On February 14, 2024, the US Department of Health & Human Services (HHS) Office for Civil Rights (OCR) issued two reports to Congress on Health Insurance Portability and Accountability Act of 1996 (HIPAA) compliance and enforcement. The reports, titled HIPAA Privacy, Security, and Breach Notification Rule Compliance and Breaches of Unsecured Protected Health Information, are required to be submitted to Congress annually by the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009.
The reports can provide help to regulated entities (such as most healthcare providers, health plans, and healthcare clearinghouses) and their business associates in their HIPAA compliance efforts by sharing steps taken by OCR to investigate complaints, breach reports, and compliance reviews regarding potential violations of the HIPAA Rules. The reports include important data on the number of HIPAA cases investigated, areas of noncompliance, and insights into trends such as cybersecurity readiness.
HIPAA Privacy, Security, and Breach Notification Rule Compliance identifies the number of complaints received, the method by which those complaints were resolved, the number of compliance reviews initiated by OCR, and the outcome of each review. Some highlights include:
- OCR received 30,435 new complaints alleging violations of the HIPAA Rules.
- OCR resolved 32,250 complaints alleging violations of the HIPAA Rules.
- OCR resolved 17 complaint investigations with Resolution Agreements and Corrective Action Plans (RA/CAPs) and monetary settlements totaling $802,500, and one complaint investigation with a civil money penalty in the amount of $100,000.
- OCR completed 846 compliance reviews and required subject entities to take corrective action or pay a civil money penalty in 80 percent (674) of these investigations. Three compliance reviews were resolved with RA/CAPs and monetary payments totaling $2,425,640.
Breaches of Unsecured Protected Health Information identifies the number and nature of breaches of unsecured protected health information (PHI) that were reported to the Secretary of HHS during calendar year 2022 and the actions taken in response to those breaches. It also highlights the continued need for regulated entities to improve compliance with the HIPAA Security Rule requirements, including:
- risk analysis and risk management;
- information system activity review;
- audit controls;
- response and reporting; and
- person or entity authentication.
OCR’s 2022 Report to Congress on HIPAA Privacy, Security, and Breach Notification Rule Compliance may be found at: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/reports-congress/index.html.
OCR’s 2022 Report to Congress on Breaches of Unsecured Protected Health Information may be found at: https://www.hhs.gov/hipaa/for-professionals/breach-notification/reports-congress/index.html.
Compliance Perspective
Issue
According to OCR, hacking/IT incidents remain the largest category of breaches occurring in 2022 affecting 500 or more individuals, and affected the most individuals, comprising 77 percent of the reported breaches. Network servers continued as the largest category by location for breaches involving 500 or more individuals at 58 percent of reported large breaches. The HIPAA Security Rule requires that covered entities and their business associates conduct a risk assessment of their healthcare organization and also requires the implementation of security measures that can help prevent the introduction of malware, including ransomware.
Discussion Points
- Review policies and procedures related to HIPAA, PHI, the Privacy and Security rules, and data integrity. Ensure that they address how to avoid falling prey to security breach efforts by unauthorized individuals, and how to guard against and detect malicious software. Update as new information becomes available.
- Train appropriate staff on HIPAA, PHI, and the Privacy and Security rules, including how to avoid phishing schemes, malware exposures, unauthorized release of PHI, and how to detect malicious software and report such detections. Provide additional training at least annually and when new threats and security information become known. Document that these trainings occurred, and file the signed training document in each employee’s education file.
- Periodically audit to ensure that staff are adhering to data integrity security measures, and to ensure that the facility’s policies and procedures for HIPAA, PHI, and privacy are being followed. Also audit to make sure computers and other devices are regularly scanned and updated.
*This news alert has been prepared by Med-Net Concepts, LLC for informational purposes only and is not intended to provide legal advice.*
