HHS reduces maximum penalties for HIPAA violations

The Department of Health and Human Services Friday issued a notice reducing the maximum civil monetary penalty for all but the most serious violations of the Health Insurance Portability and Accountability Act. A 2013 rule applied a maximum penalty of $1.5 million for all four penalty tiers under the HITECH Act of 2009. Based on further review of the statute by the HHS Office of the General Counsel, the notice reduces the maximum penalty for three of the four tiers, the exception being violations due to willful neglect that are not corrected in a timely manner.