What is a deliberate HIPAA violation?

A deliberate HIPAA violation is the intentional act of disclosing, accessing, or using protected health information (PHI) without authorization or beyond the permissible limits set by the HIPAA.

Unlike inadvertent breaches stemming from oversight or insufficient safeguards, these violations are characterized by a conscious decision to bypass or ignore the established privacy and security regulations surrounding PHI.

Definition and examples of HIPAA violations

A HIPAA violation is an event that causes non-compliance with the rules and regulations of HIPAA. This violates any one or more of the Security rule requirements. These could include:

• Unauthorized access (such as sharing PHI with unauthorized persons)
• Inadequate security measures (failure to monitor access to PHI)
• Mishandling patient information (Not providing secure encryption during the transit of data)
• Knowingly sharing PHI in unsecured email (instead of using HIPAA compliant email)

See also: Understanding HIPAA violations and breaches

What distinguishes a deliberate HIPAA violation from an unintentional one?

A deliberate HIPAA violation is distinguished from an unintentional one by the intent behind the action. In the context of HIPAA, deliberate violations involve knowingly and intentionally disregarding the rules and regulations established to protect patients' PHI. 

These actions are often driven by malicious intent, including actions such as unauthorized disclosure, data breaches deliberately not reported, or theft of patient data for personal gain, like Tesla's recent data breach. Deliberate violations are taken very seriously and can result in severe penalties. 

In contrast, unintentional violations occur when individuals or organizations inadvertently fail to comply with HIPAA requirements due to carelessness or a lack of understanding, and the penalties for unintentional violations are generally less severe.

Examples of actions that are considered deliberate HIPAA violations

1. Intentional data breach cover-up: Deliberately concealing a known data breach involving PHI without reporting it to the appropriate authorities within the required timeframe, as mandated by the HIPAA Breach Notification Rule, is a clear example of a deliberate violation.
2. Unauthorized PHI sharing for personal gain: A healthcare employee, with the knowledge that it's a violation, shares PHI for personal financial gain, such as selling patient records to third parties or using the information to commit identity theft.
3. Revenge or harm: Sharing a patient's PHI with the intent to harm or embarrass them, like posting their medical records on social media or disclosing sensitive information to harm an individual's reputation, is a deliberate HIPAA violation.
4. Malicious destruction of records: Deliberate acts to destroy or tamper with patient records to conceal information or hinder investigations into potential violations.
5. Theft of PHI: Physically stealing electronic devices containing PHI or stealing printed medical records for illicit purposes falls into the category of deliberate HIPAA violations.
6. Failure to comply with patient requests: Willfully refusing to provide a patient with access to their own PHI, as granted by HIPAA, when there's no valid legal reason for denial.

In the news: UnitedHealthcare settles with HHS over right of access violation

Consequences of HIPAA violations

HIPAA violation penalties vary based on the severity of the offense, categorized as civil or criminal penalties. Both of these penalties are enforced by the U.S. Department of Health and Human Rights Services Office for Civil Rights.

Civil penalties

These are divided into four tiers:

1. Tier 1: No knowledge of the violation (inadvertent violations without intent)
2. Tier 2: Reasonable cause (violation occurred when a healthcare provider, as a covered entity, either knew or could have reasonably known that their action went against administrative processes, but did not commit willful negligence)
3. Tier 3: Willful negligence promptly corrected (a violation intentionally committed but corrected within 30 days)
4. Tier 4: Willful negligence not promptly corrected (not corrected within 30 days)

Criminal penalties

Criminal degree violations of HIPAA are handled by the Department of Justice (DOJ) and involve the intentional obtaining or disclosure of PHI. The severity of the offense determines the penalties imposed.

Knowingly obtaining or disclosing PHI: 

• Fine: Up to $50,000; 
• Imprisonment: Up to 1 year

False representation in obtaining or Disclosing PHI:

• Fine: Up to $100,000; 
• Imprisonment: Up to 5 years

Obtaining or Disclosing PHI with Intent to Sell, Transfer, or Use for Malicious Purposes:

• Fine: Up to $500,000; 
• Imprisonment: Up to 10 years

Note: these penalties apply to criminal violations involving intentional and malicious actions related to individually identifiable PHI.

See also: What is a data breach?