There is a maximum penalty of $1.5 million for all violations of an identical provision during a calendar year.
In most cases, the maximum penalty amount will not be imposed. Instead, the government will determine the amount of a penalty on a case-by-case basis, depending on the nature and extent of the violation and resulting harm, as well as other aggravating and mitigating factors, which are listed in the HIPAA regulations at 45 CFR 160.408, available online at www.ecfr.gov/cgi-bin/text-idx?SID=267ddbb0ea4dc25607809aa61c2c7b7b&node=se45.1.160_1408&rgn=div8.
Examples of the factors include the number of individuals affected, the harm caused to the affected individuals, and the size of the dental practice.
A HIPAA violation can also result in criminal penalties. According to the U.S. Department of Health and Human Services Office for Civil Rights (OCR):
A person who knowingly obtains or discloses individually identifiable health information in violation of the Privacy Rule may face a criminal penalty of up to $50,000 and up to one-year imprisonment. The criminal penalties increase to $100,000 and up to five years imprisonment if the wrongful conduct involves false pretenses, and to $250,000 and up to 10 years imprisonment if the wrongful conduct involves the intent to sell, transfer, or use identifiable health information for commercial advantage, personal gain or malicious harm. The Department of Justice is responsible for criminal prosecutions under the Privacy Rule.1
Related References and Resources
• What are the penalties for violating HIPAA?
ADA.org/en/member-center/member-benefits/legal-resources
• OCR, HIPAA Enforcement
www.hhs.gov/ocr/privacy/hipaa/enforcement/index.html
8. I’ve Been Sued. What Do I Do?
We want you to know the law well enough to know when you need to retain counsel. Helping you spot potential legal issues is one of the goals of this publication. The truth is, however, that trying to save money by navigating a legal dispute by yourself can end up costing you far more down the road in terms of money, time, and results than will obtaining sound legal advice when legal issues first emerge.
If you are sued or threatened with suit, contact an attorney. If the dispute has not escalated very far, the attorney may recommend that you try to communicate directly with the other party, and can give you guidance about the best way to do that and about what to say and what not to say. It is best if you do not speak with the attorneys for the other side, and in many states the legal profession ethical code provides that the only thing a lawyer for an adverse or potentially adverse party should tell you is that you should seek legal counsel.
Your lawyer can help you assess your risks and duties in the event a legal action is filed. For example, your attorney can advise you about whether and how to respond to a subpoena for records or about questions you may be asked by representatives for the other party. Parties to a lawsuit are entitled to obtain from each other all information reasonably identified by a properly served request and that may be relevant to the case. This is called “discovery.” During a lawsuit, but prior to trial, most courts will err on the side of requiring disclosure, even if the information sought is likely to be ruled irrelevant and inadmissible at trial. If a lawsuit is filed or you have good reason to believe one will be filed, it is important to maintain the status quo with respect to records. For example, once a malpractice claim is made or even threatened, it is a huge mistake to discard or modify patient records. In fact, such conduct may itself create legal liability.
The questions you ask your attorney about legal matters, including legal strategies and tactics, and the legal advice your attorney gives you are protected by what is called the Attorney-Client Privilege. The other side in the legal dispute is not entitled to information about those privileged discussions unless you “waive” the privilege, which is a serious matter your attorney should advise you about. Conversations and other communications with individuals besides your attorney are not privileged and the other party is entitled to learn about them if they are relevant to the case. Discussions you have with ADA staff attorneys are not privileged and information about those discussions is discoverable. ADA attorneys cannot represent members in individual matters. Their client is the ADA and in addition they may not be licensed to practice law in your state.
The legal nature of a document or conversation is what determines whether it is privileged. Labeling or designating information that is not privileged will not make it so. Many people believe that merely designating non-privileged information as “confidential” will protect it from discovery, but that is not true.
You should immediately contact your insurance carrier when a claim is made that may be covered by insurance. Under some circumstances, failure to do so may threaten the availability of insurance coverage.
9. Should I Settle? On What Terms?
Whether to settle depends on your case. This issue invariably arises once the dust clears after you are sued. First-time defendants in malpractice cases sometimes express concern that the attorney provided by the insurance company may be pressuring them to settle the claim. If you are concerned about the advice you are getting from your insurance counsel about settlement, you may wish to consult with your private counsel, who may help you assess the merits of your case and your rights to a full defense as spelled out in your insurance contract. Private counsel can be especially important if a claim is likely to exceed policy limits or the claim is not fully covered.
Dentists often settle claims without admitting liability. Whether to settle can be more of a business issue than a legal one. For example, you may need to consider whether it is worth the time away from the office to have your day in court. If you decide to settle, your counsel will probably try to structure the agreed-upon settlement to avoid any admission of liability. A good settlement will extinguish the patient’s rights to sue further on the same facts. The proper ingredients and settlement language may turn on state law. Parties will often agree that the terms of the settlement remain private, and neither the Settlement Agreement itself nor its terms need be placed in the official court record. The Agreement may include penalties in the event a party makes an unauthorized disclosure of the settlement terms.
10. Must a Settlement of a Malpractice Claim Be Reported to the Data Bank?
It depends. If you decide to settle a malpractice claim through your insurance company, the company will need to make a report to the National Practitioner Data Bank (NPDB). Nobody knows for certain what effect being in the Data Bank will have. Some dentists view this as troublesome and will pay out-of-pocket from personal funds to avoid having to report to the Data Bank. Others are not as worried, especially if their Data Bank file is a small one. When assessing your level of discomfort regarding having something entered into your Data Bank file, keep in mind that information about you may already be available through other sources, such as publicly available malpractice “banks” in some states.
11. Will the ADA Represent Me or File a Brief on My Behalf?
The
