Since the HITECH Act (Section 13410(e) (1)) was introduced in February 2009, state attorneys general are authorized to make HIPAA-covered entities responsible for the compromise of the PHI of state locals and may submit civil actions to the federal district courts. In case of HIPAA violations, penalties may be issued as much as $25,000 for each violation category, for every calendar year. The minimum applicable penalty is $100 for every violation.
A covered entity that encountered a data breach impacting residents in several states may be required to pay HIPAA violation penalties to attorneys general in several states. Not many states have issued penalties to HIPAA-regulated entities for violating the HIPAA Regulations. They are California, Connecticut, the District of Columbia, Massachusetts, Minnesota, Indiana, New Jersey, New York, and Vermont.
In the past years, attorneys general worked together and issued penalties for HIPAA violations to address big data breaches that have impacted individuals throughout America. They have pooled their resources together and taken a part of any resolutions or civil monetary penalties. Although just a few states have used their authority to require penalties for HIPAA violations, that doesn’t indicate HIPAA violations are not punished. Numerous states issued financial penalties for comparable violations of state regulations.
Are HIPAA Violations Criminal?
If a HIPAA-covered entity or business associate breaks HIPAA Rules, civil penalties may be enforced. If healthcare companies do not comply with the HIPAA, it is normally the employer that gets fined, however not at all times. When healthcare experts knowingly acquire or use protected health information (PHI) for purposes that aren’t allowed by the HIPAA Privacy Rule, they could be criminally accountable for the HIPAA violation based on the criminal enforcement condition of the Administrative Simplification subtitle of HIPAA.
The Department of Justice prosecutes criminal HIPAA violations, particularly those committed by individuals that have intentionally broken HIPAA Rules. There were a number of incidents that have led to large fines and jail sentences.
Criminal HIPAA violations consist of theft of patient data for monetary gain and improper disclosures with the intention to cause damage. Insufficient understanding of HIPAA rules isn’t an acceptable excuse. A person that “knowingly” breaks the HIPAA means the person knew what makes up the offense, not that there’s the absolute knowledge that he or she is breaking HIPAA Rules.
Criminal Penalties for HIPAA Violations
Criminal penalties for HIPAA violations have three distinct tiers with particular terms and an associated fine. A judge decides the penalties according to the facts of every specific case. Like with OCR, various general factors will have an effect on the penalty given. When a person made profits from the PHI access, theft, or disclosure, all money acquired may be returned, besides the payment of a penalty.
There are three tiers of criminal penalties for HIPAA violations. These are as follows:
Tier 1: Reasonable cause or without knowledge of violation – About 1 year in prison
Tier 2: Acquiring PHI under false pretenses – About 5 years in prison
Tier 3: Acquiring PHI for personal profit or with malicious intention – About 10 years in prison
In the past months, there’s been an increase in the number of workers found to be viewing or stealing PHI for different motives. The price of PHI on the black market is high, and this may be a big appeal for several people. It is consequently important that controls are set up to restrict the possibility for people to steal patient information, and to have systems and policies to make sure to identify improper PHI access and theft promptly.
All employees with access to PHI due to their work duties must be educated about the HIPAA criminal penalties and the result of violations, such as loss of job and potentially a long jail sentence and a big penalty.
State attorneys general are going after data theft and penalizing people found to have broken HIPAA Privacy Rules. A jail sentence for stealing HIPAA data is consequently very likely.
