What is HIPAA? HIPAA: Health Insurance Portability and Accountability Act It was passed by Congress in 1996 It includes requirements for: Transfer and continuation of health insurance coverage for millions of American workers and their families when they change or lose their jobs Reducing healthcare fraud and waste Industry-wide standards for healthcare information on electronic billing and other processes The protection and confidential handling of protected health information Whom Does HIPAA Apply To? Applies to: Health Plans Healthcare Providers Healthcare Clearinghouses How is HIPAA Enforced? The Department of Health and Human Services, Office for Civil Rights (OCR) is responsible for administering and enforcing these standards and may conduct complaint investigations and compliance reviews. Violations can lead to civil money and criminal penalties Enforcement and Penalties –– New Definitions Reasonable Cause: An act or omission in which a covered entity or business associate knew, or by exercising reasonable diligence would have known, that the act or omission violated an administrative simplification provision, but in which the covered entity or business associate did not act with willful neglect. Reasonable Diligence: Business care and prudence expected from a person seeking to satisfy a legal requirement under similar circumstances. Willful Neglect: Conscious, intentional failure or reckless indifference to the obligation to comply with the administrative simplification provision violated. Criminal Penalties A person who knowingly obtains or discloses individually identifiable health information in violation of the Privacy Rule may face a criminal penalty of up to $50,000 and up to one-year imprisonment.  The criminal penalties increase to $100,000 and up to five years imprisonment if the wrongful conduct involves false pretenses. If the wrongful conduct involves the intent to sell, transfer, or use identifiable health information for commercial advantage, personal gain or malicious harm may face a fine up to $250,000 and up to 10 years imprisonment .  Want to learn more about HIPAA, its requirements and best practices to comply with them? ComplianceOnline webinars and seminars are a great training resource. Check out the following links: How to examine security policies, practices, and risk issues to comply with HIPAA How to use social media and texting without breaking HIPAA rules How to Conduct risk analysis to comply with HIPAA HIPAA/HITECH Assessment for Healthcare Business Associates How to comply with HIPAA Omnibus Rule Understanding new rules and responsibilities of Privacy Officer under HIPAA HIPAA Security and Breach Rule Compliance For more details visit us at:http://www.complianceonline.com/the-new-hipaa-audit-program-focus-webinar-training-702335-prdw?channel=slideshare

1. HIPAA Enforcement: What
You Need to Know

2. What is HIPAA?
• HIPAA: Health Insurance Portability and Accountability Act
• It was passed by Congress in 1996
• It includes requirements for:
– Transfer and continuation of health insurance coverage for millions of
American workers and their families when they change or lose their jobs
– Reducing healthcare fraud and waste
– Industry-wide standards for healthcare information on electronic billing and
other processes
– The protection and confidential handling of protected health information
Whom Does HIPAA Apply To?
Applies to:
• Health Plans
• Healthcare Providers
• Healthcare Clearinghouses

3. How is HIPAA Enforced?
• The Department of Health and Human
Services, Office for Civil Rights (OCR) is
responsible for administering and enforcing
these standards and may conduct complaint
investigations and compliance reviews.
• Violations can lead to civil money and criminal
penalties

4. Enforcement and Penalties –– New
Definitions
• Reasonable Cause: An act or omission in which a covered
entity or business associate knew, or by exercising reasonable
diligence would have known, that the act or omission violated
an administrative simplification provision, but in which the
covered entity or business associate did not act with willful
neglect.
• Reasonable Diligence: Business care and prudence expected
from a person seeking to satisfy a legal requirement under
similar circumstances.
• Willful Neglect: Conscious, intentional failure or reckless
indifference to the obligation to comply with the
administrative simplification provision violated.

5. Civil Penalties
HIPAA Violation Penalty
Individual did not know and, with
reasonable diligence, would not have
known
$100 - $50,000 per violation
Violation due to reasonable cause and
not willful neglect
$1000 - $50,000 per violation
Violation due to willful neglect and
corrected within the required time
period
$10,000 - $50,000 per violation
Violation due to willful neglect and not
corrected
$50,000 per violation

6. Criminal Penalties
• A person who knowingly obtains or discloses
individually identifiable health information in violation
of the Privacy Rule may face a criminal penalty of up to
$50,000 and up to one-year imprisonment.
• The criminal penalties increase to $100,000 and up to
five years imprisonment if the wrongful conduct
involves false pretenses.
• If the wrongful conduct involves the intent to sell,
transfer, or use identifiable health information for
commercial advantage, personal gain or malicious
harm may face a fine up to $250,000 and up to 10
years imprisonment .

7. Want to learn more about HIPAA, its requirements and best
practices to comply with them? ComplianceOnline webinars
and seminars are a great training resource. Check out the
following links:
• How to examine security policies, practices, and risk issues
to comply with HIPAA
• How to use social media and texting without breaking
HIPAA rules
• How to Conduct risk analysis to comply with HIPAA
• HIPAA/HITECH Assessment for Healthcare Business
Associates
• How to comply with HIPAA Omnibus Rule
• Understanding new rules and responsibilities of Privacy
Officer under HIPAA
• HIPAA Security and Breach Rule Compliance