March 7, 2011  

Written By Attorneys: Christopher J. DiIenno and John F. Mullen, Sr

This article is an interpretation of current law and is offered for informational purposes only. This material is not legal advice and should not be construed or used as a substitute for the advice of an attorney.

The U.S. Department of Health and Human Services' (HHS) Office for Civil Rights announced it was fining Cignet Health $4.3 million for failing to comply with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule. HHS imposed the civil monetary penalty on February 22, 2011. The fine was based on the provisions and increased penalty amounts authorized by the Health Information Technology for Economic and Clinical Health Act (HITECH Act). This is the first fine issued by HHS for a covered entity's violations of the HIPAA Privacy Rule, and should serve as a warning to healthcare providers and the companies that insure them.

Under the HIPAA Privacy Rule covered entities must provide requesting patients a copy of their medical records within 30 days of the request or provide a written denial. HHS received complaints from Forty-one Cignet Health patients that the entity refused to fulfill or respond to their requests. HHS conducted individual investigations for each complaint, and imposed a penalty of $1.3 million for the combined violations. Cignet Health was assessed an additional $3 million fine for making little effort to resolve patient complaints or assist with HHS's investigation.

Two days after HHS's announcement, Massachusetts General Hospital agreed to pay HHS $1 million to settle allegations of HIPAA violations stemming from a 2009 incident in which a hospital employee lost 192 patient records on the subway. Though HHS described the incident as only a "potential violation" of HIPAA's data security requirements, the incident warranted a large settlement.

The implications of HHS's actions should be carefully considered by healthcare providers, their insurers and their business associates. The fear of large civil penalties for violations of HIPAA is now a reality. Healthcare entities must recognize the fact that the HITECH Act empowers state Attorneys General to enforce these federal regulations in addition to enforcement by the HHS. Further, with the announcement of the Massachusetts General Hospital settlement, even potential violations can result in steep penalties (and probably legal fees) for covered healthcare entities and business associates. These realities highlight the need for the healthcare industry to understand the importance of compliance with previously unenforced provisions of HIPAA and the HITECH Act.

For additional information related to this or other privacy and data security issues, please contact John F. Mullen at 215.358.5154 or via email at jmullen@nldhlaw.com or Christopher DiIenno at 215.358.5161 or cdiienno@nldhlaw.com.