HIPAA Regulatory Alert: Interim rule on monetary penalties to be replaced

Final enforcement rule to take effect Sept. 16

The Department of Health and Human Services (HHS) says its interim final rule establishing rules of procedure for the imposition of civil monetary penalties on entities that violate standards adopted under the administrative simplification provisions of HIPAA will not be in effect after Sept. 16, 2003, because it will be replaced by a final enforcement rule.

HIPAA gives the HHS Secretary of Health and Human Services the authority to impose a penalty of not more than $100 for each violation of a provision of the administrative services sections up to a yearly maximum of $25,000 for all violations of an identical requirement or prohibition.

The law says the secretary cannot impose a civil monetary penalty if: 1) it’s for any action that can be punished under the law’s criminal penalty provisions; 2) it is established that the person liable for the penalty did not know that a provision was being violated; 3) the failure to comply was due to a reasonable cause and not willful neglect; and 4) payment of the civil monetary penalty would be excessive relative to the compliance failure involved.

The department notice says its approach to enforcement is to seek and promote voluntary compliance with HIPAA provisions. The agency is offering technical assistance to promote voluntary compliance. Enforcement activities will be primarily complaint driven and will consist of progressive steps that give an opportunity to demonstrate compliance or submit a corrective action plan.

The interim final rule discusses all the procedures involved in imposition of civil monetary penalties.

To download the interim final rule, go to www.cms.gov/hipaa/hipaa2/enforcement/default.asp#penalties.