Mar
31
Living with HIPAA: Enforcement of the Privacy Rule Today
Filed Under HIPAA Compliance, HIPAA Enforcement, HIPAA Law, HIPAA Regulation, HIPAA Security, HIPAA Technology
This article is a little dated but has some decent info. Robin Johnson discusses enforcement of HIPAA Laws:
It has been almost one year since the April 14, 2003 effective date of the HIPAA Privacy Rule. 1 At this time, your organization has likely implemented HIPAA privacy policies and procedures, prepared a standard authorization form, appointed a privacy officer, and adopted a notice of privacy practices. The negotiation and execution of your business associate agreements are probably underway or complete.
Despite your best efforts to implement the Privacy Rule conscientiously, you will inevitably face, or perhaps have already faced, an allegation of a breach of privacy (a “privacy incident”). To help you understand what you’ll encounter once such an allegation has been made, this series of articles will define the term “privacy incident” and discuss: (i) how to identify a privacy incident; (ii) the potential consequences of breaching privacy; (iii) the status of government enforcement efforts to-date, and how your organization should respond to it; (iv) how to conduct an internal investigation of an alleged privacy breach; (v) how to deal with the government when a complaint has been filed with the enforcement agencies; and (vi) why civil liability under state laws may be your greatest threat.
What is a Privacy Incident?
A privacy incident involves an allegation of a breach of privacy. A breach of privacy is defined for purposes of this article as:
-a violation of your privacy policies and procedures; or
-other violations of the Privacy Rule.
A potential breach of privacy may be brought to your attention through:
- voluntary reports by your staff;
- reports/complaints brought by a consumer through your internal complaint process;
- reports of a business associate that has made an inappropriate disclosure or otherwise mishandled Protected Health Information (PHI);
- a consumer complaint (or a complaint from a family member or other interested person) that has been filed with the Office of Civil Rights (the “OCR”) of the U.S. Department of Health & Human Services (HHS) and forwarded to your organization for response; or
- a federal investigator contacting your organization from either the OCR, the HHS Office of Inspector General (the “OIG”), or the U.S. Attorneys’ Office.
Potential Consequences
The potential consequences of a privacy incident can be very serious. If a breach of privacy is substantiated, your organization could face:
- civil monetary penalties;
- criminal prosecution; or
- a civil lawsuit filed under state privacy laws.
All in all? Watch out for those HIPAA Rules. You can read more here.