HIPAA Enforcement: Three Years Later  

As most readers area aware, the Health Insurance Portability and Accountability Act, or HIPAA, brought significant changes to medical privacy in the U.S. Since the final Privacy Rule regulations became effective in April of 2003, medical practices had to develop and implement new policies and procedures, create new forms such as the Notice of Privacy Practices, and train staff on using reasonable privacy protections when using or disclosing "Protected Health Information", or PHI.

To enforce the HIPAA regulations, the law granted HHS the authority to impose fines of $100 for each civil violation, up to a maximum of $25,000. HHS can also refer possible criminal violations to the Department of Justice (DOJ), which could seek penalties of up to $250,000 in fines and 10 years in jail.

Yet in the three years since the Privacy Rule became effective, the Office for Civil Rights (t...