Enforcement Actions for Unauthorized Disclosures - Module 3 of 5

Module 3: Enforcement Actions for Unauthorized Disclosures

HIPAA Enforcement 

According to health privacy experts, the first part of 2018 was a “light” time for enforcement of the Health Insurance Portability and Accountability Act of 1996, also known as HIPAA. As of April, there were only two publicly-disclosed settlements for violations.[1] One involved Fresenius Medical Care North America, which paid the U.S. Department of Health and Human Services $3.5 million in fines after it failed to implement policies and procedures to address security incidents.[2] The second fine involved Filefax, Inc., a medical records storage company, which improperly disposed of medical records for 2,150 patients.[3] 

Public settlements were down, but that doesn’t mean that enforcement is lax. In this module, we delve into enforcement actions and learn about how the federal government ensures that a covered entity is held responsible for any unauthorized disclosures that violate HIPAA.

There is a two-pronged approach to HIPAA enforcement.[4] The first, is the civil route, whereby the U.S. Department of Health and Human Services’ Office of Civil Rights investigates alleged violations and imposes civil penalties for HIPAA violations. The second prong is a criminal enforcement route, led by either the U.S. Department of Justice or a state’s attorney general, which will conduct a criminal investigation and prosecute a covered entity that violates HIPAA’s privacy and security regulations.[5]

Civil Investigation of HIPAA Violations 

The civil investigation process begins with the Office of Civil Rights looking into a filed complaint.[6] Next, it will conduct a compliance review to determine whether a covered entity is complying and protecting a person’s protected health information. Finally, it will conduct educational outreach to foster HIPAA compliance. 

The Office of Civil Rights receives thousands of complaints of possible HIPAA violations annually, but it cannot investigate every single one. Approximately sixty-two percent of complaints filed with it are ineligible for investigation.[7] It will only act on complaints that meet the following conditions. First, the alleged violation must have taken place after the date the Rules took effect. Compliance wasn’t required until 2005, so the Office of Civil Rights can’t investigate a complaint about a potential violation that occurred before that year. Second, the complaint must be filed with the Office of Civil Rights against a covered entity covered by the Privacy and Security Rules. Examples of such entities include health plans, doctors, health insurance companies, and pharmacies. Examples of entities that may have access to a person’s protected health information but aren’t subject to HIPAA’s Privacy and Security Rules include employers, life insurers and state law enforcement agencies. Third, a complaint must allege an activity that, if proven, violates the Privacy or Security Rule. For example, the Office of Civil Rights can’t investigate a complaint alleging that a doctor sent his patient’s demographic information to an insurance company to obtain payment because the Privacy Rule generally permits doctors to disclose such information for purposes of billing for services.

According to the Office of Civil Rights, “some of the most frequently investigated compliance issues relate to improper use or disclosure of health information, lack of safeguards to protect health information and lack of patient access to health information.”[8] A complainant alleging a HIPAA violation must file a complaint within 180 days of when he knew, or should have known, about the alleged violation of the Privacy or Security Rule.[9] The Office of Civil Rights may waive this time limit if it determines that the complainant shows good cause for not submitting the complaint within the 180-day time frame.

If the Office of Civil Rights accepts a complaint for investigation, it will notify the complainant and the covered entity named in it. Once notified, both parties can present information about the problem described in the complaint. The Office of Civil Rights may request information from each to understand the facts, the circumstances surrounding the incident, and the covered entity’s related policies, procedures, and practices. The Office reviews the evidence gathered in each case. 

