Lower HIPAA Fines Aren’t a License to Relax Cyber Security

Following a record year for HIPAA settlements that saw the U.S. Department of Health and Human Services (HHS) collect $28.7 million in HIPAA fines, HHS has reduced the maximum annual HIPAA fine in three out of the four penalty tiers. However, HHS’ move doesn’t mean that healthcare organizations are now free to take a laissez-faire approach to compliance or cyber security. More culpability = higher HIPAA fines For years, healthcare organizations have been complaining about eye-popping HIPAA fines in the wake of breaches that were not their fault. The adjusted fines address this issue by making willfully negligent organizations pay more than those who exercise due diligence. The new HIPAA penalty tiers are effective now and are as follows: * Tier 1 (no knowledge of violation): $100 to $50,000 per violation; capped at $25,000 per year * Tier 2 (reasonable cause): $1,000 to $50,000 per violation; capped at $100,000 per year * Tier 3 (willful neglect, corrected): $10,000 to $50,000 per violation: capped at $250,000 per year * Tier 4 (willful neglect, not corrected): $50,000 per violation; capped at $1.5 million per year While the maximum HIPAA fines have gone down significantly, these are still hefty chunks of change, especially for small and medium-sized organizations with tight budgets. It’s also important to note that the annual cap is per year for every year the violation persists. There’s more at stake than just HIPAA penalties HIPAA compliance does not automatically equate to cyber security, and healthcare organizations have a lot more to worry about than just being slapped with HIPAA penalties, which are assessed only in a minority of cases, anyway. Even if a healthcare organization faces no HIPAA fine or only a small one, it is still subject to: * Other compliance mandates, such as PCI DSS. * The theft of confidential business information or employee data. * State data privacy laws, such as the law Washington State just enacted, halving the time organizations have to notify victims of a breach from HIPAA requirements and broadening the definition of what would be considered breached information. * Civil lawsuits filed by angry patients, including class action suits. * Bad PR and brand damage that could lead to lost business and difficulty recruiting talent. * Difficulties with current or future M&A transactions; no organization wants to inherit another’s cyber security or compliance problems. * Incident response and mitigation costs, including system restoration, replacement of hardware, and the price of identity theft solutions for breach victims. Healthcare organizations can also be victimized by cyber attacks that do not involve data breaches or HIPAA penalties but are quite costly and destructive, such as ransomware and cryptojacking malware. Ransomware, which has plagued the healthcare industry for several years, can be used to disable medical IoT devices or lock providers out of electronic health records and other critical systems, putting patients’ health and lives at risk. The cyber security landscape is dynamic, and new threats are emerging literally daily. HIPAA is important, but it should not be healthcare organizations’ only compliance or cyber security concern, and fines should not be the only motivating factor to defend against cyber abuse.