True or false: It is possible to be compliant with the encryption standard under the security rule even if not every device has this safeguard installed.
And: Thefts and losses don’t count as inappropriate disclosures of protected health information under HIPAA.
If you answered “false,” and maybe even, “of course, false!” to these questions, you would be wrong—at least according to the recent interpretation by the Fifth District Court of Appeals. Last month, the panel of three justices ruled in favor of the University of Texas MD Anderson Cancer Center,[1] which spent 10 years fighting the HHS Office for Civil Rights (OCR).
After a five-year investigation, OCR fined it $4.348 million for three breaches and alleged encryption failures in 2017, which were upheld in 2018 by an administrative law judge and an ALJ review panel.[2]
In a 15-page sternly worded ruling, the court based in New Orleans threw out the entire penalty OCR imposed for three relatively small breaches that occurred more than eight years ago.
The ruling strikes at the heart of the basis upon which OCR has historically undertaken many of its enforcement actions, and one of MD Anderson’s attorneys told RPP the ruling may have wide implications.
“The opinion is an important decision for all covered entities and provides additional guidance on HIPAA requirements and enforcement that had before been unavailable to health care providers,” Scott McBride told RPP. “The decision will impact the OCR’s investigation and enforcement actions and hopefully lead to a more transparent and consistent process going forward for the entire health care industry.” McBride added that he expected the impact of the decision to reach beyond the Fifth Circuit.
The panel of three justices agreed with MD Anderson’s argument that inadvertent or accidental losses and thefts don’t actually count as inappropriate or unallowable disclosures because they are passive. The appeals court also said MD Anderson was in compliance with the encryption standard even if this was lacking on the three lost devices.
The case marks the first time a covered entity or business associate has challenged OCR to this level, and it appears the government lost on every point. HHS and OCR officials did not respond to a request for comment on the MD Anderson ruling.
