Enforcement & Consequences for Non-Compliance

In incidents of non-compliance, an organization must reach a resolution agreement with HHS. This is a signed contract in which the covered entity agrees to perform certain obligations, such as staff training or reporting requirements, generally for three years. During that period, HHS monitors compliance. A resolution agreement likely would include a penalty payment. According to the HHS website, these agreements are reserved for investigations with more serious outcomes. Absent a resolution, civil money penalties may be imposed.

Breach Penalties

Penalties for HIPAA violations may range from $100 to $50,000 per violation of one individual’s Protected Health Information (PHI). The cap for a calendar year is $1.5 million. In incidents of non-compliance, an organization must reach a resolution agreement with the U.S. Department of Health and Human Services (HHS). This is a signed contract in which the covered entity agrees to perform certain obligations, such as staff training or reporting requirements, generally for three years.

A resolution agreement likely would include a monetary penalty. These agreements are reserved for investigations with more serious outcomes, according to the HHS website. Absent a resolution, HHS may impose civil penalties.

Headlines from recent cases include:

• $750,000 HIPAA Settlement Emphasizes the Importance of Risk Analysis and Device and Media Control Policies – August 31, 2015

• HIPAA Settlement Highlights Importance of Safeguards When Using Internet Applications – June 10, 2015

• HIPAA Settlement Highlights the Continuing Importance of Secure Disposal of Paper Medical Records – April 22, 2015

• HIPAA Settlement Underscores the Vulnerability of Unpatched and Unsupported Software – December 2, 2014

• $800,000 HIPAA Settlement in Medical Records Dumping Case – June 23, 2014

• Data Breach Results in $4.8 Million HIPAA Settlements – May 7, 2014

• Concentra Settles HIPAA Case for $1,725,220 – April 22, 2014

• County Government Settles Potential HIPAA Violations – March 7, 2014

To get a sense of common violations, see this chart from HHS titled Top Ten Issues in Investigated Cases Closed with Corrective Action, from 2003 to 2013:

The chart Enforcement Results by Yearb shows the enforcement results by calendar year according to the type of closure, which includes the percentage of the total resolutions for each category. This is the number of complaints that OCR had resolved.