Home Health & Hospice Week

The feds don't seem afraid to use their HIPAA fining power, and it was one employee's innocent mistake that cost $1 million.

And Department of Health and Human Services' Office of Civil Rights (OCR) has fined the General Hospital Corporation and Massachusetts General Physicians Organization Inc. in Boston $1 million over an incident where a Mass General employee left files on a subway train that were never recovered.

"We hope the health care industry will take a close look at this agreement and recognize that OCR is serious about HIPAA enforcement," OCR Director Georgina Verdugo says in a release about the settlement. "It is a covered entity's responsibility to protect its patients' health information."

And OCR has fined insurance plan Cignet Health of Prince George's County, Md., more than $4.3 million for breaching the HIPAA Privacy Rule. "The fine is the first civil monetary penalty (CMP) ever imposed for a covered entity's violations of the HIPAA Privacy Rule," notes law firm Sidley Austin on its website.

Cignet's fine came from failing to give patients' access to their protected health information (PHI) in their medical records, rather than accidentally revealing PHI. The high total was in part racked up due to the new willful neglect fines (see related story, p. 67).

"These cases, and HHS's apparent willingness to put them in the spotlight, demonstrate the agency's newfound commitment to investigating, uncovering and imposing penalties for HIPAAviolations," notes law firm Duane Morris in an alert on the topic.

Who might report a willful neglect violation? Most frequently, an employee who's been mistreated or terminated files such a complaint against the employer, says consultant Abner Weintraub, based on his experience as an expert witness in HIPAA cases. The second-most common scenario involves a patient filing a complaint, which might be the family member filing a complaint on the patient's behalf, adds Weintraub, president of The HIPAA Group Inc. in Orlando, Fla.