Fifth Circuit Vacates $4.3M HIPAA Penalty, Potentially Opening the Door for Future HIPAA Enforcement Challenges
“With a notably sharply worded opinion, the Fifth Circuit recently vacated over $4.3 million in penalties levied against the University of Texas M.D. Anderson Cancer Center (M.D. Anderson) by the Department of Health and Human Services (HHS) for a series of alleged HIPAA violations,” reports Dianne J. Bourque and Michelle L. Caton in Mintz’ Insights Center.
“The case, University of Texas M.D. Anderson Cancer Center vs. U.S. Department of Health and Human Services, stems from three separate incidents that occurred between 2012 and 2013. In two instances, M.D. Anderson workforce members lost unencrypted protected health information (PHI), while the third incident involved the theft of a faculty member’s laptop also containing unencrypted PHI. After investigating these occurrences, HHS fined M.D. Anderson a total of $4,348,000, which M.D. Anderson contested through the agency’s administrative review process. On review, both the administrative law judge (ALJ) and the Departmental Appeals Board upheld the penalties.”
“On appeal, the Fifth Circuit concluded that HHS’s civil monetary penalties order against M.D. Anderson was arbitrary, capricious, and contrary to law, vacating the penalties and pointedly criticizing the agency’s actions and arguments in this matter. The court identified “at least four independent reasons” for its conclusion.”
