MD Anderson Cancer Center Disputes Privacy Violation Penalty

The U.S. Health and Human Services Department lacked authority to fine the University of Texas MD Anderson Cancer Center more than $4 million for allegedly violating the Health Insurance Portability and Accountability Act, the health-care provider said.

MD Anderson is a state entity, and thus isn’t a “person” subject to a civil monetary penalty under HIPAA, the provider told the U.S. District Court for the Southern District of Texas April 9.

HHS Secretary Alex M. Azar exceeded his authority by adopting a regulation that, contrary to the statute, defines a “person” to include states and state agencies, MD Anderson said. ...