The penalties for HIPAA noncompliance incurred within last 6 years are based on the level of negligence and can range from $100 to $50,000 per violation (or per record), with a maximum penalty of $1.5 million per year .

• A perception by patients, or their representatives that the HIPAA rules are not properly followed
  • E.g., patient receiving unprotected e-mail with PHI
• Processes used by the healthcare organization are not consistent with HIPAA requirements, or lacking basic safeguards
  • E.g., using out of date computers or software, or lost/unrecoverable PHI records
• The staff is not properly trained on Patient Rights established by HIPAA
  • E.g., refusing treatment because of insurance limitations

Any breach regardless of size, will automatically trigger an investigation by the Office for Civil Rights (OCR) of the US Department of Health and Human Services (HHS), which may result in an audit.

In addition, the OCR Launched Phase 2 of the HIPAA Audit Program. Covered Entities (CE) are selected through a randomized process. Responses must contain the specified documentation: adopted HIPAA policies, procedures, evidence of implementation, including risk analysis & risk management. The CE must respond within 10 business days after the initial contact by OCR.

If a CE does not have the requested documentation, an explanation for the deficiency must be included in the response. A CE may be selected for a comprehensive onsite audit.

No. The HIPAA Security and Privacy Rules provide key requirements, but they are not defined prescriptively enough that a healthcare organization can follow them out of the box. The HIPAA is designed with the intent for each practice to figure out how to apply HIPAA rules to their own processes, which is not very trivial. As a result there are no one-size-fits-all HIPAA policies and procedures available. For example, the American Dental Association offers a guidance kit that a dental practice would need to review, understand and then figure out how to use and apply. Some of the HIPAA training companies offer their own customized templates, however somebody will still need to interpret and customize them to the specific structure, size and environment of their healthcare organization, and then implement HIPAA-compliant IT capabilities and business processes to be able to maintain HIPAA compliance.