A HIPAA violation is a failure to comply with any aspect of HIPAA laws and regulations. This can occur when a covered entity or business associate violates one or more aspects of the HIPAA Privacy Rule, Security Rule, or Breach Notification Rule.

LINKS:
____________________________________________

https://etactics.com/blog/hipaacrimi...
____________________________________________

There are many recurring and common violations. One such violation is the unauthorized access of PHI. A second violation could be failing to conduct a risk analysis. Many companies also fail to implement safeguards to ensure the confidentiality, integrity, and availability of PHI.

No matter how someone mishandles or discloses PHI, the Department of Health and Human Services Office for Civil Rights, or the OCR, would rather not implement a fine or send someone to prison. However, depending on the severity of the situation, the OCR can implement penalties to make sure the situation will not happen again.

There are three tiers of criminal HIPAA Violations. Each tier is more severe than the last.

The first tier for criminal HIPAA violations involves the wrongful disclosure of individually identifiable health information. The maximum penalties involve a $50,000 fine and/or up to one year in prison.

To help you understand how this can happen, let me tell you about a situation that occurred in the beginning of 2018. Jeffrey Luke was a behavioral analyst working with autistic individuals. He stole the PHI of over 300 current and former patients after he got terminated.

An investigation discovered he was the perpetrator by tracing the downloads to his IP address. Luke pleaded guilty. He received a 30day jail sentence. He was also ordered three years of supervised release and had to pay $14,941.36 in restitution. Why such a weird number? I don’t know. You’ll have to ask the judge.

The second tier for criminal HIPAA violations involves the wrongful disclosure of individually identifiable health information committed under false pretenses. This last part is what differentiates it from Tier 1.The maximum penalties involve a $100,000 fine and/or five years in prison.

Jennifer Lynne Bacor used to be a healthcare employee. She accessed her exboyfriend's PHI who was being treated at the hospital where she worked. However, he was not one of her patients, so she should not have had access to his medical records. Bacor took a picture of a medical photograph and shared it with a third person outside the organization. Bacor pled guilty and received a sentence of five years’ probation and a $1,000 fine. She will no longer be allowed to work for any organization that deals with the private medical information of other people.

The third tier for criminal HIPAA violations involves the wrongful disclosure of individually identifiable health information under false pretenses. The perpetrator does so with the intent to sell, transfer, or use for commercial advantage, personal gain, or malicious harm. The maximum penalties involve a $250,000 fine and or ten years in prison.

Stacy Lavette Hendricks worked for several medical clinics in Florida in an administrative role. She sought out patients’ birth dates and social security numbers in order to steal their identities. Hendricks then sold the identities for profit or defrauded businesses herself. Authorities found over 113 stolen identities when they searched her vehicle. Hendricks pleaded guilty to wire fraud and identity theft. For the wire fraud offense, Hendricks received a maximum penalty of 20 years in prison. She will then serve a mandatory consecutive term of two years’ imprisonment due to the identity theft charge.

As you can see, HIPAA violations can be intense. Individuals who are convicted of criminal activity involving medical records can face between one to twenty years in prison, be fined between $50,000 and $250,000, or both. Yes, this is quite a range of punishments. It just depends on the severity of the criminal activity. Just don’t mess with the PHI of other people.

► Reach out to Etactics @ https://www.etactics.com​
►Subscribe: https://rb.gy/pso1fq​ to learn more tips and tricks in healthcare, health IT, and cybersecurity.
►Find us on LinkedIn:   / etacticsinc  
►Find us on Facebook:   / ​  

#HIPAA #HIPAACriminalPenalties