The Enforcement Rule of HIPAA
In this chapter, we’ll look at the Enforcement Rule and the effect that violations can have on individuals and organizations alike. The Enforcement Rule defines how regulators from the Department of Health and Human Services determine liability and calculate fines for any covered entity or business associate that has violated HIPAA law.
Who enforces the rules of HIPAA?
The Office for Civil Rights (OCR) is responsible for administering and enforcing the HIPAA Privacy and Security Rules and conducts complaint investigations, compliance reviews, and audits. Even if you violate HIPAA due to ignorance, you as an individual can face consequences, along with your organization.
Malicious Violations of HIPAA
If you, as an individual, violate HIPAA with a malicious motive, such as using the information for personal gain or to harm another individual, you can face big fines or up to 10 years in jail. Although the federal HIPAA law does not give an individual the right to file a lawsuit against an organization, the individual may be able to file one according to state privacy laws. Let's see what this might look like in the workplace.
Unconscious bias can have a wide range of harmful effects, both on individuals and on society as a whole. With effective workplace training, you can avoid these issues.
While it can be fun to create the occasional social media dance video at work, just remember to make sure no individual PHI is compromised in the process. Even if you breach HIPAA unintentionally, you could still be held accountable along with your company.
An employee of a Cancer Care center accessed and used a patient’s name, birth date, and social security number from the center's medical records to fraudulently obtain four credit cards. The employee pleaded guilty and served a 16-month prison sentence and had to pay back both the impacted credit card companies and the patient.
An employee taking pictures of a patient's medical records and texting them to a friend. Taking a picture of a client's PHI is definitely a HIPAA violation, in which case it should be reported to HR. In some cases, they may not just be taking pictures of random patient PHI, it could be from fellow coworkers who are also patients.
What are the consequences for a HIPAA violation?
The consequences of a HIPAA violation depend on the level of negligence. The fine for non-compliance can range from $100 - $50,000 per violation or per record, with a maximum fine of $1.5 million. But the true cost of compliance will be far greater. Victims of breaches may pursue class action lawsuits against you. Furthermore, the cost of losing customers to another health care provider and rebuilding your reputation following a HIPAA breach can be greatly damaging.
Common HIPAA Violations
To avoid civil, monetary, and criminal penalties, it is important to be aware of the most common violations. They include:
Here are some myths to look out for:
- -
Use or disclosure of more than the minimum necessary PHI.
- -
Lack of administrative, technical, or physical ePHI safeguards and
- -
Theft or misplacement of unencrypted laptops or mobile devices with ePHI on them.
- -
Most common breaches that result in settlements higher than 1 million dollars are due to theft or misplacement.
Improve Employee Compliance with training on the HIPAA Enforcement Rule
The primary benefit of training on the HIPAA Enforcement Rule is that it helps ensure that healthcare providers and organizations comply with the regulations and standards established by the U.S. Department of Health and Human Services. With EasyLlama’s HIPAA training, employees will gain a better understanding the different types of violations, learn the penalties associated with non-compliance, and observe best practices for protecting patient information. Training on the HIPAA Enforcement Rule also helps organizations prepare for the possibility of an audit or investigation.
Helping over 8,000 organizations create a safer, more productive workplace
EasyLlama’s online training course helps prepare employees to navigate HIPAA. This course provides an in-depth examination of how to respond to a breach of confidential data and the best way to protect your patients. The course covers:
Get more from EasyLlama
