HHS Adjusts Civil Monetary Penalties Again for HIPAA, MSP, and SBC Violations, Effective March 17, 2022

HHS has announced adjustments of civil monetary penalties for statutes within its jurisdiction. The latest amounts are based on a cost-of-living increase of 1.06222%. These adjustments are effective for penalties assessed on or after March 17, 2022, for violations occurring on or after November 2, 2015. Here are highlights of the adjustments potentially affecting employer-sponsored health plans:

• HIPAA Administrative Simplification. HIPAA administrative simplification encompasses standards for privacy, security, breach notification, and electronic health care transactions. HIPAA has four tiers of violations that reflect increasing levels of culpability, with minimum and maximum penalty amounts within each tier and an annual cap on penalties for multiple violations of an identical provision. The indexed penalty amounts for each violation of a HIPAA administrative simplification provision are as follows:

  • Tier 1—lack of knowledge: The minimum penalty is $127 (up from $120); the maximum penalty is $63,973 (up from $60,226); and the calendar-year cap is $1,919,173 (up from $1,806,757).
  • Tier 2—reasonable cause and not willful neglect: The minimum penalty is $1,280 (up from $1,205); the maximum penalty is $63,973 (up from $60,226); and the calendar-year cap is $1,919,173 (up from $1,806,757).
  • Tier 3—willful neglect, corrected within 30 days: The minimum penalty is $12,794 (up from $12,045); the maximum penalty is $63,973 (up from $60,226); and the calendar-year cap is $1,919,173 (up from $1,806,757).
  • Tier 4—willful neglect, not corrected within 30 days: The minimum penalty is $63,973 (up from $60,226); the maximum penalty is $1,919,173 (up from $1,806,757); and the calendar-year cap is $1,919,173 (up from $1,806,757). [EBIA Comment: It is unclear why HHS continues to use the $1,500,000 base for the calendar-year caps for Tiers 1–3 since the enforcement discretion announced in April 2019 significantly reduces the unindexed penalty amounts for those tiers (see our Checkpoint article). Further guidance from HHS would be welcome.]

• Medicare Secondary Payer. The Medicare Secondary Payer statute prohibits a group health plan from “taking into account” the Medicare entitlement of a current employee or a current employee’s spouse or family member and imposes penalties for violations. The indexed amounts for violations applicable to employer-sponsored health plans are as follows:

  • Offering incentives to Medicare-eligible individuals not to enroll in a plan that would otherwise be primary: $10,360 (up from $9,753).
  • Failure of responsible reporting entities to provide information identifying situations where the group health plan is primary: $1,325 (up from $1,247).
• Summary of Benefits and Coverage (SBC). An SBC generally must be provided to participants and beneficiaries before enrollment or re-enrollment in a group health plan. The penalty for a health insurer’s or non-federal governmental health plan’s willful failure to provide an SBC is $1,264 (up from $1,190) for each failure.

EBIA Comment: The annual adjustments to penalties are designed to preserve their deterrent effect in the face of inflation. HHS’s “annual” adjustments are supposed to made by January 15 of each year, but in practice have come at irregular intervals. The preceding adjustment was just made on November 15, 2021 (see our Checkpoint article)—HHS missed the January 15 deadline in 2021 and 2022. (Note that ERISA plans are subject to annually adjusted DOL penalties (see our Checkpoint article).) For more information, see EBIA’s HIPAA Portability, Privacy & Security manual at Section XX.E (“Civil Monetary Penalties”). See also EBIA’s Group Health Plan Mandates manual at Section XXIV.K (“Medicare Secondary Payer (MSP) Requirements: Enforcement”), EBIA’s Health Care Reform manual at Section XVI.I (“Consequences of Failing to Provide the SBC”), and EBIA’s Self-Insured Health Plans manual at Section XXVIII.C (“Summary of Benefits and Coverage (SBC)”).

Contributing Editors: EBIA Staff.