HHS cracks down hard on HIPAA privacy violations
Connecting state and local government leaders
The Health and Human Services Department fined Mass General $1 million after an employee left records on a train, and Cignet Health of Maryland $4.3 million for denying patients access to their records.
The Health and Human Services Department has issued hefty fines against two violators of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule. They are the first fines the department has issued for violating HIPAA since it became law.
Announced Feb. 24, the department fined The General Hospital Corporation and Massachusetts General Physicians Organization Inc. (Mass General) $1 million for violating the rule. On Feb. 22, HHS fined Cignet Health of Prince George’s County, Md., $4.3 million.
“Ensuring that Americans’ health information privacy is protected is vital to our health care system and a priority of this administration,” HHS Secretary Kathleen Sebelius said in a statement. “The U.S. Department of Health and Human Services is serious about enforcing individual rights guaranteed by the HIPAA Privacy Rule.”
HHS’ Office for Civil Rights (OCR) Director Georgina Verdugo reiterated Sebelius’ statement. “OCR is serious about HIPAA enforcement. It is a covered entity’s responsibility to protect its patients’ health information,” she said.
HIPAA requires health plans, health care clearinghouses and most health care providers to protect the privacy of patient information through administrative, physical and technical safeguards.
After an investigation by OCR, the agency found Mass General in violation when an employee left documents relating to 192 patients on a subway train. The documents, which were never recovered, included information on patient names, dates of birth, medical record numbers, health insurers and policy numbers, diagnoses and name of providers for 66 of those patients. HHS discovered the loss after a patient reported the records lost on March 9, 2009.
As a result of the agency’s findings, Mass General signed an agreement to “develop and implement a comprehensive set of policies and procedures to safeguard the privacy of its patients,” HHS said in its release. The actions include employee training, policies and procedures regarding record removal from the hospital, regular internal audits, and an incident action plan. The hospital will also be required to send in semi-annual audit reports to HHS for three years.
HHS found Cignet, which operates four clinics in Southern Maryland, guilty of denying 41 patients access to their medical records between September 2008 and October 2009. Under HIPAA, entities are required to provide patients their records within 30, and no later than 60, days of their request. The penalty for the violations was $1.3 million. HHS also found Cignet guilty of violating the Health Information Technology for Economic and Clinical Health (HITECH) Act.
The department fined Cignet an additional $3 million after it failed to cooperate with investigations “on a continuing daily basis” from March 17, 2009, to April 7, 2010. HHS obtained a default judgment against the company on March 30, 2010 to produce the records after Cignet refused to comply with a subpoena from HHS to do so. “On April 7, 2010, Cignet produced the medical records to OCR, but otherwise made no efforts to resolve the complaints through informal means,” HHS said.
“Covered entities and business associates must uphold their responsibility to provide patients with access to their medical records, and adhere closely to all of HIPAA’s requirements,” Verdugo said. “The U.S. Department of Health and Human Services will continue to investigate and take action against those organizations that knowingly disregard their obligations under these rules.”
The fines and other actions by HHS could be a sign that the department is getting serious about enforcement, said Deborah Peel, founder and chairwoman of the Patient Privacy Rights Foundation, reported Kumar Vijayan in a Computerworld article Feb. 25.
The actions are among "the most significant things that the administration has done for patient privacy," said Peel.