Fifth Circuit Issues Landmark HIPAA Decision That Will Impact Future OCR Investigations

On January 15, 2021, the Fifth Circuit vacated a $4.3 million penalty that the Office of Civil Rights (OCR) at the Department of Health and Human Services (HHS) had issued against the University of Texas M.D. Anderson Cancer Center (M.D. Anderson) in 2017. OCR initially levied the penalty against M.D. Anderson after the hospital disclosed three separate security incidents in which unencrypted devices containing electronic personal health information (ePHI) were stolen or lost in 2012 and 2013. OCR had determined that M.D. Anderson violated the Health Insurance Portability and Accountability Act's (HIPAA) Privacy and Security Rules. Specifically, OCR had determined that M.D. Anderson violated HIPAA's encryption provisions from the Security Rule because it did not have an appropriate mechanism to encrypt ePHI, and HIPAA's use and disclosure principles in the Privacy Rule, which prohibit the unpermitted disclosure of ePHI. An administrative law judge (ALJ) upheld OCR's