Several pharmaceutical district sales managers were fined and sentenced to probation, home confinement, or a combination of the three, for violations of the Health Insurance Portability and Accountability Act (HIPAA). One district manager was charged with filling out prescription prior authorizations on behalf of physicians in an effort to increase sales numbers, and instructing his representatives to do the same. The district manager was also said to have ignored a company-wide memorandum intended to identify and prevent potential HIPAA violations, including, specifically, the ramifications for viewing or filling out patient-specific prior authorization forms.
Important in this case, as well as others, is the pharmaceutical company’s memorandum to its staff recognizing and prohibiting its workforce from providing assistance in completing prior authorization forms. From the government’s perspective, such a memorandum may be considered a component of the company’s internal risk assessment, as required under HIPAA. The district manager’s intentional disregard of the company-wide memo exacerbates the level of enforcement action, as the degree of a HIPAA violation is directly correlated with the offender’s intent.
The judge presiding over the matter emphasized the severity of the crime and noted, “No matter how much publicity these cases get, it doesn’t seem to deter anyone.” Penalties for HIPAA violations can be severe, and the government is pursuing these matters more frequently and more vigorously. In light of the current trend of severe criminal and civil penalties for HIPAA violations, entities should employ a conservative approach to HIPAA compliance if they have not already. As part of a reasonable compliance plan, covered entities and business associates must complete a risk assessment on a regular basis in order to evaluate and mitigate any known or likely threats and vulnerabilities to the privacy and security of patient protected health information. If your practice or pharmacy requires assistance in performing a required risk analysis, contact Frier Levitt.