Tech & Innovation in Healthcare

Question: What are the financial penalties covered entities (CE) could face for HIPAA violations?

Colorado Subscriber

Answer: The responsibility of enforcing HIPAA Privacy and Security Rules rests with the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR). If the OCR determines a CE violated Privacy and Security Rules, they will try to obtain a resolution agreement, corrective action, or voluntary compliance from the CE.

However, if the CE remains noncompliant, then the OCR may impose civil money penalties (CMP) on the CE. These HIPAA civil violation penalties include:

• No Knowledge Penalty: $100 to $50,000 per violation, with an annual maximum of $25,000 for repeat violations
• Reasonable Cause Penalty: $1,000 to $50,000 per violation, with an annual maximum of $100,000 for repeat violations
• Willful Neglect – Corrected Penalty: $10,000 to $50,000 per violation, with an annual maximum of $250,000 per violation
• Willful Neglect – Non Corrected Penalty: $50,000 per violation, with an annual maximum of $1.5 million

The secretary of HHS has the discretion to assess the nature and extent of the violation to determine the amount of the penalty, as well as how much damage was caused by the violation. However, the secretary cannot levy fines if the violation is corrected within 30 days, except in cases where the CE was found to have committed violations of willful neglect.