HIPAA violations occur when there is a breach of confidentiality, integrity, or availability of protected health information (PHI).
Examples of HIPAA violations include improper disposal of PHI, unauthorized access or disclosure of PHI, failing to implement appropriate security
measures to protect PHI, and improper use of PHI for marketing purposes. The tiers of criminal penalties for HIPAA violations are :
- Tier 1: Reasonable cause or no knowledge of violation – Up to 1 year in jail
- Tier 2: Obtaining PHI under false pretenses – Up to 5 years in jail
- Tier 3: Obtaining PHI for personal gain or with malicious intent – Up to 10 years in jail
The difference between HIPAA and HITECH is that HIPAA is a federal law that regulates how healthcare providers must protect patients’ health information
while HITECH is an act that was passed as part of the American Recovery and Reinvestment Act (ARRA) of 2009. HITECH expands on HIPAA by providing additional
protections for electronic health records (EHRs) and by increasing the penalties for HIPAA violations.
PHI stands for Protected Health Information. It includes any information that can be used to identify an individual’s health status or medical history.
Examples of PHI include names, addresses, social security numbers, medical diagnoses, and treatment plans.
Some common HIPAA violations include:
- Failing to perform a risk analysis
- Failing to implement appropriate security measures
- Failing to train employees on HIPAA compliance
- Failing to obtain patient consent before disclosing PHI
- Failing to provide patients with access to their own PHI
The penalties for violating HIPAA can be severe. The tiers of criminal penalties for HIPAA violations are:
- Tier 1: Reasonable cause or no knowledge of violation – Up to 1 year in jail
- Tier 2: Obtaining PHI under false pretenses – Up to 5 years in jail
- Tier 3: Obtaining PHI for personal gain or with malicious intent – Up to 10 years in jail
In addition to criminal penalties, organizations that violate HIPAA can also face civil penalties. The maximum civil penalty per violation is $50,000,
with an annual maximum of $1.5 million.