Although most health care providers understand in the abstract that they must comply with The Health Insurance Portability and Accountability Act of 1996 (HIPAA), many may not fully appreciate the legal and financial significance of noncompliance. More and more, the federal government utilizes HIPAA enforcement options to protect the public interest in security, including the following strong incentives for HIPAA compliance.
HIPAA Civil Penalties
Caps on penalties for HIPAA violations by covered entities were increased in 2009 by the enactment of the HITECH Act. Covered entity civil penalties are “tiered” as follows:
- No knowledge of HIPAA violation – $100-$50,000 for each violation, up to a maximum of $1.5 million during a calendar year.
- A reasonable cause of the HIPAA violation exists – $1,000-$50,000 for each violation, up to a maximum of $1.5 million during a calendar year.
- The HIPAA violation was caused by willful neglect but timely corrected – $10,000-$50,000 for each violation, up to a maximum of $1.5 million during a calendar year.
- The HIPAA violation was caused by willful neglect but not timely corrected – $50,000 or more for each violation, up to a maximum of $1.5 million during a calendar year
The HITECH Act also offers benefits to encourage patients to report HIPAA violations similar to those offered in qui-tam cases. This allows patients who have been impacted by HIPAA violations to collect a portion of the civil monetary penalty that is imposed against a violator. However, there are three very important exceptions to collecting on this penalty:
- The offense is punishable under HIPAA criminal provisions;
- The violator did not know and, by exercising reasonable diligence, would not have known of the violation; or
- The failure to comply is caused by “reasonable cause” rather than “willful neglect” and the alleged violator takes action to cure the failure during the first 30 days following actual knowledge of the noncompliance or when the person should have known of the noncompliance.
HIPAA Criminal Penalties
Although the DHHS Office for Civil Rights enforces the civil penalties for HIPAA violations, the Department of Justice is the agency in charge of enforcing HIPAA’s criminal penalties. As with the civil penalties, the nature of the HIPAA violation determines the severity of the penalty in regards to criminal sanctions:
- If a person knowingly and, in violation of the Privacy Rule, discloses PHI to another individual, they face a base penalty of up to $50,000 in fines and up to a year in prison, or both;
- if the offense is committed under false pretenses, they can be fined up to $100,000 and face up to five years in jail, or both;
- if the offense is committed with an intent to sell or otherwise use PHI for commercial advantage, personal gain or malicious harm, they can be fined up to $250,000 and face up to 10 years in jail, or both.
















Medical device companies, pharmaceutical companies or other health care related companies or vendors often seek consulting or personal services from doctors. Physicians should be cautious in such arrangements to avoid legal issues under federal law. Where fair market value compensation is paid for such services, there may be no issue under, for example, the federal Anti-Kickback Statute (AKS). However, arrangements that involve excessive compensation can lead to legal problems and reporting issues.
The trend in the United States toward physician employment by hospital systems, large medical practices, and other health care employers is continuing. Physicians should not make the mistake of failing to negotiate fair terms and good language in their physician employment agreements.
Controlling healthcare costs is essential to the economic security of the United States. Total healthcare spending in the U.S., already an astronomical $3 trillion dollars in 2013, is expected to grow almost 6% annually through 2022.1 Spiraling healthcare costs is an obvious problem on many levels, including the fact that, through Medicare, the federal government is the single largest purchaser of healthcare in our third party payer system. Total Medicare spending is expected to increase from $523 billion in 2010 to $932 billion by 2020.2
Medicare payments to community health centers are expected to increase by as much as $1.3 billion over the next five years, according to
What are whistleblower lawsuits?
Shopping savvy largely derives from the discomfort of parting with money. If health insurance pays all (or most) of the bill for healthcare services, why should the patient care what the cost of the healthcare is, how such cost is calculated, or how cost might be reduced? But as a patient begins to spend money out-of-pocket for healthcare, his attention to cost and his interest in how cost is determined and what alternatives might save money quickly increase. When his money is spent, he tends to want to know more about his medical bills, what the details are and, ultimately, how price is calculated. Historically, how healthcare is priced has been all but impossible for consumers to ascertain. Now, there is a push in the healthcare industry toward greater pricing transparency, which may dovetail well with increasing financial responsibility placed upon patients for their healthcare costs. Many experts argue that greater price transparency will lead to more intelligent “shopping” by patients for their healthcare, which in turn may (at least theoretically) put downward pressure on healthcare costs.
Halifax Hospital Medical Center and Halifax Staffing, Inc. (Halifax), on the day of jury selection, agreed to pay $85 million and made other concessions as part of a settlement with the federal government to resolve allegations that Halifax violated STARK prohibitions and the False Claims Act (FCA). The settlement amount is the largest STARK sanction to date against a hospital system for STARK law violations.