HIPAA Enforcement Final Rule Increases CMP Cap

The Health Insurance Portability and Accountability Act (HIPAA) enforcement final rule, released Jan. 17, incorporates increased civil monetary penalties and caps maximum annual penalties at $1.5 million, up from an existing $25,000 cap. The final rule, released as part of an omnibus package of HIPAA final rules, “adopted a range of penalty amounts between the minimum given in one tier and the maximum given in the second tier for each violation and adopted the amount of $1.5 million as the limit for all violations” of the same HIPAA provision in a calendar year. The increased penalties apply to all covered entities, which are defined as health care providers, health plans, and health care clearinghouses. The final rule will be published in the Jan. 25 Federal Register and will take effect March 26. Covered entities and business associates must be in compliance with the final rule by Sept. 23. An interim HIPAA enforcement final rule was released Oct. 30, 2009. The final rule did not make any significant changes to the interim final rule.