Describe changes since 2008 in the enforcement of the Health Insurance Portability and Accountability Act of 1996 (HIPAA)

Question

What will be an ideal response?

Answer 1

Before 2008, law enforcement agency responsible for HIPAA (the Department of Health and Human Services [HHS] Office of Civil Rights) tended to simply respond to complaints. It only completed a few compliance reviews. In addition, the HHS Office of Civil Rights had chosen not to prosecute high-profile cases, including "the theft of millions of veterans' records...A California health plan that left personal information about patients on a public Web site for years, and a Florida hospice that sold...personal patient information to other hospices."
Between 2003 and 2006, there were 19,420 grievances, most of them alleging privacy violations or difficulty in getting records. There were also two criminal prosecutions. "One man was sentenced to 16 months ... in prison for stealing credit card information from a cancer patient; a woman was convicted of selling an FBI agent's medical records." The government responded to 73 percent of the complaints by saying there was no violation or allowing the violating entity to fix the problem. The HHS preferred to work for voluntary compliance and settle complaints through "corrective action plans." This has been criticized by privacy advocates who state that "the administration's decision not to enforce the law more aggressively has not safeguarded...medical records." According to a health care privacy expert at Columbia University, "The law was put in place to give people some confidence when they talk to their doctor or file a claim with their insurance company, that information isn't going to be used against them. [Because] they have done almost nothing to enforce the law...we're dangerously close to having a law that is essentially meaningless." HIPAA compliance was falling in 2005 . Five hundred cases were open.
By June 30, 2008, a total of 37,200 complaints had reached the Office for Civil Rights. Eighty percent were resolved; 6,648 were investigated, and corrective action was taken. In July 2008, for the first time, a covered entity was required to pay a fine. After receiving 31 complaints about one company, the Office for Civil Rights and the Centers for Medicare and Medicaid Services investigated and required it to pay $100,000 . There has also been an increase in criminal prosecutions by the Department of Justice