Privacy protections are applied in the exchange of electronic data by your health insurance company and their business associations, to government programs that pay for health care, and to your local pharmacy when filling your medications. The Department of Health and Human Services (DHHS), through the implementation of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), established these privacy practices. Rule 45 CFR §164.308 sets regulations for HIPAA security standards known as administrative safeguards. These provisions regulate standardization of electronic health information requiring health plans to “implement policies and procedures to prevent, detect, contain, and correct security violations [by] conduct[ing] an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronically protected health information held by the health plan [1].

The Health Information Technology for Economic and Clinical Health (HITECH) Act was signed into law on February 17, 2009. Section 13410(d) of the Act, revised section 1176 (a) of the Social Security Act (the Act). This regulation establishes levels of culpability; tiers for each violation: and a maximum penalty amount of $1.5 million for all violations of an identical provision.  The regulation states:

(A) in the case of a violation of such provision in which it is established that the person did not know that such person violated such provision, a penalty for each such violation of an amount that is at least the amount described in paragraph (3)(A) but not to exceed the amount described in paragraph (3)(D);

(B) in the case of a violation of such provision in which it is established that the violation was due to reasonable cause and not to willful neglect, a penalty for each such violation of an amount that is at least the amount described in paragraph (3)(B) but not to exceed the amount described in paragraph (3)(D); and

(C) in the case of a violation of such provision in which it is established that the violation was due to willful neglect.

Ensuring compliance with this regulation and other established security provisions requires health care organizations to design and implement compliance programs with well-defined metrics to help assess program efficiency. The Office of the Inspector General (OIG) of the Department of Health of Human Services oversees the efficiency of such compliance programs by investigation and audit, guidance through advisory opinions, and providing resources for improving effectiveness. The practice of enforcing compliance gives substance to these established security regulations ensuring the privacy protections in the use of our health care information remains protected.

[1] Rule 45 CFR §164.308