Annual Adjustment Leads To Uncertainty In HIPAA Penalty Maximums

On November 5, 2019, the Department of Health and Human Services (the Department) issued its annual inflation adjustment to civil monetary penalties that fall under the Department's purview (2019 Inflation Rule), including penalties related to violations of the Health Insurance Portability and Accountability Act (HIPAA). The annual adjustment is determined using the percent of increase in the Consumer Price Index for all Urban Consumers (CPI-U) for the month of October of the year in which the amount of each civil penalty was most recently established or modified. The 2019 adjustment is based on a cost-of-living multiplier (based on the CPI-U for October 2018) of 1.02522.

Outlined below are the updated penalties under HIPAA based on the culpability tiers:

Culpability Penalties for HIPAA Violations after February 17, 2019

General Penalties (Pre-Inflation Adjustment)

($) 2018 Maximum adjusted penalty ($) 2018 Maximum adjusted penalty ($) No Knowledge Minimum Per Violation Maximum Per Violation Calendar Year Cap 100 50,000

1,500,000 114 57,051 1,711,533

117 58,490 1,754,698 Reasonable Cause Minimum Per Violation Maximum Per Violation Calendar Year Cap 1,000 50,000

1,500,000 1,141 57,051 1,711,533

1,170 58,490 1,754,698 Willful Neglect - Corrected Minimum Per Violation Maximum Per Violation Calendar Year Cap 10,000 50,000

1,500,000 11,410 57,051 1,711,533

11,698 58,490 1,754,698 Willful Neglect

- Not Corrected Minimum Per Violation Maximum Per Violation Calendar Year Cap 50,000 50,000

1,500,000 57,051 57,0511 1,711,533

58,490 58,4902 1,754,698 However, the 2019 Inflation Rule penalties for HIPAA violations are seemingly inconsistent with the Department's Notification of Enforcement Discretion Regarding HIPAA Civil Monetary Penalties, which was released in April 2019 (April Notice). Under the April Notice, the Department determined that the calendar year cap should vary based on the level of culpability (see table below for overview). In the April Notice, the Department noted that the revised tiered calendar year caps would be utilized by the Department until further notice and that it expected to engage in future rulemaking to formally amend the regulatory penalty structure. As the regulation has not...