The HIPAA Privacy, Security, and Breach Notification Rules¹ apply to healthcare providers who engage in certain electronic transactions, healthcare clearinghouses, and health plans, including employee group health plans with 50 or more participants or that are administered by a third party.² Covered entities must comply with HIPAA for the following reasons:

1. Civil Penalties Are Mandatory for Willful Neglect. The Office for Civil Rights (“OCR”) is required to impose HIPAA penalties if the covered entity acted with willful neglect, i.e., with “conscious, intentional failure or reckless indifference to the obligation to comply” with HIPAA requirements.³ The following chart summarizes the tiered penalty structure⁴:

A single action may result in multiple violations. According to HHS, the loss of a laptop containing records of 500 individuals may constitute 500 violations.⁵ Similarly, if the violations were based on the failure to implement a required policy or safeguard, each day the covered entity failed to have the required policy or safeguard in place constitutes a separate violation.⁶ Not surprisingly, penalties can add up quickly. And the government is serious about the new penalties: the OCR has imposed millions of dollars in penalties or settlements since the mandatory penalties took effect.⁷ State attorneys general may also sue for HIPAA violations and recover penalties of $25,000 per violation plus attorneys’ fees.⁸ Future regulations will allow affected individuals to recover a portion of any settlement or penalties arising from a HIPAA violation, thereby increasing individuals’ incentive to report HIPAA violations.⁹

The good news is that if the covered entity does not act with willful neglect, the OCR may waive or reduce the penalties, depending on the circumstances.¹⁰ More importantly, if the covered entity or business associate does not act with willful neglect and corrects the violation within 30 days, the OCR may not impose any penalty; timely correction is an affirmative defense.¹¹

2. HIPAA Violations May Be A Crime. Federal law prohibits any individual from improperly obtaining or disclosing protected health information (PHI) from a covered entity without authorization; violations may result in the following criminal penalties¹²:

Physicians, hospital staff members, and others have been prosecuted for improperly accessing, using or disclosing PHI.

3. Covered Entities Must Self-Report HIPAA Breaches. The risk of penalties is compounded by the fact that covered entities must self-report HIPAA breaches of unsecured PHI to the affected individual, HHS, and, in certain cases, to the media.¹³ In 2013, the Omnibus Rule modified the Breach Notification Rule to eliminate the former harm analysis; now a breach of PHI is presumed to be reportable unless the covered entity or business associate can demonstrate a low probability that the data has been compromised through an assessment of specified risk factors.¹⁴ Reporting a HIPAA violation is bad enough given the costs of notice, responding to government investigations, and potential penalties, but the consequences for failure to report a known breach are likely worse: if discovered, such a failure would likely constitute willful neglect, thereby subjecting the covered entity or business associate to the mandatory civil penalties.¹⁵

4. Potential for a Private Cause of Action. HIPAA does not expressly create a private cause of action for injured individuals; however, plaintiffs may attempt to use HIPAA to establish the standard of care owed in a negligence claim. In addition, individuals may also sue under common law tort theories such as invasion of privacy, negligent infliction of emotional distress, or public disclosure of private facts. Even if the covered entity ultimately prevails, the covered entity may face the costs of defending the suit.

Given the increased penalties, lowered breach notification standards, and expanded enforcement, it is more important than ever for covered entities to comply or, at the very least, document good faith efforts to comply, to avoid a charge of willful neglect, mandatory penalties, and civil lawsuits. The following are key compliance actions that covered entities should take.

1. Assign HIPAA responsibility. Covered entities must designate persons to serve as their HIPAA privacy and security officers, and document the designation in writing.¹⁶ The privacy and security officers are responsible for ensuring HIPAA compliance. To that end, they should be thoroughly familiar with the requirements of the HIPAA Privacy¹⁷, Security¹⁸, and Breach Notification Rules.¹⁹ The OCR maintains a very helpful website to assist covered entities in complying with the rules, http://www.hhs.gov/ocr/privacy/.

