Despite the announcement made last week by the Department of Health and Human Services Office for Civil Rights (OCR) about certain reduced penalty caps under the Health Insurance Portability and Accountability Act (HIPAA), OCR has shown in this week’s settlement that it still plans to vigorously enforce HIPAA.
New Maximum Annual Penalty Caps
On April 30, 2019, OCR announced in a Notification of Enforcement Discretion new annual penalty caps for identical violations of a requirement or prohibition under HIPAA. Specifically, under HIPAA, the penalty tiers are based on four levels of culpability. Until the announcement, the annual cap for identical violations was $1.5 million for every level of culpability. Now, after the announcement, only the last tier (willful neglect-not corrected) is subject to that higher cap of $1.5 million. The lower three tiers of culpability have lesser annual caps for identical violations—specifically, willful neglect-corrected – $250,000; reasonable cause – $100,000, and no knowledge – $25,000. The settlement announced this week signals that OCR is still willing to pursue enforcement of HIPAA violations and to seek big settlements for those violations.