Latest HIPAA Compliance & Enforcement Trends

Enforcement activity by the Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR) showed no signs of slowing throughout 2018 and has already picked up speed in 2019. More recent and significant actions from OCR last year include the following:

• OCR began 2019 with a recovery of a $3 million settlement and corrective action plan based on two reported breach incidents: one was an update to security settings that unintentionally permitted access to an otherwise unprotected server, which made protected health information (PHI) accessible to anyone with access to the server; and the second breach resulted from a misconfiguration during a response to an information technology (IT) troubleshooting ticket, which exposed unsecured PHI over the internet. OCR also found that the provider failed to perform periodic evaluations in response to operational changes and failed to obtain a written business associate agreement (BAA) with a PHI contractor. OCR said the resolution is a reminder that “information security is a dynamic process, and the risks to electronic PHI (ePHI) may arise before, during and after implementation” of system changes.

• In the Spring of 2019, HHS OCR moved to quarterly newsletters, providing ongoing “recommendations” to those in the healthcare industry.

• An Administrative Law Judge (ALJ) granted summary judgment in OCR’s favor, upholding remedies it had imposed on a Texas hospital.

• In the Fall of 2018, OCR announced its largest monetary settlement to date.

• The agency recouped its record-breaking recovery total of $28.7 million in 2018 from 10 reported enforcement actions.

Please see full Publication below for more information.

LOADING PDF: If there are any problems, click here to download the file.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Bass, Berry & Sims PLC | Attorney Advertising

Written by:

Bass, Berry & Sims PLC

Bass, Berry & Sims PLC on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.