorized to conduct compliance reviews. According to OCR, it is conducting Privacy Rule compliance reviews only where compelling and unusual circumstances demand.

Responsibilities of Covered Entities

Covered entities are required to provide records and compliance reports to the Secretary to determine compliance, and to cooperate with complaint investigations and compliance reviews.

Secretarial Action

In cases where no violation is found, the Secretary is to inform the covered entity and the complainant in writing. In cases where an investigation or compliance review has indicated noncompliance, the Secretary is to inform the covered entity and the complainant in writing, and attempt to resolve the matter informally. If the Secretary determines that the matter cannot be resolved informally, the Secretary may issue written findings documenting the noncompliance. The covered entity has 30 days to respond to the Secretary's findings and must be given an opportunity to submit written evidence of any mitigating factors or affirmative defenses, as it proceeds to the civil monetary penalty phase. Finally, the Rule includes a provision that prohibits covered entities from threatening, intimidating, coercing, discriminating against, or taking any other retaliatory action against anyone who complains to HHS or otherwise assists or cooperates in the HIPAA enforcement process. Actions must be brought by the Secretary within six years from the date of the violation.

Affirmative Defenses

Three specific affirmative defenses would bar the imposition of civil money penalties: (1) the violation is a criminal offense under HIPAA—wrongful disclosure of individually identifiable health information; (2) the covered entity did not have actual or constructive knowledge of the violation; or (3) the failure to comply was due to reasonable cause and not to willful neglect, and was corrected during a 30-day period beginning on the first date the person liable for the penalty knew, or by exercising reasonable diligence would have known, that the failure to comply occurred. With respect to the first two defenses, the Secretary may waive the civil money penalty if it would be excessive in relation to the violation.

Civil Money Penalties

The Enforcement rule provides that the "Secretary will impose a civil money penalty upon a covered entity if the Secretary determines that the covered entity has violated an administrative simplification provision."

The Secretary is required to provide notice of a proposed penalty to the covered entity, including the respondent a right to request a hearing within 90 days before an Administrative Law Judge. If the respondent fails to request a hearing, the Enforcement Rule states that "the Secretary will impose the proposed penalty or any lesser penalty permitted by 42 U.S.C. 1320d-5." Once a penalty has become final, the Secretary is obligated to notify the public, state, and local medical and professional organizations; state agencies administering health care programs; utilization and quality peer review organizations; and state and local licensing agencies and organizations.

To determine the number of "violations" to compute the amount of the civil penalty, the Secretary is to base the decision upon the nature of the covered entity's obligation to act or not under the violated provision. The Rule also provides that HHS may consider the following aggravating or mitigating factors when determining the amount of the penalty: the nature of the violation; the circumstances under which the violation occurred; the degree of culpability; any history of prior compliance, including violations; the financial condition of the covered entity; and such "other matters as justice may require." The Secretary is authorized to settle any issue or case or to compromise any penalty.

Criminal Referrals

HHS refers to the DOJ for criminal investigation appropriate cases involving the knowing disclosure or obtaining of individually identifiable health information in violation of the Privacy Rule.

DOJ Criminal Enforcement Actions

Criminal convictions have been obtained in four cases involving employees of covered entities who improperly obtained protected health information. Three of the HIPAA criminal cases were brought after the OLC legal opinion limiting direct liability for violations to covered entities.

United States v. Gibson

The first case prosecuted by a U.S. Attorney's Office under the HIPAA criminal statute involved a Seattle phlebotomist employed at a cancer center who was sentenced to 16 months in prison and 3 years of supervised release in 2004 for stealing credit card information from a cancer patient, charging $9,000 worth of merchandise on it, and using that information to get credit cards in the defendant's name. The defendant was ordered to pay restitution in the amount of $15,000. The U.S. attorney's office in Seattle chose to prosecute the identity theft as a criminal HIPAA violation because the information had been collected from a patient, instead of prosecuting the defendant for identity theft. Specifically, the defendant was charged with and pled guilty to the wrongful disclosure of individually identifiable health information for economic gain in violation of 42 U.S.C. § 1320d-6(a)(3) and (b)(3). It is notable that the defendant was not a covered entity but a member of the covered entities workforce not acting within the scope of his employment. The OLC legal opinion was issued after the defendant's conviction.