When the investigation is done, the Office of Civil Rights issues a closure letter, which presents the agency’s decision on whether there has been a violation of a federal statute or regulation. It will attempt to settle and resolve the issues with the covered entity by obtaining:

    ·        voluntary compliance;   

    ·        corrective action; and

    ·        a resolution agreement[10] 

Sample Case Studies of HIPAA Remedies

The Office of Civil Rights prefers to resolve HIPAA violations using a measure such as a resolution agreement that will have a covered entity voluntarily comply with HIPAA. For example, in 2017 one investigation concerned Memorial Healthcare System, a nonprofit corporation which operates six hospitals, an urgent care center, a nursing home, and a variety of ancillary healthcare facilities throughout South Florida. The protected health information, such as names, dates of birth, and Social Security numbers, of over 115,000 people had been impermissibly accessed by its employees and impermissibly disclosed to affiliated physician office staff. Additionally, a former employee’s login credentials had been used to access health records affecting 80,000 people. Memorial Healthcare System not only agreed to pay a $5.5 million settlement, it announced that it would voluntarily implement a robust corrective action plan immediately that would include procedures to modify and terminate employees’ right of access, as required by the HIPAA Rules. Some of these procedures in the corrective action plan included:[11]

    ·        enacting new policies and procedures to enhance password security;

    ·        hiring IBM to provide assessment, response, and password monitoring services; and

    ·        hiring an independent technology firm to conduct monthly network audits and scans 

Urging voluntary compliance and reaching a resolution agreement aren’t the only tools in the civil arsenal. The Office of Civil Rights can also impose severe civil monetary penalties. HIPAA imposes a tiered structure for fines with a high financial cost for a covered entity that fails to adequately protect protected health information.[12] A violation that the covered entity was unaware of and could not have realistically avoided even had reasonable care been exercised will still lead to a minimum fine of $100 per violation and a maximum of $50,000 per violation, with an annual maximum of $1.5 million in fines.[13]  A HIPAA violation suffered as a direct result of “willful neglect” of HIPAA Rules but where an attempt has been made to correct the violation will lead to a minimum fine of $10,000 per violation and a maximum of $50,000 per violation, with an annual maximum of $1.5 million in fines.[14] If there’s a violation due to willful neglect and the covered entity makes no attempt to correct the violation, there will be a $50,000 fine per violation with an annual maximum of $1.5 million in fines.[15]  

Covered entities of all sizes and reputations can be fined. In July 2009, the Office of Civil Rights fined a Kaiser Permanente Hospital $187,500 for patient privacy violations.[16] It found that the hospital, located in Los Angeles, compromised the privacy of four patients when several employees improperly accessed those patients’ electronic health records. This penalty followed another fine levied against the same hospital two months earlier, for improper access to the medical records of the “Octomom,” Nadya Suleman.[17] Kaiser was fined $250,000 after it discovered that twenty-five employees were identified as having inappropriately accessing Suleman’s medical records.[18] 

Another case involved two Arizona-based cardiac surgeons whom the Office of Civil Rights investigated in 2009. It notified the surgeons that it had initiated an investigation on a complaint alleging that the surgeons had impermissibly disclosed electronic protected health information by making it available on the Internet. Specifically, the physicians posted over 1,000 separate entries of electronic protected health information on a publicly accessible, Internet-based calendar and had transmitted daily electronic protected health information from an office-based email account to the employees’ personal email accounts.[19] 

Due to these violations, the Office of Civil Rights required both physicians to pay $100,000 and to institute a corrective action plan with policies and procedures to assess risks and vulnerabilities and implement technical security measures to guard against unauthorized access to protected health information.[20] 

Criminal Prosecutions for HIPAA Violations 

A covered entity that violates HIPAA can also face criminal prosecution and penalties. Any person who “knowingly” obtains or discloses individually identifiable protected health information for an unauthorized use can face both a criminal fine and imprisonment. There are two elements of the federal statute: 

1) knowingly obtaining individually identifiable health information relating to an individual; and

2) obtaining that information in violation of federal law.[21] 

HIPAA’s criminal enforcement provision has a low threshold to prove criminal intent. The DOJ has interpreted the “knowingly” element of the HIPAA statute for criminal liability as requiring only knowledge of the actions that constitute an offense; knowledge that an action violates HIPAA is not required.[22] 

The penalties for the misdemeanor statute for HIPAA violations subject the violator to a fine of up to $50,000 and imprisonment for up to one year. Offenses committed under false pretenses carry fines of up to $100,000 and up to five years imprisonment.[23] Offenses committed with the intent to sell, transfer, or use individually identifiable protected health information for commercial advantage, personal gain, or malicious harm permit fines of $250,000 and imprisonment of up to ten years.[24] During sentencing, a court may also order the payment of restitution for improper disclosure of protected health information.

