Fines For HIPAA Security Rule Violations Found Unjustified By Fifth Circuit

The U.S. Court of Appeals for the Fifth Circuit has vacated a $4,348,000 penalty imposed on the University of Texas MD Anderson Cancer Center for alleged violations of the privacy and security regulations. The authors of this article explain the decision, which highlights the important distinction between violations of privacy or security mandates or standards and the occurrence of security breaches.

A three-member panel for the U.S. Court of Appeals for the Fifth Circuit has unanimously vacated a $4,348,000 penalty that the Office for Civil Rights ("OCR") of the Department of Health and Human Services ("HHS") imposed on the University of Texas MD Anderson Cancer Center ("MD Anderson") for alleged violations of the privacy and security regulations implementing the Health Insurance Portability and Accountability Act ("HIPAA") and the Health Information Technology for Economic and Clinical Health Act ("HITECH Act").