Get certified in HIPAA for Leaders for just $49.95.
To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video
So, what do you do if you receive a HIPAA complaint? If you receive a complaint from a patient or a business about how you handled PHI, you must first note it in your incident log. You must also provide a complaint form for the patient or business to complete and explain the complaint in their own words, and note the date you received it. The privacy officer then conducts a formal investigation to determine whether any policies or procedures were not followed, and whether PHI may have been compromised. From there, one of two things happens. If the investigation finds no breach occurred, document your findings & how the complaint was resolved, and then close it out in your records. If the investigation finds that PHI was breached, follow your organization's breach response process, which are the same steps we covered earlier: determine whether it is a reportable breach, notify the affected individuals and HHS within the required timelines, and document each step. Whatever the outcome, two things matter. Document the complaint, your investigation, and the resolution, and keep those records as part of your Book of Evidence. Lastly, as a leader, you should never retaliate against someone for filing a complaint in good faith, because retaliation is itself a HIPAA violation.
In this lesson, we'll be covering what you should do if you get a HIPAA complaint, including steps you should take if you both get a complaint and suffer a data breach. At the end of the lesson, we'll stick with our recent looks at HIPAA violations with a Word about HIPAA violation penalty structure.
If you receive a compliant from a patient or a business about your handling of protected health information, you should remedy the situation using the following steps:
Let's say you take a complaint seriously and discover it was not only valid, but PHI was indeed breached. What do you do now?
If your privacy officer does identify that PHI has been breached, take the following steps:
Each category of violation carries a separate HIPAA penalty. It is up to the Office for Civil Rights to determine a financial penalty within the appropriate range. They will consider a number of factors when determining penalties, such as the length of time a violation was allowed to persist, the number of people affected, and the nature of the data exposed.
An organization´s willingness to assist with an Office for Civil Rights' investigation is also taken into account. The general factors that can affect the level of financial penalty also include prior history, the organization's financial condition, and the level of harm caused by the violation.
You may recall in the last Word section of the last lesson, how there was a tier system when it comes to HIPAA's penalty structure. Well, there's also a tier system when it comes to assessing fines.
The above fines for HIPAA violations are those stipulated by the HITECH Act. It should be noted that these are adjusted annually to take inflation into account.
A data breach or security incident that results from any violation could see separate fines issued for different aspects of the data breach under multiple security and privacy standards. For instance, a fine of $50,000 could, in theory, be issued for any violation of HIPAA rules, however minor they turn out to be.
A fine can also be applied on a daily basis. For example, if a covered entity has been denying patients the right to obtain copies of their medical records, and had been doing so for a period of one year, the Office for Civil Rights may decide to apply a penalty per day that the covered entity has been in violation of the law.
Therefore, the penalty would be multiplied by 365, not by the number of patients that have been refused access to their medical records.