On April 26, 2019, the U.S. Department of Health and Human Services (HHS) issued a Notification of Enforcement Discretion (Notice) regarding imposition of Civil Money Penalties (CMPs) under HIPAA. In the Notice, HHS announces that it has revisited its prior interpretation of the standards for assessment of CMPs under the HITECH Act, and is exercising its discretion to reduce the maximum amount of CMPs that may be assessed annually for HIPAA violations based on culpability.

The official version of the Notice is dated April 30, 2019 and is available here.

The HITECH Act established four tiers of culpability for HIPAA violations:
1. the entity/individual did not know (and, by exercising reasonable diligence would not have known) that such entity/individual violated the provision;
2. the violation was due to reasonable cause (and not to willful neglect);
3. the violation was due to willful neglect that is timely corrected; or
4. the violation was due to willful neglect that is not timely corrected.

The HITECH Act also set forth tiers of penalties for violations corresponding to the four levels of culpability. The language of the HITECH Act created ambiguity about the cap on CMPs for all violations of a particular HIPAA requirement within a calendar year, which HHS acknowledged in 2009. As part of its Omnibus Rule finalized in 2013, HHS finalized regulations under which the limit for all violations of an identical provision of the HIPAA regulations in a single year would be $1.5 million.

HHS now states in its Notice that “[u]pon further review” of the HITECH Act, it “has determined that the better reading of the HITECH Act is to apply annual limits” as follows:

The above CMP tier structure will be used by HHS until further notice, provided that the amounts will be adjusted annually for inflation in accordance with the Bipartisan Budget Act of 2015. Per the Notice, HHS expects to engage in further rulemaking to revise its HIPAA regulations accordingly.

The Notice represents a welcome development for HIPAA-regulated organizations and individuals at a time when HHS has been increasingly pursuing high-dollar penalties for HIPAA violations.