2. Know the use and disclosure rules. The basic privacy rules are relatively simple: covered entities may not use, access, or disclose PHI without the individual’s valid, HIPAA-compliant authorization unless the use or disclosure fits within an exception.²⁰ Unless they have agreed otherwise, covered entities may use or disclose PHI for purposes of treatment, payment, or certain health care operations without the individual’s consent.²¹ In addition, covered entities may use or disclose PHI for certain purposes so long as the individual has not objected, including use of certain PHI for facility directories, or disclosure of PHI to family members or others involved in the individual’s care or payment for their care, and the provider believes the disclosure is in the individuals’ best interests.²² HIPAA contains numerous exceptions that allow disclosures of PHI to the extent another law requires disclosures or for certain public safety and government functions, including reporting of abuse and neglect; responding to government investigations; or disclosures to avoid a serious and imminent threat to the individual.²³ Even though HIPAA would allow a disclosure, the covered entity generally cannot disclose more than is minimally necessary for the intended purpose.²⁴ Covered entities generally must take reasonable steps to verify the identity of the person to whom the disclosure may be made.²⁵ The OCR has published a helpful summary of the Privacy Rule athttp://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/privacysummary.pdf, although the summary has not been updated to reflect changes in the recent Omnibus Rule.

3. Know individuals’ rights. HIPAA grants individuals certain rights concerning their PHI. Among others, individuals generally have a right to request limitations on otherwise permissible disclosures for treatment, payment, and healthcare operations²⁶; request confidential communications at alternative locations or by alternative means²⁷; access or obtain copies of their PHI, including e-PHI²⁸; request amendments to their PHI²⁹; and obtain an accounting of impermissible and certain other disclosures of PHI.³⁰ Covered entities must know and allow individuals to exercise their rights. One health system was fined $4.3 million for, among other things, failing to timely respond to individual requests to access their PHI.³¹

4. Implement and maintain written policies. HIPAA requires covered entities to develop and maintain written policies that implement the Privacy, Security, and Breach Notification Rule requirements.³² According to HHS, maintaining the required written policies is a significant factor in avoiding penalties imposed for “willful neglect.”³³ Rite Aid paid $1,000,000 to settle HIPAA violations based in part on its failure to maintain required HIPAA policies.³⁴ If they have not done so, covered entities should update their privacy and breach notification policies to comply with the new Omnibus Rule provisions issued in 2013.

5. Develop compliant forms. HIPAA requires that certain documents used by covered entities satisfy regulatory requirements as described below. Covered entities should ensure that their HIPAA forms comply, although the OCR has suggested that technical non-compliance would likely not constitute willful neglect.³⁵

a. Authorizations. HIPAA authorizations to use or disclose PHI must contain certain elements and required statements to be valid.³⁶

b. Notice of privacy practices. Covered entities must provide individuals with a notice of privacy practices that describes how the entity will use the individual’s PHI and contains certain required statements.³⁷ The OCR has published model privacy notices on its website, http://www.hhs.gov/ocr/privacy/hipaa/modelnotices.html, although most covered entities would likely prefer to use their own forms.

c. Other forms. Although not required, covered entities may develop other forms to ensure compliance with individual rights, such as individual requests to access PHI, amend records, or obtain an accounting of disclosures.

6. Execute appropriate business associate agreements. Although HIPAA now applies directly to business associates, HIPAA still requires covered entities to execute “business associate agreements” with their business associates before disclosing PHI to the business associate.³⁸ Business associates are generally those outside entities who create, receive, maintain, or transmit PHI on behalf of the covered entity.³⁹ The Omnibus Rule expanded the definition of “business associates” to include data storage companies, entities that provide data transmission services if they require routine access to PHI, and subcontractors of business associates.⁴⁰ If they have not done so recently, covered entities should immediately identify their business associates and ensure appropriate agreements are executed with them.

