The U.S. Department of Health and Human Services (HHS) has published an interim final rule that incorporates changes to HIPAA included in federal stimulus legislation enacted earlier this year.

The interim final rule amends HIPAA's enforcement regulations to include new categories of violations and tiered civil penalties on covered entities. [The rule also] revises limitations on the authority of the HHS secretary to impose civil penalties for violations.

Under the interim final rule, the following penalties for HIPAA violations will apply on or after Nov. 30:

• The minimum civil penalty is $100 per violation if the covered entity was unaware of it and, by exercising reasonable diligence, would not have known about the violation.
• The minimum civil penalty is $1,000 per violation for those that were the result of “reasonable cause” involving circumstances that would make it unreasonable for the covered entity to comply.
• The minimum penalty is $10,000 for violations that result from willful neglect and are subsequently corrected.
•The minimum penalty is $50,000 for violations that result from willful neglect but are not corrected.
•The maximum penalty for multiple violations is $1.5 million per calendar year.

The new penalty amounts apply to HIPAA violations occurring on or after Feb. 18.

The rest of the story . . . .