The interesting part of this case is the size of the penalties and the arguments put forward by MD Anderson regarding the statutory caps on civil monetary penalties that are permitted to be imposed under HIPAA. Unfortunately for MD Anderson, the ALJ was only delegated authority to review OCR’s imposition of penalties under the regulations with respect to reasonableness and was not permitted to declare the regulations to be beyond OCR’s authority or to declare proposed penalties to be arbitrary and unconstitutional. In the absence of an appeal, MD Anderson now owes civil money penalties of $4.3 million due to its violations of HIPAA.
You can read the ALJ’s opinion here and the OCR press release here.
Sign up for our newsletter and get the latest to your inbox.