Breach of the business associate agreement exposes the business associate to contract claims by the covered entity in addition to HIPAA penalties. Covered entities are generally not liable for the actions of their business associates unless the covered entity knows of a pattern of activity or practice of the business associate that constitutes a material violation of the business associate’s obligation and fails to act to cure the breach or end the violation,⁴¹ or the business associate is acting as the agent of the covered entity.⁴² To avoid liability, covered entities should ensure that business associates are acting as independent contractors, not agents of the covered entity.⁴³

7. Perform and document a risk analysis. The HIPAA Security Rule applies to PHI maintained in electronic form, e.g., data on computers, mobile devices, USBs, etc.⁴⁴ Covered entities must conduct and document a risk analysis of their computer and other information systems to identify potential security risks and respond accordingly.⁴⁵ HHS has provided an on-line risk assessment tool that covered entities may use to perform their analysis; it is available at the following location: https://www.healthit.gov/providers-professionals/security-risk-assessment-tool. The OCR has published additional guidance for the risk analysis at http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/rafinalguidancepdf.pdf. Covered entities should periodically review and update their risk analysis. A Massachusetts dermatology practice recently agreed to pay $150,000 for, among other things, failing to conduct an adequate risk assessment of its systems, including the use of USBs.⁴⁶

8. Implement required safeguards. HHS recognizes that individual privacy cannot be absolutely protected; accordingly, HIPAA does not impose liability for “incidental disclosures” so long as the covered entity implemented reasonable administrative, technical, and physical safeguards designed to protect against improper disclosures.⁴⁷ The Security Rule contains detailed regulations specifying safeguards that must be implemented to protect e-PHI.⁴⁸ The Privacy Rule is less specific; it simply requires that covered entities implement reasonable safeguards.⁴⁹ The reasonableness of the safeguards depends on the circumstances, but may include, e.g., not leaving PHI where it may be lost or improperly accessed; checking e-mail addresses and fax numbers before sending messages; using fax cover sheets; etc.

9. Train workforce. Having the required safeguards, policies, and forms is important, but covered entities and business associates must also train their workforce members to comply with their policies and document such training.⁵⁰ HIPAA requires that new employees receive training within a reasonable period of time after hire, and as needed thereafter.⁵¹ According to HHS commentary, covered entities may avoid HIPAA penalties based on the misconduct of a rogue employee so long as the covered entity implemented appropriate policies and adequately trained the employee.⁵²

10. Respond immediately to any violation or breach. This is critical for several reasons. First, HIPAA requires covered entities and business associates to investigate any privacy complaints, mitigate any breach, and impose appropriate sanctions against any agent who violates HIPAA.⁵³ It may also require covered entities to terminate an agreement with a business associate due to the business associate’s noncompliance.⁵⁴ Second, prompt action may minimize or negate the risk that the data has been compromised, thereby allowing the covered entity or business associate to avoid self-reporting breaches to the individual or HHS.⁵⁵ Third, a covered entity or business associate can avoid HIPAA penalties altogether if it does not act with willful neglect and corrects the violation within 30 days.⁵⁶

11. Timely report breaches. If a reportable breach of unsecured PHI occurs, covered entities must notify the individual within 60 days.⁵⁷ If the breach involves less than 500 persons, the covered entity must notify HHS by filing an electronic report no later than 60 days after the end of the calendar year.⁵⁸ If the breach involves 500 or more persons, the covered entity must file the electronic report when it notifies the individual.⁵⁹ If the breach involves more than 500 persons in a state, the covered entity must notify local media.⁶⁰ The written notice to the individual must satisfy regulatory requirements concerning the manner and content of the notice.⁶¹

12. Document actions. Documenting proper actions will help covered entities defend against HIPAA claims. Covered entities and business associates are required to maintain documentation required by HIPAA for six years from the date that the document was last in effect.⁶²

13. Beware more stringent laws. In evaluating their compliance, covered entities must also consider other federal or state privacy laws. To the extent a state or other federal law is more stringent than HIPAA, covered entities should comply with the more restrictive law, including conditions of participation or licensing regulations that may apply to certain facilities.⁶³ In general, a law is more stringent than HIPAA if it offers greater privacy protection to individuals, or grants individuals greater rights regarding their PHI.⁶⁴

CONCLUSION.

Covered entities must comply with HIPAA or face draconian penalties. As many businesses have recently learned, even seemingly minor or isolated security lapses may result in major fines and business costs. Fortunately, however, covered entities may avoid mandatory fines and minimize their HIPAA exposure by taking and documenting the steps outlined above. Covered entities may use this outline to evaluate and, where needed, upgrade their overall HIPAA compliance.

