When it comes to the Health Insurance Portability and Accountability Act of 1996, perception may no longer reflect reality.
HIPAA has been widely criticized for having lax enforcement—sort of a get-out-of-jail-free card—but that may no longer be the case.
Norbert Kugele, a Warner Norcross & Judd partner who concentrates his practice on privacy issues, with a particular focus on HIPAA, is seeing a shift in that philosophy.
He believes we are on the cusp of a new trend in HIPAA: Stricter enforcement of the regulations. Why? Because for the first time, the U.S. Department of Health and Human Services is doing HIPAA compliance audits of hospitals. Moreover, the department has given the Office for Civil Rights (the agency within the department that enforces the HIPAA privacy regulations) the power to issue subpoenas, so that it can fully investigate complaints.
Kugele said this signals that the department may be ready to take the next step beyond the informal, "kinder, gentler" approach used to date to deal with complaints, which many feel has led to some providers becoming lax in their implementation of HIPAA.
DHHS is apparently responding to the perception that it is not enforcing the regulations and that health care providers get what amounts to a "free violation" of HIPAA—though Kugele notes that we still haven't seen any civil monetary penalties to this point.
Still, the fact that DHHS is out doing audits and has given OCR the authority to issue subpoenas should be getting people's attention.
At the same time, Kugele has noted that individuals are having success in private lawsuits filed over HIPAA issues. While the law doesn't give individuals the right to sue under HIPAA, he said, individuals are bringing negligence or invasion of privacy claims and the courts are looking to HIPAA for standards of care.
DHHS continues to receive a large number of complaints. As of April, more than 27,000 complaints had been filed with the DHHS regarding HIPAA privacy violations. Most of these, according to the department's Web site, target private health care practices, hospitals, outpatient facilities, group health plans and pharmacies.
The top five reasons for complaints include:
Impermissible use or disclosure of protected health information
Lack of adequate safeguards
Refusal to provide patients access to their own records
Violations of the minimum necessary rule
Failure to get authorization
Kugele said health care providers and group health plans can take many steps to remedy the situation, but two would be of immediate assistance.
First, reexamine all policies and procedures. It's been a few years since they were initially drafted, and practices may have changed. Now is the time to ensure written policies reflect the actual privacy practices, he said. In the event of an audit, a discrepancy between policies and actual practices may be considered a violation.
Second, implement an ongoing training program and document the results. HIPAA requires not only an initial round of training when an employee first starts, but also ongoing training programs, such as refresher courses, that reinforce privacy policies. These training sessions must be documented as evidence of compliance, in the event DHHS conducts an audit. And if an employee has violated one of these policies, Kugele said it's critical to document the disciplinary action taken as evidence of ongoing compliance.
While it's not yet certain that stepped-up enforcement will become the norm, implementation of a few simple procedures could protect health care providers and group health plans from some additional heartache.
* * *
About Warner Norcross & Judd:
Warner Norcross & Judd LLP is one of the leading law firms in Michigan. With more than 180 attorneys in Grand Rapids, Metro Detroit, Holland and Muskegon, Warner Norcross is a full-service provider of legal services. Nearly half of our partners are listed in the 2007 edition of The Best Lawyers in America. Warner Norcross was also named the best corporate law firm in West Michigan by Corporate Board Member magazine for the third year in a row. Warner Norcross has been recognized as a national leader in client service among law firms by BTI Consulting, as one of the nation's leading employment law firms by Workforce Management and as one of West Michigan's 101 Best & Brightest Companies to Work For. The firm represents local, statewide, regional, national and international clients in all areas of business and civil law.
Timothy J. Gortsema