Pathology/Lab Coding Alert

A HIPAA breach is an impermissible use or disclosure under the Privacy Rule that compromises protected health information (PHI). Gauging the severity and penalty implications of a breach depends on understanding the following four definitions:

1. Administrative simplification provision: Standard transaction rules, code sets and identifiers that ensure consistent electronic communication within the U.S. health care system.

2. Reasonable Cause: An act or omission in which a covered entity (CE) or business associate (BA) knew, or by exercising reasonable diligence would have known, that the act or omission violated an administrative simplification provision, but in which the CE or BA did not act with willful neglect.

3. Reasonable Diligence: Business care and prudence expected from a person seeking to satisfy a legal requirement under similar circumstances.

4. Willful Neglect: Conscious, intentional failure or reckless indifference to the obligation to comply with the administrative simplification provision violated.

Heads up: Willful neglect violations must be investigated, and penalties are mandatory, according to Jim Sheldon-Dean, founder and director of compliance services for Lewis Creek Systems, LLC in Charlotte, Vermont.

Understand Civil and Criminal Penalties

Based on OCR guidance, here are the civil monetary penalties linked to HIPAA violation tiers:

Criminal: HIPAA criminal cases aren’t common, but when they do occur it’s often linked to the use of patient data for personal gain. The list of criminal penalties focus on the following three tiers:

Compliance key: To overcome common staff hesitance to point out hunches or concerns regarding HIPAA, you need to “train in incident management, top to bottom,” Sheldon-Dean says. That includes providing clear descriptions of how incidents will be handled. “Staff need to feel like they are empowered to report their suspicions of information security incidents,” he says.