$4.3 Million HIPAA Penalty Shows OCR Serious About HIPAA Enforcement

Updated: February 22, 2011

The first CMP ever assessed by OCR under the HIPAA Privacy Rule, the Cignet CMP assessment announced February 22, 2011 is the latest in a series of developments documenting the rising risks that health care providers, health plans, health care clearinghouses and their business associates ("covered entities") face for violations of HIPAA. Covered entities and their business associates should tighten privacy policies, breach and other monitoring, training and other practices to mitigate against exposures in light of recently tightened requirements and new enforcement risks.

HIPAA Privacy Rule restricts the use, access and disclosure by covered entities of PHI and other individually identifiable health care information to those outlined within the Rules. Under HIPAA covered entities also are responsible for establishing and enforcing policies and procedures that safeguard PHI against improper use, access or disclosure by employees, business associates, and other third parties. Noncompliance with the Privacy and Security Rules exposes a covered entity to criminal prosecution and penalties, civil penalties or both. The Privacy Rule requires health plans, health care clearinghouses and most health care providers (covered entities), including most pharmacies, to safeguard the privacy of patient information, including such information during its disposal.

In an Oct. 20, 2010 Notice of Proposed Determination, OCR found Cignet violated 41 patients' HIPAA rights and committed other HIPAA violations. The Notice of Final Determination (Final Determination) assessing the $4.3 million CMP against Cignet announced February 22, 2011 applies the expanded HIPAA violation categories and increased HIPAA civil monetary penalty amounts authorized by HIPAA amendments made by Section 13410(d) of the Health Information Technology for Economic and Clinical Health (HITECH) Act. Read more details.

Even before the announcement of the Cignet CMP, the HIPAA Privacy exposures of covered entities for failing to comply with HIPAA already had risen significantly. As of January 1, 2011, OCR reports that 12,781 of the cases it has investigated have been resolved by requiring changes in privacy practices and other corrective actions by the covered entities and has referred more than 484 Privacy Rule breach investigations to the Department of Justice for consideration for potential criminal prosecution. The Department of Justice has secured several criminal convictions or pleas under HIPAA's criminal provisions. OCR data confirms that the covered entities involved in these actions included health care providers, health plans, and others.

While OCR had not assessed any civil monetary penalties against any covered entity for violation of HIPAA before Cignet, OCR's collection of $2.25 million from CVS Pharmacy, Inc. under a 2009 Resolution Agreement and $100,000 from Providence Health & Services under a 2008 Resolution Agreement demonstrated the willingness of OCR to pursue significant civil remedies against covered entities that it determined willfully violated the Privacy Rules. A subsequent settlement with Rite Aid in 2010 showed OCR's continued efforts to uses Resolution Agreements when possible to remedy breaches.

OCR's February 18, 2009 announcement of the CVS Resolution Agreement came just one day after President Obama signed into law the HITECH Act amendments to HIPAA. Among other things, the HITECH Act amended HIPAA to modify and expand the HIPAA audit obligations of OCR, amend and expand the potential penalties, make business associates liable for violation of the privacy rules like covered entities, to require covered entities and business associates to provide notification of breaches of unsecured PHI and to tighten other HIPAA obligations. The HITECH Act amendments also impose new obligations on OCR to audit and enforce HIPAA compliance and empower state attorneys' general to bring civil lawsuits against covered entities and business associates that commit HIPAA violations that injure citizens in their state under certain circumstances.

Featured Research
  • Executive Brief: Mitigate Avaya risk and future-proof your customer experience

    When Avaya filed for bankruptcy, it ended months of speculation. However, the company’s ongoing financial instability has left many businesses in a precarious position. If you’re concerned about your future with Avaya, don’t wait around to see what long-term options are available to modernize your customer engagement center. more

  • Harnessing the Power of Speech Analytics

    The conversations between your customers and agents contain invaluable insights—if you have the right tools to easily interpret and act on this dialogue. Unfortunately, most organizations waste time manually mining only a subset of customer interaction data, or worse yet, do nothing with it at all. Speech analytics is an incredibly powerful tool for contact center leaders. It easily delivers real-time visibility into the full customer journey and agent responses, which are essential for driving higher customer satisfaction and business success. more

  • Budgeting for BI in 2018

    Is your business ready for Business Intelligence (BI) software? As BI software continues to improve, more businesses are moving to adopt BI sooner rather than later. Before you make that commitment though, it pays to figure out exactly how much money it will cost you to implement. more

  • Gartner Report: Gartner Magic Quadrant for Contact Center Infrastructure, Worldw...

    The 2017 Magic Quadrant provides Gartner’s annual analysis of the contact center infrastructure vendors. The report examines the innovations driving the market and compares vendors based on completeness of vision and ability to execute. more

  • Forrester Report: Artificial Intelligence with the Human Touch

    Artificial intelligence (AI) can’t replicate the human touch, but it can ease your agents’ burden by handling many simple, repetitive requests. A new Forrester Consulting paper offers a look at the strengths and weaknesses of both AI and humans independently, yet how blending them together can give your customers the seamless end-to-end experience they expect. more