HIPAA Enforcement and Penalties 4 — Questions and Answers
Question 1: An OCR investigation begins with a complaint. After reviewing the complaint, what is OCR's first enforcement step?
- Immediately issuing a civil monetary penalty
- Conducting a desk or on-site investigation (Correct answer)
- Referring the case to the DOJ for criminal prosecution
- Publishing the covered entity's name publicly
Correct answer: Conducting a desk or on-site investigation
After receiving a complaint, OCR typically conducts an investigation (desk review or on-site) to determine whether a violation occurred before taking any enforcement action.
Question 2: Which outcome is possible when OCR finds a covered entity in violation but the violation is not due to willful neglect and has been corrected?
- OCR must impose a minimum $100,000 penalty
- OCR has discretion to waive civil monetary penalties (Correct answer)
- OCR must refer the case to a grand jury
- OCR must permanently revoke the entity's Medicare certification
Correct answer: OCR has discretion to waive civil monetary penalties
For violations not constituting willful neglect that have been corrected, OCR has discretion to waive civil monetary penalties.
Question 3: Which of the following actions can a state attorney general take under HIPAA enforcement authority granted by HITECH?
- Impose criminal penalties directly on covered entities
- Bring a civil action in federal district court on behalf of residents (Correct answer)
- Revoke a covered entity's state business license
- Negotiate resolution agreements with OCR's approval
Correct answer: Bring a civil action in federal district court on behalf of residents
State AGs may bring civil actions in federal district court to enjoin violations and obtain damages on behalf of state residents.
Question 4: A covered entity self-discloses a potential HIPAA violation to OCR through the Voluntary Disclosure Protocol. What is a likely benefit of self-disclosure?
- Complete immunity from all civil monetary penalties
- Potential for reduced penalties and faster resolution (Correct answer)
- Automatic classification as 'unknowing' violation
- Exemption from corrective action plan requirements
Correct answer: Potential for reduced penalties and faster resolution
Self-disclosure through OCR's protocol can result in reduced penalties and a more efficient resolution, though it does not guarantee complete immunity.
Question 5: Under HIPAA, can a covered entity face BOTH civil monetary penalties AND criminal prosecution for the same violation?
- No — double jeopardy prevents both types of penalties
- No — OCR must choose one enforcement track
- Yes — civil and criminal penalties are distinct and can both apply (Correct answer)
- Yes — but only if the violation involved more than 500 individuals
Correct answer: Yes — civil and criminal penalties are distinct and can both apply
Civil and criminal enforcement are separate tracks under HIPAA, and a covered entity or individual may face both simultaneously for the same conduct.
Question 6: Which of the following individuals can be held criminally liable under HIPAA?
- Only the covered entity as an organization, not individuals
- Only C-suite executives of covered entities
- Any person, including employees and workforce members (Correct answer)
- Only business associates, not covered entities
Correct answer: Any person, including employees and workforce members
HIPAA criminal penalties apply broadly to 'any person' — including employees, contractors, and other workforce members — who knowingly violates HIPAA.
Question 7: OCR's HIPAA Audit Program, established under HITECH, is designed to:
- Replace complaint-based investigations entirely
- Proactively assess covered entity and business associate compliance (Correct answer)
- Issue automatic penalties to all audited organizations
- Limit enforcement to only the largest health systems
Correct answer: Proactively assess covered entity and business associate compliance
The HIPAA Audit Program proactively evaluates whether covered entities and business associates comply with HIPAA requirements, independent of complaints.
HIPAA Enforcement and Penalties 4
An OCR investigation begins with a complaint.
After reviewing the complaint, what is OCR's first enforcement step?