HHS makes revisions to civil money penalties limit for HIPAA violations
In a notice of enforcement discretion published April 30, 2019, the Department of Health and Human Services (HHS) announced updates regarding HIPAA civil money penalties (CMP) as amended by the Health Information Technology for Economic and Clinical Health (HITECH) Act.
The prior system for assigning CMPs under the Act applies the same cumulative annual CMP limit across four categories of violations based on level of culpability. In their April 30 notice, HHS announced that they will now apply a different cumulative annual CMP limit for each of the four penalty tiers in the HITECH Act, as shown in Table 2 (from HHS’ notice and shown here):
HHS expects to engage in future rulemaking to revise the penalty tiers in the current regulation to better reflect the text of the HITECH Act.