Dive Brief:
- HIPAA fines are expected to significantly increase over the next 12 months, with HHS starting a new round of HIPAA audits soon, according to a National Law Review report.
- Audits will be conducted later in 2014 on some of the 1,200 companies identified earlier this year as potential audit candidates. Included in HHS's extensive audit strategy: 800 covered entities (healthcare providers, insurers or clearinghouses) and 400 business associates.
- A federal lawyer recently told an American Bar Association conference the HHS Office of Civil Rights wants to send a strong message to the industry through high-impact cases concerning privacy rights. A huge number of HIPAA cases deal with personal mobile devices, he said, and most data breach cases resulting in financial settlements arise from an entity's failure to conduct a comprehensive risk assessment, as required by HIPAA.
Dive Insight:
HHS has recovered more than $10 million in connection with alleged violations of the Health Insurance Portability and Accountability Act from numerous U.S. healthcare entities since mid-2013 alone, according to the National Law Review. Yet the chief regional civil rights counsel for HHS said that the past 12 months' enforcement will pale in comparison to the next 12 months.
In April, HHS unveiled details of round two of its HIPAA auditing, in which covered entities and their business associates are subject to audits. The latter may be penalized up to $1.5 million per violation.
The attorney writing the NLJ article said "simply knowing that such plans are in place is not enough, and entities subject to HIPAA should begin to examine their own policies and practices and make changes as needed."
Taking action makes sense not just because of HIPAA auditors. Cybersecurity experts warned at a Washington Business Journal event June 12 that cyberthreats across the U.S. are rapidly outpacing the ability to combat threats. And the problem's scope extends beyond stealing data and leaving: attackers may be able to shut down power or connectivity.
