The Office for Civil Rights (OCR) of the Department of Health and Human Services (HHS) investigates complaints of HIPAA violations. If OCR determines a violation has occurred, the HHS Secretary may impose HIPAA OCR civil monetary penalties on the entity that committed the violation. Before the HIPAA OCR civil monetary penalty may be imposed, OCR must first provide the entity with a Notice of Proposed Determination of Intent to Impose a Civil Money Penalty (“Notice”).
What Rights Does an Entity Who Has Been Given a HIPAA OCR Notice Have?
A covered entity that has received a HIPAA OCR Notice of Proposed Civil Money Penalty, based on alleged violation of the HIPAA Security Rule or the HIPAA Privacy Rule, may request a hearing before an Administrative Law Judge (ALJ). That judge will take evidence from OCR and the entity, and render a written decision. A party that is dissatisfied with the ALJ’s decision may request review of that decision by the Departmental Appeals Board (Board).
The appeal of the decision of the ALJ to the Board must be initiated by the dissatisfied party’s filing a “Notice of Appeal” with the Departmental appeals Board. This filing must be made within 30 days after the ALJ has served a copy of its decision on that party. A copy of the Notice of Appeal must be given to the ALJ.
Once the Notice of Appeal is filed, the ALJ must forward the entire record of the case to the Board for the Board’s review.
What Evidence Must be Submitted by the Party Who Appeals?
The notice of appeal must be accompanied by a written brief. A brief is a document, addressed to the Board, that contains the dissatisfied party’s reasons for why it disagrees with the ALJ’s decision. The brief cannot simply contain a list of disagreements. The brief must contain reasons – arguments – for the disagreements. The party (covered entity or OCR) who files the notice of appeal and the brief with the Board, must also provide a copy of the notice of appeal and the brief to the other party. Once that other party receives the notice of appeal and the accompanying brief, that party has a right to respond to it. The response of that party (the “responding party”) is known as a “Brief in Opposition.” The Brief in Opposition is addressed to the Board, and must contain the responding party’s arguments as to why the other party’s arguments are inaccurate.
To prevent both parties from trying to spring “last-minute evidence” on the Board, the Board, by law, may not consider any issue that was raised in the briefs for the first time. That is, generally, the Board will only review arguments that were made, or could have been made, to the ALJ in the first instance. This rule is best thought of as a “no new evidence” rule.
What Action May the Board Take?
Once the briefs have been submitted to the Board, the Board has several options. The Board may decline to review the case. The Board, if it decides to review the case, may uphold the penalty assessed by the ALJ. The Board is permitted to increase or reduce the amount of that penalty. The Board is also empowered to reverse the penalty. If the Board believes the case needs to be sent back (remanded) to the ALJ, so that the ALJ can hear additional evidence, the Board may send the case back to the ALJ.
Within 60 days after the deadline for the parties’ filing their briefs, the Board must serve a copy of its decision on each party.
A party dissatisfied with the Board’s decision may file a “Request for Reconsideration” with the Board. The Request for Reconsideration asks the Board to reconsider its decision. The Board need not act on a Request for Reconsideration. Indeed, the Board will only reconsider if its decision only if the Board determines it made a clear error in that decision.
The Board‘s decision on reconsideration – whatever it is – generally becomes the final decision of the Secretary.
If the Board upholds the fine, the covered entity may then seek review of Board’s decision in federal court.