United States v. Ramirez

In 2006, a Texas woman employed in the office of a doctor who had a contract to provide physicals and medical treatment to FBI agents was convicted of selling an FBI agent's medical records for $500. The defendant pled guilty to the federal felony offense of wrongfully using a unique health identifier intending to sell individually identifiable health information for personal gain, 42 U.S.C. § 1320d-6(a)(1) and (b)(3), and of violating 18 U.S.C. §2. She was sentenced to six months in jail and four months of home confinement to be followed by a two-year term of supervised release. The defendant was also ordered to pay a criminal money penalty of $100. Two aggravating factors were found by the court. First, the defendant had sold the confidential medical record, and second, the record belonged to a federal agent.

United States v. Ferrer and Machado

The defendant was an employee of a medical clinic and improperly obtained Medicare information and other patient information for more than 1,100 clinic patients and sold that information to the owner of a medical claims business for $5 to $10 each. The information was then used by medical providers to fraudulently bill Medicare for services not rendered and equipment not supplied, resulting in a $7 million fraud to Medicare and the payment of approximately $2.5 million to providers and suppliers. The defendants were charged with conspiracy in violation of 18 U.S.C. § 371, with computer fraud in violation of 18 U.S.C. § 1030(a)(4)and (c)(3)(A), wrongful disclosure of individually identifiable health information in violation of 42 U.S.C. § 1320d-6(a)(2) and (b)(3), and aggravated identity theft in violation of 18 U.S.C. § 1028A(a)(2). Because the clinic-employer was a cooperating witness and the defendant was acting outside the scope of her lawful employment, the clinic was not charged.

In January 2007, Florida defendant Machado pled guilty to conspiracy to commit computer fraud, conspiracy to commit identity theft and conspiracy to wrongfully disclose individually identifiable health information. The defendant testified against her co-defendant. The defendant was sentenced on April 27, 2007, and faced a maximum of 5 years imprisonment, $250,000 fine, and possible restitution. Defendant Machado was sentenced to 3 years probation, including 6 months of home confinement, and also ordered to pay restitution in the amount of $2,505,883.

Co-defendant Ferrer, owner of the medical claims business, was convicted by a jury of all eight counts (one count of conspiring to defraud the United States, one count of computer fraud, one count of wrongful disclosure of individually identifiable health information, and five counts of aggravated identity theft). Defendant Ferrer was also sentenced on April 27, 2007, and faced a maximum statutory term of imprisonment of 5 years on the conspiracy count; a maximum statutory term of imprisonment of 5 years on the computer fraud count; a maximum statutory term of imprisonment of 10 years on the wrongful disclosure of individually identifiable health information count; and a maximum statutory term of imprisonment of 2 years on each count of aggravated identity theft. Ferrer was sentenced to 87 months in prison, 3 years of supervised release, and ordered to pay restitution in the amount of $2,505,883. According to DOJ, this is the first HIPAA violation case that has gone to trial. The two other cases resulted in guilty pleas.

United States v. Smith

The defendant, a licensed practical nurse at the time of the crime, pleaded guilty in April, 2008 to wrongfully disclosing individually identifiable health information for personal gain, a violation of the health information privacy provisions of HIPAA. On December 3, 2008, the defendant was sentenced to two years probation including 100 hours of community service.

HHS Enforcement of the HIPAA Privacy Rule

According to recently released data from HHS, from April 2003, when enforcement of the Privacy Rule began, to December 31, 2008, approximately 41,107 health information privacy complaints were filed with HHS. In 23,466 cases, HHS did not find enforcement authority under HIPAA. HHS found authority to investigate and resolve 7,729 cases. In those cases, HHS obtained changes in the investigated entity's privacy practices or other corrective actions. HHS found no violation of the Privacy Rule in 3,858 cases. Almost 6,054 cases remained unresolved.

