HHS cracks down hard on HIPAA privacy violations

More than $5M in fines are the first since law took effect

The Health and Human Services Department has issued hefty fines against two violators of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule. They are the first fines the department has issued for violating HIPAA since it became law.

Announced Feb. 24, the department fined The General Hospital Corporation and Massachusetts General Physicians Organization Inc. (Mass General) $1 million for violating the rule. On Feb. 22, HHS fined Cignet Health of Prince George’s County, Md., $4.3 million.

“Ensuring that Americans’ health information privacy is protected is vital to our health care system and a priority of this administration,” HHS Secretary Kathleen Sebelius said in a statement. “The U.S. Department of Health and Human Services is serious about enforcing individual rights guaranteed by the HIPAA Privacy Rule.”

HHS’ Office for Civil Rights (OCR) Director Georgina Verdugo reiterated Sebelius’ statement. “OCR is serious about HIPAA enforcement. It is a covered entity’s responsibility to protect its patients’ health information,” she said.

HIPAA requires health plans, health care clearinghouses and most health care providers to protect the privacy of patient information through administrative, physical and technical safeguards.

After an investigation by OCR, the agency found Mass General in violation when an employee left documents relating to 192 patients on a subway train. The documents, which were never recovered, included information on patient names, dates of birth, medical record numbers, health insurers and policy numbers, diagnoses and name of providers for 66 of those patients. HHS discovered the loss after a patient reported the records lost on March 9, 2009.

As a result of the agency’s findings, Mass General signed an agreement to “develop and implement a comprehensive set of policies and procedures to safeguard the privacy of its patients,” HHS said in its release. The actions include employee training, policies and procedures regarding record removal from the hospital, regular internal audits, and an incident action plan. The hospital will also be required to send in semi-annual audit reports to HHS for three years.

HHS found Cignet, which operates four clinics in Southern Maryland, guilty of denying 41 patients access to their medical records between September 2008 and October 2009. Under HIPAA, entities are required to provide patients their records within 30, and no later than 60, days of their request. The penalty for the violations was $1.3 million. HHS also found Cignet guilty of violating the Health Information Technology for Economic and Clinical Health (HITECH) Act.

The department fined Cignet an additional $3 million after it failed to cooperate with investigations “on a continuing daily basis” from March 17, 2009, to April 7, 2010. HHS obtained a default judgment against the company on March 30, 2010 to produce the records after Cignet refused to comply with a subpoena from HHS to do so. “On April 7, 2010, Cignet produced the medical records to OCR, but otherwise made no efforts to resolve the complaints through informal means,” HHS said.

“Covered entities and business associates must uphold their responsibility to provide patients with access to their medical records, and adhere closely to all of HIPAA’s requirements,” Verdugo said. “The U.S. Department of Health and Human Services will continue to investigate and take action against those organizations that knowingly disregard their obligations under these rules.”

The fines and other actions by HHS could be a sign that the department is getting serious about enforcement, said Deborah Peel, founder and chairwoman of the Patient Privacy Rights Foundation, reported Kumar Vijayan in a Computerworld article Feb. 25.

The actions are among "the most significant things that the administration has done for patient privacy," said Peel.



About the Author

Kathleen Hickey is a freelance writer for GCN.

Reader Comments

Wed, Mar 2, 2011

Very curious to see how this impacts the use of wireless communications for caregivers-- which is essential to efficiently and quickly summoning resources to the point of care in a hospital setting.

Mon, Feb 28, 2011 Puregoldj Washington, DC

I am hopeful that the law will extend to the former Kansas AG, who is clearly guilty of criminal activity for deliberately unauthorized disclosure of personal information, in clear violation of (1) The Privacy Acto of 1974, (2) HIPAA, and (3) the E-Government Act of 2003. I am an IT governance guy, not a lawyer, so I am probably missing a few. However I do know that the laws I mentioned have no exceptions for ideological crusades. Prosecuting this guy, and disbarring him if he is found guilty would send a message.

Mon, Feb 28, 2011

HIPAA as implemented saves corporations a fortune in flowers! Just think, if no one can talk about you being ill, being in the hospital, or convalescing/confined you don't have to send flowers or even a "Get Well" card. When you have a tailess ape like the former Kansas AG free to practice his own brand of fundamentalist terrorism as a part of his government role,who needs this law or any other?

Sat, Feb 26, 2011

I was encouraged by this story. I then learned a former Attorney General of Kansas, had actually acquired the medical records of women who had visited an abortion clinic. He made copies of the records and made the contents of the records available to third parties. I am opposed to abortion, but I wish this man could be prosecuted under current law.

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above