Do you get worried when you see a news headline about a healthcare office indicted with a HIPAA violation? Wondering what HIPAA violations are commonly neglected, and what sequence of actions follow when they occur? Let’s go over this in further detail.

What is a HIPAA Violation?

HIPAA, or Health Insurance Portability and Accountability Act, established in 1996, sets rules for what are considered acceptable measures of storage, transmission, and release of patients’ healthcare records. The HIPAA Privacy Rule states that a patient’s personal health information shall not be released or shared with any individual or entity without consent from the patient or their guardian. A HIPAA violation encompasses any release/disclosure of personal health information by a healthcare provider/office without the patient’s (or guardian’s) consent.

Common HIPAA violation examples involving patient information include:

• Unauthorized release 
• Improper disposal 
• Accessing from an unsecured device or location
• Sharing confidential information without authorization
• Hacks
• Loss or theft of data

How are HIPAA Violations Uncovered?

Numerous HIPAA violations are found via internal auditing processes. On top of this, office personnel who have violated HIPAA regulations are commonly discovered by upper management, and reported.

The Office for Civil Rights of the Department of Health and Human Services, which enforces HIPAA laws, thoroughly investigates HIPAA violation complaints.

Their objective is to ensure compliance of HIPAA Security and Privacy laws, and are assisted in doing so by providing an avenue for consumer complaints, which they evaluate.

What are the Penalties for Violations of HIPAA Rules?

Failure to comply with HIPAA guidelines, can carry hefty consequences. HIPAA penalties are determined case-by-case, and are based on the level of neglect. Prison time and criminal penalties of up to 6 digit violation fees can be implemented depending on various factors. In serious cases, it is possible to reach over $1 million in violation fees in a year.

How do you know if a practice violates HIPAA?

Risk assessments and analyses are mandatory for practices to complete, helping to assess the likelihood of HIPAA violations. Areas of non-compliance in the evaluation must be pointed out and corrected. Neglecting compliance with risk assessment and analyses can be considered a HIPAA violation.

What is the difference between a risk assessment and a risk analysis?

Risk assessments evaluate internal and external risks that may compromise data security and privacy. Risk analysis is a component of risk assessment that involves the probability and importance of each risk.

When potential risks and vulnerabilities are identified, what happens next?

Discovering potential risks of your practice means further action may need to take place. Depending on the involved factors, practices should take the steps needed to correct the situation and ensure proper security measures and acceptability in accordance with HIPAA laws.

Conclusion

HIPAA violations are a serious matter for healthcare practices. Practices that face HIPAA violation penalties not only face hefty fines and possible prison time, but will suffer a tarnished reputation. Proper training of staff on HIPAA regulations, along with regular risk assessments are important for practices to implement, to avoid HIPAA violations. Find out how mConsent software can keep your practice HIPAA compliant.