The HIPAA Privacy and Security Rules (and as of this year, all rules promulgated under the HIPAA and ARRA HITECH acts) are enforced by the US Department of Health and Human Services' Office for Civil Rights. HIPAA is a federal law, if you violate federal law and are caught, you will be punished. Violation of HIPAA provisions is no longer simply a civil offense, it is now a criminal offense. I think the best summary of the enforcement provisions of HIPAA come straight from the law itself.

42 USC 1320d-6 (HIPAA Sec. 1177) Wrongful disclosure of individually identifiable health information contains the criminal penalties for violating the HIPAA privacy standards. It states:

"a. Offense.—

A person who knowingly and in violation of this part—

uses or causes to be used a unique health identifier;
obtains individually identifiable health information relating to an individual; or
discloses individually identifiable health information to another person,

shall be punished as provided in subsection (b).

b. Penalties.—

A person described in subsection (a) shall—

be fined not more than $50,000, imprisoned not more than 1 year, or both;
if the offense is committed under false pretenses, be fined not more than $100,000, imprisoned not more than 5 years, or both; and
if the offense is committed with intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm, be fined not more than $250,000, imprisoned not more than 10 years, or both."

Ouchie! That could seriously hurt.

However, this is not why we comply with the Privacy and Security Rules. We comply because it is good for our patients, contributes to high-quality health care; and most importantly because it is the right thing to do. Remember, the health information you protect could be your own.

Do you want to check out some brief stories of privacy infractions of Medical Records? I think they will help you better understand the importance of protecting patient privacy. Here is a link to bunches, check them out.........

Privacy Infractions of Medical Records

Some Good Advice

Pay attention when receiving HIPAA training from your employer
Find, and read your organization's HIPAA policies
Do not look up patient information unless it is part of your job
Do not share patient information unless its part of your job
Do not talk about patients unless its part of your job
When talking about patients, make sure you cannot be overheard by patients, guests, or visitors who have no right to know
Shred all documents with patient identifiers on them
Log off or lock your computer workstation when leaving it - even if it is just for a minute
Do not share your passwords with anyone for any reason - not ever!
Keep records areas and computer labs or workstations locked
Verify the identity of anyone in an "Employee Only" area of your facility - if you don't know, then ask them who they are and what their business is.
Do not disclose patient information to anyone, unless its part of your job
If you don't know what to do ask your Privacy Officer or supervisor!

In other words:

Hear no Info, See no Info, Speak no Info

(unless its part of your job!)

Hear no Info_See no Info_Speak no Info_monkey_graphic.png

Three Monkeys, John Fenzel, 2007

And some final words on HIPAA.....................

What's the effect of most HIPAA presentations?
HIPAA-nosis

What do you call someone who preaches privacy, but doesn't follow through?
HIPAA-critical

What do you call a provider if he/she is found to have violated patient confidentiality?
HIPAA-cratic HIPAA-crit

What do you call a theory for HIPAA success?
HIPAA-thesis

What do you call the complete understanding of all HIPAA rules?
HIPAA-thetical situation

If you've heard about HIPAA compliance until you're blue, you might be:
HIPAA-thermic

What do you call someone who complains incessantly about HIPAA?
HIPAA-chondriac

What do you say when you fail your HIPAA training for the fifth time?
I'm in a HIPAA trouble.

If, after all this time, you still think HIPAA is sweet, you may be:
HIPAA-glycemic

What is the disease you get from too much HIPAA?
HIPAA-titis

If you're sure you know all the HIPAA rules, you're probably:
HIPAA-go-lucky

Who was the first Privacy Officer in the Old West?
HIPAA-long Cassidy

What do you call someone who is afraid of HIPAA?
HIPAA-phobic

What do you call a boring person who talks in circles about HIPAA?
HIPAA-drone

What do you call government personnel who wrote all those HIPAA rules?
HIPAA-critical HIPAA-crats

What do you call the long uphill learning curve for HIPAA compliance?
The HIPAA-tenuse

What do you call a "shot" of HIPAA humor?
A HIPAA-dermic

Remember, the information you protect may be your own!

Take the practice quiz that follows as many times as you need to make you have a good understanding of the material. Reread the material if necessary.