• E-mail
• Print
• RSS

Authority of the Secretary of the Department of Health and Human Services (HHS)

HIPAA Weekly Advisor, March 28, 2002

Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!

Q: Does the Secretary of the Department of Health and Human Services (HHS) have any authority to monitor our compliance with the regulations?

A: Yes. The HHS Secretary and those authorized by the secretary may conduct compliance reviews to determine whether covered entities are complying with the regulations. The HHS also has the power to investigate a covered entity when it receives a complaint.

The covered entity must cooperate with HHS investigations and compliance reviews and give access to its facilities, books, records, accounts, and systems, including relevant protected health information.

In most cases, HHS will provide notice before seeking access to the entity's records. The rules state that a covered entity must give HHS access during normal business hours. However, if investigators determine that the covered entity may be hiding or destroying documents, it must allow access at any time without notice.

If after an investigation or compliance review, HHS determines that further action is unwarranted, the Secretary will notify in writing the covered entity and the complainant, if the investigation was prompted by a complaint.

If investigators determine that the provider failed to comply with HIPAA, HHS will inform the covered entity in writing and "attempt to resolve the matter by informal means whenever possible."

If HHS reviewers find that the covered entity is not complying and determines that it cannot resolve the problem informally, they may issue written findings documenting the non-compliance.

The regulation sets forth fines of $100 for each violation with a cap of $25,000 per year for violations of the same type. If HHS determines that the covered entity did not know of the violation and could not reasonably be expected to have discovered the violation, it cannot impose any fines on the covered entity.

Violations determined to be willful or intentional can result in fines of between $50,000 and $250,000 and one to 10 year prison sentences.

Note that in the commentary to the rules, HHS says it intends to issue an enforcement rule, addressing civil monetary penalties and the referral of criminal cases.

"We believe that the penalties under the statute are woefully inadequate.we support legislation that would increase the amount of these penalties," the commentary reads.

Brought to you by attorneys Marty Baxter and Gretchen McBeath at Bricker and Eckler, LLP (http://www.bricker.com/hipaa) and The Quality Management Consulting Group, Ltd. (http://www.qmcg.com). E-mail: mbaxter@bricker.com or gmcbeath@bricker.com.

Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!

• E-mail to a Colleague
• Print
• RSS
• Archive