by David P. Saunders and Allison N. Glover
On January 14, 2021, the Fifth Circuit vacated a $4.3 million penalty imposed by the U.S. Department of Health and Human Services (HHS) on M.D. Anderson Cancer Center (M.D. Anderson) in connection with three data incidents experienced by the center. University of Texas M.D. Anderson Cancer Center v. United States Department of Health and Human Services, No. 19-6022 (5th Cir. January 14, 2021). In vacating the penalty, the Fifth Circuit held that (1) HHS had not shown that the loss of unencrypted electronic protected health information (PHI) on its own was sufficient to demonstrate a breach of any HIPAA rules and (2) the penalty imposed on M.D. Anderson was arbitrary, capacious, and unlawful because it exceeded HHS’ authority. Id. The Court’s decision potentially will have ripple effects for the future of HIPAA enforcement actions, including potentially spurring HHS to create new regulations. In the meantime, the University of Texas ruling could mean that fewer companies will report lost or stolen devices as a HIPAA data breach, turning on its head years of prior practice. Either way, the Fifth Circuit’s decision is a big one in terms of HIPAA enforcement.