A prosecution for improper disclosure of protected health information is often brought in tandem with a healthcare fraud prosecution case. In one 2016 case, three former district managers of a Boston-based pharmaceutical company drove pharmaceutical sales by directing sales representatives to fill out prior authorizations for a certain drug even when physicians refused to authorize it.[25] To follow through with this scheme, the district managers accessed patients’ protected health information to learn about their medical histories and then shared the data with sales representatives. All three district managers pled guilty to committing healthcare fraud and prosecutors also charged them with violating HIPAA because they accessed confidential and protected health information that they had no right to access or disclose. 

Criminal prosecutions for HIPAA violations are usually misdemeanor cases, punishable by fines, penalties, forfeitures or short-term confinement. Still, in some cases, HIPAA prosecutions can result in the more serious felony convictions. 

One of the few felony HIPAA prosecutions involved a 33-year-old woman in Alaska who worked as a financial counselor at a hospital and had access to computerized medical records. One of her friends, who had been recently sentenced to life imprisonment, contacted her and asked her to check the medical records of two people he had victimized: one victim who had been sexually assaulted and another whom he had shot. She provided him with the information, including what each victim told hospital staff about how they sustained their injuries, the severity of the injuries and what was reflected in hospital records about their cooperation with law enforcement. In sentencing her to a two-year sentence after felony conviction, the federal district judge stated that the former hospital employee “displayed no respect for the law or the private and confidential information of the victims,” adding that “in this day and age, every human being expects private records to remain private.”[26] 

Private Right of Action

HIPAA does not provide a person a private right to sue. The ability to bring a civil enforcement action to remedy HIPAA violations and ensure that a healthcare provider is HIPAA compliant lies within the exclusive power of the U.S. Department of Health and Human Services.[27] Courts have also held that there is no implied private right of action under HIPAA. In one case, a hospital sued to prevent a newspaper from publishing information contained in a hospital peer review report. A federal district court in Colorado held that no implied private right of action exists under HIPAA. The fact that a federal statute has been violated and hospital patients harmed didn’t automatically give rise to a private cause of action in favor of that person. Instead, the court reasoned that Congress needed to create an implied private right of action to enforce federal law.[28]

While a patient can’t bring an individual action seeking monetary damages or an injunction for the unauthorized disclosure of health information, she may be able to bring a tort action based on state law, such as negligence, or another state statute that recognizes a private right of action. 

In 2015, Yehonatan Weinberg filed a class action lawsuit against Advanced Data Processing, a medical billing and coding company providing services to emergency medical services providers across the United States.[29] He alleged that ADP failed to safeguard his sensitive personal information and exposed the protected health information of hundreds of other emergency medical service patients, including their names, birth dates, Social Security numbers, health insurance information and other protected health information, to criminals who then sold their identities.

Weinberg made two claims: one claim for negligence based on alleged HIPAA violations and the other a (Florida) state law negligence claim under the “undertaker’s doctrine,” which imposes a liability on someone who undertakes (by contract or for free) to aid someone and then fails to act as a reasonable person in carrying out that aid.[30] He alleged that ADP implicitly undertook a responsibility to safeguard the information of its clients’ patients. 

The federal district court in Florida dismissed his first claim, reasoning that “Florida courts have refused to recognize a private right of action for negligence per se based on an alleged violation of a federal statute.”[31] However, the court granted his second claim based on state law, finding that Weinberg had sufficiently alleged a duty pursuant to the undertaker's doctrine because state law imposed a duty of care not only on parties to a contract, but also any third parties that perform services under the contract. 

In the next module, we’ll look at how HIPAA interacts with relevant state health privacy laws and we will discuss when and how HIPAA can preempt relevant state health privacy laws.