The intent of HIPAA is to inform consumers how their health information is being used as we embrace the electronic computer age. The emphasis is on preserving privacy of PHI and ensuring security of electronic transmission of such data. In practice, this means informing all patients, via postings in the office or hospital, direct mailings, brochures, etc., of the conditions under which the contents of their records will be shared with others, and the procedures in place to safeguard improper disclosures.
HIPAA creates criminal and civil penalties for the improper use or disclosure of PHI by covered entities. Business associates, like covered entities, are now also subject to HIPAA rules under the Health Information Technology for Economic and Clinical Health Act (HITECH Act), which is a part of the American Recovery and Reinvestment Act of 2009. Fines start at $100 for each violation. Criminal penalties are severe for knowing and wrongful disclosures, with fines up to $50,000 and up to a year in prison.
If the violation is committed under false pretenses, the penalty can reach $100,000 and 5 years in prison. Where the disclosure is coupled with the intent to sell or to use for commercial advantage or personal gain, the punishment reaches $250,000 and up to 10 years in prison. Recent changes in HIPAA rules include an increase of the maximum civil penalty to $1.5 million.
HIPAA does not create a private right of action, that is, only the government, not private individuals, can prosecute a violation. However, HIPAA can serve to set the standard governing privacy of health information, and it has been used as evidence to support a case of emotional distress that allegedly resulted from the improper disclosure of records.
Dr. Tan is a former professor of medicine and adjunct professor of law at the University of Hawaii. This article is meant to be educational and does not constitute medical, ethical or legal advice. It is adapted from the author’s book, "Medical Malpractice: Understanding the Law, Managing the Risk" (2006). For additional information, readers may contact the author at siang@hawaii.edu.
This column, “Law & Medicine,” appears regularly in Internal Medicine News, a publication of Elsevier.