… On March 16, 2006 the final rule on Enforcement under HIPAA became effective. This enforcement rule (federal regulation) relates not only to the Privacy Rule, but also to other rules adopted by the Secretary of the U.S. Department of Health and Human Services to implement the Administrative Simplification provisions of HIPAA (for example, the Security and Transaction Rules). If a complaint is filed against a “covered entity” (private practitioner health care providers may or may not be a “covered entity” – depending upon whether or not they transmit any health information in electronic form in connection with specified insurance – related transactions), an investigation may begin.

Suppose that a “covered” practitioner failed to give a patient the Notice of Privacy Practices on the patient’s first visit, or perhaps the therapist or counselor failed to provide the patient with timely access to his/her mental health treatment records. If a patient were to file a complaint with the Secretary of Health and Human Services (Office for Civil Rights), it is possible that the practitioner would ultimately be assessed a fine (called a “civil money penalty”) for an alleged violation. It is also possible that the matter will be resolved amicably without the imposition of a civil money penalty, even if the practitioner did violate the Privacy Rule.

While the regulations provide for a formalized, adversarial process where a proposed civil monetary penalty is contested, the government’s general approach to complaints is that they will work with covered entities to help them achieve compliance. They will do this when the non-compliance is due to “reasonable cause” and not “willful neglect” and is corrected over a certain period of time after the covered entity knew or should have known of the compliance failure. If the violation is intentional or due to “willful neglect,” however, the government will likely pursue the civil money penalty approach. In such a case, the practitioner has specified rights, including the right to a hearing before an Administrative Law Judge (ALJ) and the right to appeal the ALJ’s decision.

Those who are “covered providers” need to have a more in depth knowledge about these recently effective federal regulations for a variety of reasons, not the least of which is to know how to navigate the system should one suddenly and unexpectedly be the subject of a complaint. Even those who are not “covered entities” should be aware of these regulations, since the government may wrongly assume or wrongly assert that one is a covered entity when in fact that is not the case. Additionally, there are some possible implications with regard to one’s licensing board, since whenever a proposed penalty is final, HHS will notify the public and the appropriate state licensing agency of the penalty and the reason why it was imposed. Finally, be mindful that your malpractice carrier may cover you for some aspect of such an investigation and proceeding by the federal government.