Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The role of HIPAA Security Officer is very important in maintaining compliance. In smaller organizations, there's overlap in employees' roles, so the person that ends up as the HIPAA Security Officer may not have a whole lot of background in compliance. Does the individual serving in this role face more personal liability for breaches than other employees?

share|improve this question

migrated from healthcareit.stackexchange.com May 1 '12 at 11:13

This question came from our site for healthcare IT professionals and solution providers.

3 Answers 3

up vote 12 down vote accepted

Good question! But there's not a solid answer I'm afraid. As with most of these cases, it depends case by case, but there are a few things to consider.

First of all if there has been some for of negligence than an individual can be personally liable.

However I don't think that an HIPAA Security officer is any different than any other person responsible for the security of sensitive personal information; usually these cases don't make it to court.

share|improve this answer
    
Asked our company's lawyer and pretty much got the same answer. Though I admit "I can tell you that it hasn't happened yet" wasn't as reassuring as I'd hoped. –  John Straka Oct 14 '11 at 12:21
3  
@JohnStraka Professional liability from a company officer usually requires inappropriate ignorance of conditions or malice. If you made the best reasonable efforts, you ought to be in a sound position. –  Jeff Ferland Oct 26 '11 at 23:05

Does the individual serving in this role face more personal liability for breaches than other employees?

Disclaimer: I am not a lawyer, but I have been through several rounds of HIPAA training.

Is a HIPAA security officer automatically liable for a breach? No. If the security officer has done due diligence, the proper safeguards are in place, and some malicious user goes and sells a celebrity's health information to a paparazzi anyway, it seems doubtful that the security officer would be named in any resulting lawsuit. Even if they were named, they've done their job and should have nothing to fear.

But is a HIPAA security officer exposing him/herself to more potential liability than the average employee? Maybe. By taking on the responsibility for this area, it's possible that they might face some form of liability if they are negligent in the safeguards they put into place or the training of others. (Though as @John Straka pointed out, I've never heard of it happening.)

share|improve this answer

Unfortunately, I think the question is currently moot. While I think HIPAA compliance is important, enforcement is still non-existent.

Franken noted dryly that 64,000 privacy complaints have been filed with the OCR—and that nearly 500 were referred to the Justice Department for criminal investigation. But the Justice Department told his staff, Franken said, there have been just 16 HIPAA criminal prosecutions. Meanwhile, HHS had secured only one civil monetary penalty and six settlements, he said.

http://www.modernhealthcare.com/article/20111116/BLOGS02/311169962/candid-comments-on-hipaa-privacy-rules-enforcement

Until enforcement changes occur, we won't know who will really end up being responsible.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.