According to HHS, the compliance issues most frequently investigated were for impermissible use or disclosure of protected health information, lack of adequate safeguards for protected health information, lack of patient access to his or her protected health information, the disclosure of more information than is minimally necessary to satisfy a particular request for information, and failure to have an individual's authorization for a disclosure that requires one. The covered entities most commonly required to take corrective action by HHS, in order of frequency, include private practices, general hospitals, outpatient facilities, health plans, and pharmacies.

According to its enforcement website, HHS did not report any civil penalties during the five-year period of 2003-2008. HHS reported that more than 448 cases were referred by HHS to DOJ for criminal investigation of knowing disclosure or access to protected health information in violation of the Privacy Rule. An additional 285 cases were referred to the Centers for Medicare and Medicaid Services (CMS) for investigation of cases that involve a potential violation of the HIPAA Security Rule. Although information on criminal convictions was not reported by HHS, criminal convictions were obtained in four cases involving employees of covered entities who improperly obtained protected health information.

Concerns have been raised by some that the HIPAA Privacy Rule is being underenforced by the U.S. Departments of Health and Human Services (HHS) and Justice (DOJ). Privacy advocates have been critical of HHS' enforcement of the HIPAA Privacy Rule which has focused on technical assistance and voluntary cooperation for the covered entity with HHS. According to HHS, several factors contribute to the number of enforcement actions taken by it for violations of the HIPAA Privacy Rule. First is HHS's preference for voluntary compliance, corrective action, and/or resolution agreement. Second, HIPAA applies only to certain groups, defined as covered entities, health plans, health care clearinghouses, and health care providers who transmit financial and administrative transactions electronically. HIPAA does not cover all types of entities that maintain personal health information (e.g., life insurers, employers, workers compensation carriers, schools and school districts, state agencies such as child protective service agencies, law enforcement agencies, and municipal offices). Third, HIPAA does not cover of all types of health transactions. Fourth, the statute does not create a private right of action, but rather public enforcement by HHS and DOJ. Fifth, the complained-of activity might not be a violation of the Privacy Rule.

In July 2008, the first time since the Privacy Rule went into effect in 2003, HHS required a resolution agreement from a covered entity (a contract signed by HHS and the covered entity) for violations of the HIPAA Privacy and Security Rules. HHS entered into a resolution agreement with Providence Health & Services requiring the covered entity to pay $100,000 and to implement a corrective action plan to safeguard identifiable electronic patient information to settle potential violations of the HIPAA Privacy and Security Rules. In this case the violations involved the loss of backup tapes and theft of laptops containing individually identifiable health information.

CMS Enforcement of the HIPAA Security Rule

The Centers for Medicare & Medicaid Services (CMS) is the agency within HHS that is responsible for enforcing the HIPAA Security Rule. In October 2008, the HHS inspector general released a report on the results of his audit to evaluate the effectiveness of CMS's oversight and enforcement of covered entities' implementation of the HIPAA Security Rule. Inspector General Daniel R. Levinson concluded that

CMS had taken limited actions to ensure that covered entities adequately implement the HIPAA Security Rule. These actions had not provided effective oversight or encouraged enforcement of the HIPAA Security Rule by covered entities. Although authorized to do so by Federal regulations as of February 16,2006, CMS had not conducted any HIPAA Security Rule compliance reviews of covered entities. To fulfill its oversight responsibilities, CMS relied on complaints to identify any noncompliant covered entities that it might investigate. As a result, CMS had no effective mechanism to ensure that covered entities were complying with the HIPAA Security Rule or that ePHI was being adequately protected.

Although CMS did not agree with those findings, the inspector general recommended that CMS establish policies and procedures for conducting HIPAA Security Rule compliance reviews of covered entities.