The U.S. Department of Health and Human Services (HHS) recently published its annual inflation-adjusted civil monetary penalty amounts. The higher amounts will apply to penalties assessed after March 17, 2022, for any violations occurring on or after November 2, 2015.
Health Insurance Portability and Accountability (HIPAA). HIPAA contains provisions that ensure portability of health coverage as well as protect the privacy and security of certain individually identifiable protected health information (PHI). Additionally, HIPAA requires employers to report data breaches of unsecured PHI. HHS has adopted a tiered penalty system based on the degree and nature of HIPAA a violation as follows:
Tier 1 – Lack of Knowledge
Minimum penalty is now $127 per violation, with a maximum penalty of $63,973 per violation. HHS has set the new annual penalty cap for Tier 1 violations at $1,919,173.
Tier 2 – Reasonable Cause and Not Willful Neglect
Minimum penalty is now $1,280 per violation, with a maximum penalty of $63,973 per violation. HHS has set the new annual penalty cap for Tier 2 violations at $1,919,173.
Tier 3 – Willful Neglect, Corrected within 30 Days
Minimum penalty is now $12,794 per violation, with a maximum penalty of $63,973 per violation. HHS has set the new annual penalty cap for Tier 3 violations at $1,919,173.
Tier 4 – Willful Neglect, Not Corrected within 30 Days
Minimum penalty is now $63,973 per violation, with a maximum penalty of $1,919,173 per violation. HHS has set the new annual penalty cap for Tier 4 violations at $1,919,173.
Keep in mind that HHS did announce in 2019 that it would exercise its enforcement discretion to apply lower annual caps for violations in Tiers 1 to 3. The lower caps, which are adjusted annually for inflation, were set at
$25,000, $100,000, and $250,000, respectively.
Medicare Secondary Payer (MSP) Rules
The MSP rules establish an ordering system under which Medicare will pay only after (or secondary to) group health coverage sponsored by an employer with 20 or more employees. Thus, the MSP rules contain penalties to discourage employers from forcing individuals off otherwise primary health coverage. The rules forbid employers from taking into account a current employee’s (or current employee’s immediate family member’s) Medicare eligibility for purposes of health plan coverage. In particular, the MSP rules prohibit an employer from offering any incentive for an individual to opt out of employer-provided group health coverage in favor of Medicare. The new penalty amount for improperly incentivizing a Medicare-eligible person not to enroll in a group health plan that would otherwise be the primary medical expense payer is $10,360 per violation. These amounts add up quickly, especially as HHS views each impermissible offer of an incentive to be a separate violation.
This information has been prepared for UBA by Fisher & Phillips LLP. It is general information and provided for educational purposes only. It is not intended to provide legal advice. You should not act on this information without consulting legal counsel or other knowledgeable advisors.
