After a number of years of little HIPAA enforcement activity, the tides appear to be turning.

From September 2015 through April 2016, HIPAA settlements have averaged more than one a month. The dollar amounts involved are significant, ranging from $240,000 to nearly $4 million.

That’s not all. The HHS Office for Civil Rights (OCR) has begun its second phase of audits of covered entities (CEs) and their business associates. Unlike the first round of HIPAA audits, the second round may result in disciplinary actions. The OCR is under pressure to become more proactive than reactive following release of a study from the Office of Inspector General and accompanying recommendation that OCR should strengthen its oversight of covered entities’ compliance with the Privacy Rule.

It is not uncommon to find HIPAA noncompliance in acquisition targets in a healthcare transaction. We are always conscientious to help investors find practical methods for assessing risk of target noncompliance and create effective compliance going forward.