CHRIS: Generally speaking, though, if it does go through the OCR, they're going to tend toward conducting an investigation unless they make a determination not to, and then they're just going to provide technical assistance down that resolution path. And I think a lot of these scenarios end up falling into intake and review resolution. Possible HIPAA rule violation, decide not to investigate, and they just make technical assistance available or recommendations.
But that, again, is sort of the point. If you're getting those, you need to take it seriously and understand, yeah, maybe they didn't decide to investigate at that point or refer it to the DOJ even. But you've gotten some grace potentially, so fix it permanently if there are issues they tell you about, take it seriously.
If it does go into investigation, then there are a lot of options here for how they output from that. One of the biggest things is they can obtain voluntary compliance, corrective action, they can charge penalties. And some of the penalties are nuts, per incident or per-patient breach cost or violation. [These] can be dramatic, it can be very substantial.
But one of the things that you can see, like if you have hundreds, thousands, tens of thousands or more patients, if there's a per-patient incident that occurs, this can add up really fast. Some of the EMR/EHR systems have paid literally tens of millions of dollars because of issues and violations. So please take this seriously.
But you don't want to be just overly scared about it either. And I know that's an oxymoron almost. But the bottom line here is that, if you look at what they're saying here, they're basically going through this progressive process where they're trying to see if something serious happened. And one of the biggest things I can tell you is if there is an investigation or a review, they're probably going to be asking for what your processes were, what are your documentation processes, what did you actually note as risk, and then address?
This is probably one of the biggest things that I see most folks missing, so just keep that in mind. Ultimately that is going to show goodwill, and at least that you are going to be a good actor in this space. Even if you miss something, generally that's going to put them in a better position to not have to be as aggressive with you.
One of the other things that I would note is if you go to the enforcement data page. This is also a little bit more detailed. But you can see that they list the cases that they close fall into these five different categories. You see this on that visualization, but this gives some links and it provides detailed text around each of these. If you scroll down beyond that, you can see they go into enforcement results by year, enforcement results by state, top issues in investigating cases. And these are just really, really helpful. You can actually see some of the types of HIPAA eCommerce problems that occur.
If you go into the top five issues in investigating cases, this is sort of a repeating situation. Impermissible uses and disclosures, that's the number one issue. Access and safeguards, that's number two and number three, depending on the year, they flip-flop. Administrative safeguards, and then finally it gets into some of these other aspects, HIPAA breach notice to individual technical safeguards and minimum necessary.
But there's a common theme here. It's basically like, “Are we limiting use [access to data], making sure that folks aren't doing things with the data that they shouldn't? Like doing marketing stuff that's going to be impermissible, use and disclosure, for example. Maybe someone internally has access to it that shouldn't. Do we have any safeguards in place and administrative safeguards?”