Tiers of HIPAA Violations: Civil vs Criminal
The Health Insurance Portability and Accountability Act (HIPAA) is an American law that establishes the standards for safeguarding the protected health information (PHI) of patients. Violations of HIPAA occur when there is unauthorized access, use, or disclosure of that sensitive data, and the related penalties aren’t just serious—they’re complicated as well.
Two different government agencies manage two different kinds of HIPAA violations—civil and criminal—and within those two categories are several tiers for both.
To help simplify the details, we’re going to overview these different kinds of HIPAA violations. As HIPAA assessors, we’ve helped over 100 of our clients stay in compliance with this law in just the last year. We helped them avoid these penalties, and now we’re going to help you as well by providing more context.
While you’re likely trying to avoid any violation at all, knowing what’s truly at risk—from the smallest infringement to the biggest—can only help you in doing so.
What is a HIPAA Violation?
To commit a HIPAA violation is to fail to comply with any of the HIPAA rules and standards, and those potential violations can range widely and include things like:
- Unauthorized access of PHI/ePHI
- Delayed breach notifications
- Failure to perform an organization-wide risk analysis
- Failure to enter into a HIPAA-compliant business associate agreement
- Wrongful disclosures of PHI
- Failure to safeguard PHI
- Failed or non-existent risk management processes, which can result in an actionable failure to manage security risks to a sufficient level
- Failure to implement sufficient access controls
As patients can suffer serious harm from HIPAA violations, including identity theft or discrimination, the violations and their related consequences can be severe in both the civil and criminal tiers— though they too can range (making compliance with HIPAA all the more important).
What are the Civil Penalties for HIPAA Noncompliance?
Let’s start with civil violations, which are managed by the Department of Health and Human Services (HHS) Office of Civil Rights (OCR)—they enforce HIPAA through regular audits, complaints, and investigations following a complaint or a breach.
When they happen, the OCR assesses the nature of a breach and investigates the possible weaknesses from noncompliance that could’ve caused said breach before issuing civil monetary penalties (CMP), corrective action plans (CAPs), and resolution agreements to ensure future HIPAA compliance.
As we mentioned before, the OCR follows a tiered penalty structure to assess the severity of the violation. Here is a breakdown of civil violations and their related, proportional penalties:
|
Tier |
Context of Violation |
Examples |
Penalty |
|---|---|---|---|
|
Tier 1: Lack of knowledge
|
This is an unintentional violation of privacy or security that may be caused by carelessness, lack of knowledge or training, or other human error. The covered entity or business associate was unaware of and, through due diligence, could not have known the HIPAA rule was violated. |
|
Minimum: $127
|
|
Tier 2: Reasonable cause and not willful neglect
|
The organization knew or should have known through due diligence that its action (or omission) violated HIPAA, but the violation was not caused by willful neglect. (i.e., when PHI is carelessly accessed or released by an employee.) Demonstrates disregard for HIPAA regulation and/or internal policies and procedures but falls short of willful neglect. |
|
Minimum: $1,280 Maximum: $63,973 Calendar-year cap: $1,919,173* |
|
Tier 3: Willful neglect, corrected within 30 days
|
A breach was caused by willful neglect, but the organization took corrective action within 30 days. |
|
Minimum: $12,794 Maximum: $63,973 Calendar-year cap: $1,919,173* |
|
Tier 4: Willful neglect, not corrected within 30 days
|
A breach occurred due to willful neglect, and the organization made no efforts to correct the violation in a reasonable time frame. Demonstrates systemic non-compliance with the HIPAA rules. |
|
Minimum: $63,973 Maximum: $1,919,173 Calendar-year cap: $1,919,173* |
* The calendar-year cap applies only to violations of a single HIPAA provision in a calendar year. So, if you violate multiple provisions, the cap applies to each provision for each calendar year you violated that provision.
