On January 14, 2021, the U.S. Court of Appeals for the Fifth Circuit overturned a $4.348 million penalty for alleged HIPAA violations assessed by the U.S. Department of Health & Human Services (HHS) against the University of Texas M.D. Anderson Cancer Center (Hospital). The case arises from an enforcement action undertaken by HHS following the Hospital’s self-disclosure of three separate instances of lost or stolen portable devices containing electronic protected health information (ePHI). The government’s investigation determined that the devices were not encrypted, and that the Hospital’s failure to encrypt the devices to protect the ePHI contained therein constituted a violation of HIPAA’s Privacy and Security Rules. After HHS imposed the penalty in 2017, the Hospital appealed the penalty first to an Administrative Law Judge, and then to HHS’s Departmental Appeals Board before petitioning the Fifth Circuit for review in 2019 (see our prior analyses of this case here).
Continue Reading Fifth Circuit Overturns “Arbitrary and Capricious” $4.3 Million HIPAA Penalty Against Hospital

On March 27, 2018, the United States Court of Appeals for the Fifth Circuit held that a health care provider can seek an injunction in federal court against recoupment by Medicare of alleged overpayments despite not exhausting its administrative appeal remedies, in part because the current delay in scheduling of hearings before an Administrative Law Judge could cause the provider to go out of business before it has an opportunity to exhaust its administrative challenge of the recoupment. This decision could provide a template for other providers facing significant Medicare recoupment demands amidst the “colossal backlog” in Medicare appeals to delay such recoupments until their appeals receive a hearing.
Continue Reading Fifth Circuit Reinstates Provider’s Collateral Challenge to the Medicare Appeal Process