HHS Announces Reduction of HIPAA-Related Civil Monetary Penalty Caps
HHS again makes HIPAA enforcement-related headlines, but not for the same reason it had in the recent past. At the end of April, HHS issued a “Notification of Enforcement Discretion Regarding HIPAA Civil Monetary Penalties” (the “Enforcement Discretion Notice”) in which it announces reduced annual limits for HIPAA violations based on an actor’s culpability, or level of responsibility, for a violation.
Under the current Enforcement Rule, each penalty tier had the same maximum annual limit for civil monetary penalties (or “CMPs”) of $1.5 million per year. In the Enforcement Discretion Notice, HHS explains it is using its enforcement discretion to apply a reduction in the annual limits for all tiers except “Willful Neglect-Not Corrected,” where the most egregious cases fell. Violations where the actor had “No Knowledge” are now limited to $25,000 per year, those with “Reasonable Cause” are now limited to $100,000 per year, and those with “Willful Neglect-Corrected” are now limited to $250,000 per year. Each of these limits is a drastic reduction from the prior cap of $1.5 million.
HHS’s Enforcement Discretion Notice seems to buck the trend of OCR’s recent enforcement activity. As a reminder, 2018 was a record year for OCR enforcement actions, where OCR brought in a total of $28.7 million in settlements and CMPs. In the Anthem case alone, OCR assessed its largest settlement of $16 million.
However, the degree to which these new limits will affect the overall monetary amounts of subsequent settlements remains uncertain. Previously, OCR’s assessments of CMPs were lower than the amounts which could have been assessed given the number of different HIPAA violations OCR uncovered during those investigations. Furthermore, the vast majority of HIPAA investigations which resulted in payments to OCR were “settled” for an amount less than the total CMPs that could have been assessed if the parties had not reached settlement. This is again due largely to the number of unique violations cited during the investigation process. Given all of this, it is possible that OCR could simply change its CMP calculation strategy and negotiation tactics to result in future settlement amounts at or near those amounts to which we are accustom. It will be interesting to watch the next few settlements to see how the new maximum penalties play out in actual enforcement scenarios.