HHS releases final rule to increase civil monetary penalties

The Department of Health and Human Services (HHS) has issued a final rule that adjusts the agency’s maximum civil monetary penalty amounts for inflation. The rule, which implements the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015, adjusts the penalties to reflect inflation and “maintain their deterrent effect.” The rule was effective September 6, 2016.

Some of the penalty adjustments that could be applicable to employers are as follows:

• Penalty for each pre-February 18, 2009, violation of a HIPAA administrative simplification provision: $150 (up from $100), up to a calendar year maximum of $37,561 (up from $25,000);

• Penalty for each February 18, 2009, or later violation of a HIPPA administrative simplification provision, in which it is established that the covered entity or business associate did not know and by exercising reasonable diligence, would not have known that the covered entity or business associate violated such a provision: $110 minimum to $55,010 maximum (up from $100 and $50,000, respectively), up to a calendar year maximum of $1,650,300 (up from $1,500,000);

• Penalty for each February 18, 2009, or later violation of a HIPAA administrative simplification provision, in which it is established that the violation was due to reasonable cause and not to willful neglect: $1,110 minimum to $55,010 maximum (up from $1,000 and $50,000, respectively), up to a calendar year maximum of $1,650,300 (up from $1,500,000);

• Penalty for each February 18, 2009, or later violation of a HIPAA administrative simplification provision, in which it is established that the violation was due to willful neglect and was corrected during the 30-day period beginning on the first date the covered entity or business associate knew, or, by exercising reasonable diligence, would have known that the violation occurred: $11,002 minimum to $55,010 maximum (up from $10,000 and $50,000, respectively), up to a calendar year maximum of $1,650,300 (up from $1,500,000);

• Penalty for each February 18, 2009, or later violation of a HIPAA administrative simplification provision, in which it is established that the violation was due to willful neglect and was not corrected during the 30-day period beginning on the first date the covered entity or business associate knew, or, by exercising reasonable diligence, would have known that the violation occurred: $55,010 minimum to $1,650,300 maximum (up from $50,000 and $1,500,000, respectively), up to a calendar year maximum of $1,650,300 (up from $1,500,000);

• Penalty for the failure to provide the Summary of Benefits and Coverage: $1,087 (up from $1,000); and

• Penalty for violations of the regulations related to the medical loss ratio reporting and rebating: $109 (up from $100).

SOURCE: 81 FR 61538, September 6, 2016.

Visit our News Library to read more news stories.