To further illustrate this, say you failed to conduct an annual risk assessment and did not implement a risk management process in place for three years—that would mean you violated two separate provisions over 3 years and your total fine could reach as much as $11.5M.
Insofar as how the OCR calculates HIPAA violation fines, they will consider the following factors before coming to their final number:
- The number of individuals affected
- Organization’s history of prior compliance or non-compliance
- Size of the organization
What are the Criminal Penalties for HIPAA Noncompliance?
And that’s just in the civil category. When it comes to the other side of HIPAA violations and penalties, the game changes a bit.
Not only are there only three tiers to criminal penalties, but the Department of Justice (DOJ) manages these prosecutions of HIPAA violations, rather than the OCR.
A judge determines the penalties based on the three categories of criminal violations, and these consequences can range from fines to jail time depending on the severity of the violation:
|
Tier |
Context of Violation |
Example |
Maximum Penalty |
|---|---|---|---|
|
Tier 1: Wrongful disclosure of PHI |
The lowest-level violation. Covers cases of:
The DOJ does not acknowledge ignorance of HIPAA regulations as an excuse for violating HIPAA rules because all covered entities are responsible for compliance. |
A behavioral health analyst working with autistic individuals stole the PHI of over 300 patients. The analyst was sentenced to 30 days in jail, 3 years of supervised release, $14,900 in restitution. |
|
|
Tier 2: Wrongful disclosure of PHI under false pretenses |
Includes obtaining PHI under false pretenses or disclosing it without permission. For example, a hospital employee cannot access the records of patients who are not under their care. |
A healthcare worker accessed her ex-boyfriend’s PHI who was being treated at the hospital where she worked, took a picture of his records, and shared it with another person outside of the organization. As he was not a patient of hers, she should not have had access to his medical records at all. Having known what she was doing, she was sentenced to 5 years’ probation and given a $1,000 fine. She can no longer work for any organization that deals with the PHI of other people. |
|
|
Tier 3: Wrongful disclosure of PHI under false pretenses with malicious intent |
The most severe violation. The individual who commits the crime wrongfully obtains PHI with the intent to sell, transfer, or use the data for personal gain, commercial advantage, or malicious harm. |
An administrator of a medical clinic in Florida sought out and collected patient identifying information such as DOBs and SS# to steal their identities. She then sold the identities for a profit or defrauded businesses herself using the identities. The administrator pled guilty to wire fraud and identity theft and was thereby sentenced to 20 years in jail for wire fraud along with a consecutive 2-year term for the identity theft. |
|
Moving Forward in Your HIPAA Compliance
For those of you health plans, healthcare clearinghouses, and healthcare providers—among other covered entities and relevant business associates that need to be HIPAA-compliant—you’ve likely read all that and are thinking Bruce Barton was right. There are no “small” violations, especially when it’s also possible to incur civil AND criminal penalties at the same time.
Now that you know what could happen if you fell out of compliance, it becomes that much more important to ensure you stay within the regulations. If you’re interested in taking steps to remain compliant through a HIPAA assessment that can help you determine where your controls stand, check out our other content that can help you understand what you’d be getting into:
- The Cost of a HIPAA Assessment
- What Is The HIPAA Audit Process?
- The Differences Between HIPAA and HITRUST
If you've already decided that an attestation is what you need but still have some specific questions regarding your organization, please feel free to contact us as well. Our team of experienced assessors would be happy to clear up any concerns so that you feel more comfortable moving forward.
About Schellman
Schellman is a leading provider of attestation and compliance services. We are the only company in the world that is a CPA firm, a globally licensed PCI Qualified Security Assessor, an ISO Certification Body, HITRUST CSF Assessor, a FedRAMP 3PAO, and most recently, an APEC Accountability Agent. Renowned for expertise tempered by practical experience, Schellman's professionals provide superior client service balanced by steadfast independence. Our approach builds successful, long-term relationships and allows our clients to achieve multiple compliance objectives through a single third-party assessor.