To impose civil money penalties for violations occurring after February 18, 2009
The U.S. Department of Health and Human Services (HHS) has issued an interim final rule with request for comments to strengthen its enforcement of the rules promulgated under the Health Insurance Portability and Accountability Act (HIPAA).
The Health Information Technology for Economic and Clinical Health (HITECH) Act, which was enacted as part of the American Recovery and Reinvestment Act of 2009, modified the HHS Secretary’s authority to impose civil money penalties for violations occurring after February 18, 2009.
These HITECH Act revisions significantly increase the penalty amounts the secretary may impose for violations of the HIPAA rules and encourage prompt corrective action.
Prior to the HITECH Act, the secretary could not impose a penalty of more than $100 for each violation or $25,000 for all identical violations of the same provision. A covered health care provider, health plan or clearinghouse could also bar the secretary’s imposition of a civil money penalty by demonstrating that it did not know that it violated the HIPAA rules.
Section 13410(d) of the HITECH Act strengthened the civil money penalty scheme by establishing tiered ranges of increasing minimum penalty amounts, with a maximum penalty of $1.5 million for all violations of an identical provision. A covered entity can no longer bar the imposition of a civil money penalty for an unknown violation unless it corrects the violation within 30 days of discovery.
The interim final rule with request for comments published today conforms the HIPAA enforcement regulations to these revisions made by the HITECH Act. This rule making will become effective on November 30, 2009, and HHS will consider all comments received by December 29, 2009.
This interim final rule with request for comments is the first of several steps HHS is taking to implement the HITECH Act’s enforcement provisions.