OCR Leader: No HIPAA Enforcement Schedule Yet

HITECH calls for greater penalties for HIPAA violations and increased enforcement through "periodic audits." And that provision, section 13411 of the HITECH, targets covered entities and business associates. In the new rule, the civil monetary penalties increased greatly, with a maximum penalty of $1.5 million for all violations of an identical provision.

As for the latest numbers surrounding HIPAA complaints, OCR in 2009 reported it received 7,116 complaints, a sharp decrease from the prior three years:

• 2008: 8,526


• 2007: 8,174


• 2006: 7,334

Why the decline in 2009? Perhaps it was a year of policy-making, and HIPAA enforcement and complaints were in limbo.

Uday O. Ali Pabrai, CISSP, CHSS, chief executive and co-founder of HIPAA Academy in Newport Beach, CA, said at the HIPAA Summit Thursday he thinks enforcement activity—and breaches—will become more prevalent after this month.

"I think there will be a lot of data breaches we'll be hearing about in the media this year," Pabrai said.