It has been a busy last few weeks at the U.S. Department of Health and Human Services Office for Civil Rights (OCR).  OCR has announced four new enforcement actions, the most recent of which is rooted in a healthcare provider’s failure to properly identify and report a breach of protected health information (PHI), and the others in healthcare providers’ failure to conduct thorough, enterprise-wide HIPAA security risk analyses. Interestingly, the actions involve a varied group…

The laws, rules, and regulations regarding privacy and data security are changing throughout the world. In the United States, California recently passed the California Consumer Privacy Act (CCPA), which is due to take effect in 2020. In May 2018, Europe enacted the General Data Protection Regulation (GDPR), which introduced sweeping changes to EU privacy law and contains specific requirements regarding data security and safeguarding information. Brazil and India have respectively passed and proposed privacy laws…

The U.S. Department of Health and Human Services Office for Civil Rights (OCR) announced last week that it entered into a Resolution Agreement with a Florida medical center (“Medical Center”) following allegations that the Medical Center failed to respond to a patient’s request for medical records in a timely fashion and in violation of the patient’s right to access such records under HIPAA. While the $85,000 settlement amount is relatively small in comparison to the…

The Department of Health and Human Services Office for Civil Rights (OCR) has shown once again that it is willing to enforce HIPAA against business associates, as seen in a recent settlement. The settlement highlights the importance of thorough risk analysis conducted by business associates and covered entities, as required by the HIPAA Security Rule, and serves as an indication that OCR remains ready to exercise its authority to enforce HIPAA’s requirements for business associates.…

Despite the announcement made last week by the Department of Health and Human Services Office for Civil Rights (OCR) about certain reduced penalty caps under the Health Insurance Portability and Accountability Act (HIPAA), OCR has shown in this week’s settlement that it still plans to vigorously enforce HIPAA. New Maximum Annual Penalty Caps On April 30, 2019, OCR announced in a Notification of Enforcement Discretion new annual penalty caps for identical violations of a requirement…

A private practice (Practice) comprising three physicians has agreed to pay the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) $125,000 to settle potential violations of the Health Insurance Portability and Accountability Act (HIPAA). While the fine is small compared with OCR’s October announcement of the $16 million settlement with Anthem, it confirms OCR’s ongoing commitment to enforcing HIPAA compliance, regardless of an organization’s size or the number of impacted…

After a relatively quiet start to 2018, the Office for Civil Rights within the U.S. Department of Health and Human Services (OCR) has had an incredibly busy week, with the announcement of a blockbuster settlement, an updated security risk assessment tool, and new priorities for the agency. Anthem Settlement In a record-breaking settlement, Anthem, one of the nation’s largest health benefits companies, has agreed to pay OCR $16 million and take substantial corrective actions to…