It has changed a lot since then. 2015 was a huge overhaul of HIPAA and its enforcement.

Prior to that, it was just a polite suggestion.

+1

I work in publicly funded mental health and our responses to possible/actual HIPAA breaches are monitored very closely by our funders. So even if an event occurs that is not deemed to be an actual breach, if our response/investigation/corrective action is found to be unsatisfactory, our county/state/fed contracts, foundation grants, and Joint Commission Accreditation could be altered/canceled.

Really? That's surprising to me. I worked a hospital job for several years, and had heard of employees making minor infractions who were fired and sued by both the hospital as well as the patient(s). Though those were individuals, things could be different if you're a corporation [rolls eyes pessimistically].

9 times out of 10 those types of infractions are intentional, stuff like this: https://www.reliasmedia.com/articles/11576-13-hospital-worke...