On November 5, 2019, the Department of Health and Human Services (the Department) issued its annual inflation adjustment to civil monetary penalties that fall under the Department's purview (2019 Inflation Rule), including penalties related to violations of the Health Insurance Portability and Accountability Act (HIPAA). The annual adjustment is determined using the percent of increase in the Consumer Price Index for all Urban Consumers (CPI-U) for the month of October of the year in which the amount of each civil penalty was most recently established or modified. The 2019 adjustment is based on a cost-of-living multiplier (based on the CPI-U for October 2018) of 1.02522.
Outlined below are the updated penalties under HIPAA based on the culpability tiers:
| Culpability |
Penalties for HIPAA Violations after February 17,
2019 |
||||
|
|
General Penalties |
2018 Maximum adjusted penalty ($) |
2018 Maximum adjusted penalty ($) |
||
| No Knowledge |
Minimum Per Violation Maximum Per Violation Calendar Year Cap |
100 |
114
57,051 |
117 58,490 1,754,698 |
|
| Reasonable Cause |
Minimum Per Violation Maximum Per Violation Calendar Year Cap |
1,000 |
1,141
57,051 |
1,170 58,490 1,754,698 |
|
| Willful Neglect – Corrected |
Minimum Per Violation Maximum Per Violation Calendar Year Cap |
10,000
50,000 1,500,000 |
11,410
57,051 |
11,698 58,490 1,754,698 |
|
|
Willful Neglect - Not Corrected |
Minimum Per Violation Maximum Per Violation Calendar Year Cap |
50,000 |
57,051 57,0511 1,711,533 |
58,490 58,4902 1,754,698 |
|
However, the 2019 Inflation Rule penalties for HIPAA violations are seemingly inconsistent with the Department's Notification of Enforcement Discretion Regarding HIPAA Civil Monetary Penalties, which was released in April 2019 (April Notice). Under the April Notice, the Department determined that the calendar year cap should vary based on the level of culpability (see table below for overview). In the April Notice, the Department noted that the revised tiered calendar year caps would be utilized by the Department until further notice and that it expected to engage in future rulemaking to formally amend the regulatory penalty structure. As the regulation has not yet been amended, the Department has legal standing to rely on the amounts identified in the 2019 Inflation Rule. However, it is unlikely that the Department will, without notification, rescind the tiered structure approach adopted under the April Notice. Specifically, the 2019 Inflation Rule is not specific to HIPAA, but instead is a statutorily required inflation adjustment for all civil monetary penalties identified in relevant regulations. Until the regulation outlining HIPAA penalties is amended, the Department will be required to continue to increase the identified amounts annually.
It is important to note that the tiered approach adopted under the April Notice is subject to annual inflation adjustments. Given the recent adoption of the tiered approach, it is unclear whether an adjustment would applied in 2019 or be stayed until 2020. In the event the cost-of-living multiplier identified under the 2019 Inflation Rule applies, the current adjusted calendar year cap for multiple identical violations at each level of culpability is as follows:
|
Culpability |
Calendar Year Cap Established by April Notice |
Calendar Year Cap |
|||
| No Knowledge | $25,000 | $25,630 | |||
| Reasonable Cause | $100,000 | $102,522 | |||
| Willful Neglect – Corrected | $250,000 | $256,305 | |||
|
Willful Neglect - Not Corrected |
$1,500,000 | $1,754,698 | |||
Footnotes
1 The 2019 Inflation Rule appears to
erroneously identify the 2018 maximum as $1,711,533.
2 The 2019 Inflation Rule appears to
erroneously identify the 2019 maximum as $1,754,698.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
