In March, the Office for Civil Rights (OCR), which polices enforcement with the HIPAA privacy, security and breach notification rules, received a new director, Roger Severino (RPP 4/17, p. 1). This was expected, as OCR directors are political appointees who typically change with the administration.
While it takes time to reveal whether a new leader will influence the pace, size or number of enforcement actions, Severino now presides over an agency that closed out 2017 with a near-record $19.4 million collected from covered entities (CEs) and business associates (BAs) to resolve allegations of HIPAA violations.
The last agreement came in the final days of the year (see story, p. 1). Settlements were packed into the first five months of the year, with a drought from June to November.
The year’s enforcement actions held noteworthy developments, including four firsts: the first for late notification of a breach, the first to be issued to a medical device firm, the first involving an organization in the middle of bankruptcy and the first for an errant fax.
Typically CEs and BAs settle with OCR over allegations of HIPAA infractions and pledge to adhere to a corrective action plan (CAP) as part of the settlement terms. That was the case with all but one of 2017’s 10 cases. Last year OCR took the rare step of imposing a penalty. Other 2017 cases were more routine, triggered, for example, by the theft of unencrypted laptops.
