The U.S. Department of Health and Human Services (HHS) has recently imposed significant penalties against two entities for violation of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), signaling the government's intent to seriously enforce the HIPAA privacy requirements. In one case, Cignet Health (Maryland) was fined $4.3 million dollars for failing to comply with the HIPAA requirement to provide patients with access to their medical records (actually, $1.3 million for failing to provide the records, and $3 million for not cooperating wit the government's investigation). The allegations involved the alleged failure of Cignet to provide 41 individuals access to their records between September 2008 and October 2009. During the course of the investigation, Office for Civil Rights (OCR) of the HHS (the office of enforcement of the HHS for HIPAA privacy issues) determined that Cignet willfully neglected the obligation to cooperate with OCR and did not attempt to resolve the patient issues. The penalty, which was significant in amount, is the first such assessment by HHS for failure to comply with the HIPAA requirements.

Continuing its enforcement of HIPAA, two days after the Cignet penalty was imposed, HHS agreed to resolve an issue with General Hospital Corporation and Massachusetts General Physicians Organization, Inc. (Mass General) regarding loss of patient records by an employee of an outpatient practice.