¹45 CFR part 164.
²45 CFR § 160.103, definition of “covered entity.”
³45 CFR § 160.401 and 164.404.
⁴45 CFR § 160.404.
⁵See 78 FR 5584 (1/25/13).
⁶45 CFR §160.406; 78 F.R. 5584 (1/25/13).
⁷The OCR’s website contains data summarizing HIPAA enforcement activities, http://www.hhs.gov/ocr/privacy/hipaa/enforcement/index.html.
⁸42 USC § 1320d-5(d); see also OCR training for state attorneys general at http://www.hhs.gov/ocr/privacy/hipaa/enforcement/sag/index.html.
⁹See 78 FR 5568 (1/25/13).
¹⁰45 CFR § 160.308(a)(2) and 160.408.
¹¹45 CFR § 160.410.
¹²42 USC § 1320d-6.
¹³45 CFR § 164.400 et seq.
¹⁴45 CFR § 164.402; 78 FR 5641 (1/25/13).
¹⁵75 FR 40879 (7/14/10).
¹⁶45 CFR §§ 164.308(a)(2) and 164.530(a).
¹⁷45 CFR part 164, subpart E (§§ 164.500-164.534).
¹⁸45 CFR part 164, subpart C (§§ 164.302-164.318).
¹⁹45 CFR §164.502, Subpart D (§§ 164.400-414).
²⁰45 CFR §164.502
²¹45 CFR §§164.506 and 164.522(a).
²²See 45 CFR § 164.510.
²³45 CFR § 164.512.
²⁴45 CFR §§ 164.502(b) and 164.514(d).
²⁵45 CFR § 164.514(h).
²⁶45 CFR § 164.522(a).
²⁷45 CFR § 164.522(b).
²⁸45 CFR § 164.524.
²⁹45 CFR § 164.526.
³⁰45 CFR § 164.528.
³¹See Press Release at http://www.hhs.gov/news/press/2011pres/02/20110222a.html.
³²45 CFR §§ 164.316(a), 164.404(a), and 164.530(f).
³³See 75 FR 48078-79.
³⁴See Press Release at http://www.hhs.gov/news/press/2010pres/07/20100727a.html.
³⁵75 FR 40878 (7/14/10)
³⁶45 CFR § 164.508(c).
³⁷45 CFR § 164.520.
³⁸45 CFR §§ 164.308(b) and 164.502(e).
³⁹45 CFR § 160.103.
⁴⁰45 CFR § 160.103.
⁴¹45 CFR § 164.504(e)(1).
⁴²45 CFR § 160.402(c).
⁴³78 FR 5581.
⁴⁴45 CFR § 164.103.
⁴⁵45 CFR § 164.308(a)(1).
⁴⁶See Press Release at http://www.hhs.gov/news/press/2013pres/12/20131226a.html.
⁴⁷45 CFR § 164.502(a)(1); see Guidance athttp://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/incidentalusesanddisclosures.html.
⁴⁸45 CFR §§ 164.308 to 164.316 and Appendix A to 45 CFR part 164, subpart C.
⁴⁹45 CFR § 164.530(c).
⁵⁰45 CFR § 164.530(b); see also 45 CFR §§ 164.308(a)(5) and 164.414(a).
⁵¹45 CFR § 164.530(b).
⁵²75 FR 40879.
⁵³45 CFR § 164.530(d)-(f).
⁵⁴45 CFR §§164.314(a)(2) and 164.504(e)(2).
⁵⁵45 CFR § 164.402.
⁵⁶45 CFR § 160.410.
⁵⁷45 CFR § 164.404.
⁵⁸45 CFR § 164.408(c).
⁵⁹45 CFR § 164.408(b).
⁶⁰45 CFR § 164.406.
⁶¹45 CFR § 164.404(c)-(d).
⁶²45 CFR §§ 164.316(b), 164.414(a), and 164.530(j).
⁶³45 CFR § 160.203.
⁶⁴45 CFR § 160.202.