Last month, the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) settled it's fourth HIPAA agreement of the year, with the University of California at Los Angeles Health Systems (UCLAHS). The settlement of $865,500 was the fourth settlement of 2011 and the sixth settlement since the Act with into compliance in 2003.
This increasing number of settlements has led some to ask if the OCR is now enforcing HIPAA at a new level?
Adam H. Greene of Davis Wright Tremaine notes:
At this time, the chance of an investigation leading to a formal settlement or civil money penalty (CMP) remains remote, but those odds are increasing, especially for large organizations that have experienced a headline-grabbing privacy incident.
Given that it takes two years for an investigation to reach a settlement, on average, there aren't enough data points for us to know if the OCR is trying to step up enforcement. For more on the trends, read here.