Six+ Months to Go - Tuning up for HIPAA Compliance - Tips of the Trade

Sep 12, 2026

Upload by Xiajie

A presentation focused on preparing for HIPAA compliance within the final six-plus months, addressing what privacy and security officials worry about and how to respond. It outlines enforcement and compliance accountability, including oversight by OCR, CMS, DOJ, FBI, and related review processes. It summarizes HIPAA Privacy Rule enforcement activity through complaint statistics, highlights common complaint categories, and explains business risks and consequences of noncompliance, including litigation, loss of confidence, and civil and criminal penalties.

LanguageEnglish

CategoryPresentations

FormatPDF

Pages79

Reading Time28 min

AccessFree to download

What keeps Privacy and Security Officials Awake at Night?

Enforcement and accountability

Reasonably anticipated threats and documentation

Applicable laws and regulations crosswalks

Where to get help

HIPAA Enforcement

HIPAA Enforcement at OCR and CMS

Summary of HIPAA Privacy Rule Compliance Activities

Complaint statistics and closure reasons

Most frequent complaint types

Referrals to the Department of Justice (DOJ)

Business Risks and Impact of Not Complying

Six+ Months to Go: Tuning up for HIPAA Compliance – Tips of the Trade Presented to: Pre-Conference Symposia The Ninth National HIPAA Summit Holt Anderson, Executive Director North Carolina Healthcare Information & Communications Alliance, Inc. © 2004 NCHICA, All Rights Reserved. Do Not Duplicate Without Permission What keeps Privacy and Security Officials Awake at Night ? What keeps Privacy and Security Officials Awake at Night ? • Who is judging our effort? – Enforcement • What don’t I know? – “Reasonably anticipated threats” • How do we prove it? – Documentation • What other Laws and Regulations apply? – Crosswalks • Where do I get help? – Resources • Why was I chosen? – ???? Compliance & Enforcement HIPAA Enforcement • Office of Civil Rights (Privacy) • CMS (Transactions, Code Sets, Identifiers, Security) • Justice Department • FBI • OIG (Re: lessons learned from fraud & abuse) • Accreditation reviews • Plaintiff’s bar & courts • Business Continuity HIPAA Enforcement at CMS CMS Office of HIPAA Standards: »Establish and operate enforcement processes »Develop regulations »Obtaining voluntary compliance through technical assistance »Process will be complaint driven Summary of HIPAA Privacy Rule Compliance Activities 􀂉 Received by HHS Office of Civil Rights (OCR) 􀂉 7,577 complaints as of July 31, 2004. 􀂉 57% have been closed, because either 􀂉– Office for Civil Rights (OCR) lacks jurisdiction 􀂉– There was no violation of the Privacy Rule 􀂉– Complaint resolved through voluntary compliance Summary of HIPAA Privacy Rule Compliance Activities (cont.) 􀂉 Most frequent complaints 􀂉 Impermissible use or disclosure 􀂉 Lack of adequate safeguards 􀂉 Refusal or failure to provide right of access 􀂉 Disclosures not limited to “minimum necessary” standard 􀂉 Failure to obtain individual’s authorization, when required 􀂉 108 referrals to the Department of Justice (DOJ) OCR refers to the DOJ complaints involving the knowing disclosure or obtaining of protected health information in violation of the Privacy Rule. Business Risks • Loose implementation may open the door to litigation for privacy violations • Not adjusting as scope and complexity of current environment / technology changes • Unquestioning reliance on vendors and “HIPAA Compliant” solutions • Not completing a thorough analysis / compliance effort and is found negligent Impact of Not Complying 􀂄 Possible litigation 􀂄 Loss of public confidence 􀂄 Penalties − Civil monetary for violations of each standard − Criminal for wrongful disclosure of protected health information − No private right of action

FAQs

What keeps privacy and security officials awake at night in HIPAA compliance planning?

Enforcement and accountability, missing knowledge about “reasonably anticipated threats,” the need to prove controls through documentation, and understanding what other laws and regulations apply via crosswalks.

Who enforces HIPAA and participates in related review processes?

The Office of Civil Rights (Privacy) and CMS (Transactions, Code Sets, Identifiers, Security) are highlighted, along with the Justice Department, FBI, OIG, accreditation reviews, and plaintiff’s bar & courts.

What are the key consequences and business risks of not complying with HIPAA?

Risks include possible litigation, loss of public confidence, and penalties such as civil monetary penalties for violations and criminal exposure for wrongful disclosure, with no private right of action.

Sep 12, 2026

Upload by Xiajie