The HHS Office of Civil Rights (“OCR”) closed out the month of April with some updates to HIPAA civil monetary penalty (“CMP”) limits and clarifications to OCR’s stance on the Privacy Rule’s application to transfers of electronic protected health information (“ePHI”) to third-party applications and application programming interfaces (“APIs”).

Differential CMP Caps Based on Enforcement Discretion

Under the current HIPAA Enforcement Rule, HHS employs a four-tier level of culpability scale in line with the HITECH Act. These four tiers correspond to appropriate CMPs ranges for violations by covered entities and business associates of the HIPAA Privacy and Security Rules. These penalty tiers are adjusted for inflation pursuant to the cost-of-living formula set forth in the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015.

For instance, if a person did not know and, by exercising reasonable diligence, would not have known that the person violated the applicable HIPAA provision, the CMP range the person could be levied was $100-$50,000 for each identical violation, up to a maximum of $1.5 million for all such violations annually (before adjusted for inflation). The $1.5 million annual cap on CMPs for HIPAA violations applied across all four tiers, even though the minimum penalties for each tier increased in amount.

Since HHS began using this four-tier structure, however, there has been debate about whether the HITECH Act mandates different annual CMP caps for each of the tiers. OCR’s April 30, 2019 Federal Register Notice changes HHS’s prior position on this, and now imposes the following annual caps on CMPs for HIPAA violations:.


Continue Reading

HHS-OIG published a new favorable advisory opinion on October 21, 2015 regarding free transportation services offered by an integrated health care system.  Integrated health care systems continually seek ways to provide seamless, connected care to patients who may be using multiple providers for treatment of medical conditions. Free transportation is a potential way to ensure that patients attend their numerous appointments, but offering such a benefit without appropriate safeguards implicates the Anti-Kickback Statute (“AKS”) (42 U.S.C. § 1320a-7b(b)) or the Beneficiary Inducement Civil Monetary Penalty (“CMP”) Law (42 U.S.C. § 1320a-7a(a)(5)).

Advisory Opinion 15-13, largely reinforces the existing guidance that HHS-OIG has published on the subject of free transportation.  We note that HHS-OIG released Advisory Opinion 15-13 even though it published a proposed rule in October 2014 that would specifically establish a new safe harbor for free or discounted local transportation services.  Regardless, until a final rule describing a transportation safe harbor is available, Advisory Opinion 15-13 clarifies that arrangements where a health care system provides free transportation services to patients who see physicians with offices located on that health care system’s campus or at affiliated locations are acceptable under the applicable fraud and abuse laws, even if such physicians are not bona fide employees of the health care system.  These arrangements will be permissible so long as the benefits of such free transportation services are “incidental” and do not serve to induce referrals to the non-employed physicians or influence beneficiaries to choose these non-employed physicians.


Continue Reading