OCR’s Enforcement Of HIPAA’s Privacy And Security Rules Continues With Robust 2014

With the news of the recent cyber-attack and resulting data breach at health insurance giant Anthem Inc., the buzz around data security and privacy is again high.  The Anthem breach serves as a reminder to those entities subject to the Health Insurance Portability and Accountability Act (HIPAA) that failing to keep protected health information secure and private can lead to serious consequences.   In fact, enforcement of HIPAA's Privacy and Security Rule was at an all-time high in 2014, with the U.S. Department of Health & Human Service's (HHS) Office for Civil Rights (OCR) resolving a number of significant cases, summarized below.

As background, OCR began enforcing HIPAA's rules on the use and disclosure (as opposed to security) of protected health information (PHI) by covered entities (i.e., health plans, health care providers and clearinghouses) in 2003.  These rules are known collectively as the "Privacy Rule."  OCR began enforcing HIPAA's rules related to the