## Facts

- A state-run cancer center and HIPAA-covered entity experienced three incidents involving unencrypted devices containing electronic protected health information (ePHI).
- In 2012, a faculty member’s unencrypted, unpassworded laptop containing ePHI for 29,021 individuals was stolen.
- In 2012, a trainee lost an unencrypted USB drive containing ePHI for over 2,000 individuals.
- In 2013, a visiting researcher misplaced an unencrypted USB drive containing ePHI for nearly 3,600 individuals.
- The center self-reported all three incidents to the federal agency responsible for HIPAA enforcement.
- The agency concluded the center violated (i) a security regulation requiring implementation of a mechanism to encrypt/decrypt ePHI (or an alternative reasonable safeguard) and (ii) a privacy regulation barring impermissible uses/disclosures of protected health information (PHI).
- An administrative law judge granted summary judgment for the agency and sustained civil monetary penalties totaling $4,348,000; the departmental appeals body affirmed.
- On judicial review, the agency conceded it could not defend penalties above $450,000 and sought a large reduction.

## Issues

1. Whether the agency lawfully found a violation of the HIPAA encryption-implementation regulation where the center had encryption policies, licenses, and available encryption tools but some devices remained unencrypted.
2. Whether loss or theft of devices containing ePHI, without evidence of access or viewing by an unauthorized person, constitutes a “disclosure” under the HIPAA privacy regulation.
3. Whether the agency’s penalty calculation complied with HIPAA’s penalty framework (including annual caps), the agency’s regulations and guidance, and the Administrative Procedure Act (APA).
4. Whether the agency acted unlawfully by rejecting comparative enforcement evidence and asserting effectively unreviewable discretion to penalize some regulated entities but not others.

## Decision

- The court granted the petition for review, vacated the civil monetary penalty order, and remanded.
- The court held the agency action was arbitrary, capricious, and contrary to law under the APA, based on multiple independent defects.
- On encryption, the court held the regulation required implementation of an encryption “mechanism,” and the record showed the center had implemented such a mechanism; treating any unencrypted device as an automatic violation misconstrued the regulation.
- On disclosure, the court held the agency lacked evidence that unauthorized persons actually accessed the ePHI; equating loss/theft alone with a proven “disclosure” stretched the regulation beyond its text.
- On enforcement consistency, the court faulted the administrative decision for refusing to engage with evidence that the agency had treated similar cases differently and for suggesting arbitrary enforcement was permissible.
- On penalties, the court found the agency failed to provide a lawful, coherent basis for the multi-million-dollar amount in light of statutory/regulatory limits; the agency’s later concession further indicated the original calculation was indefensible.
- The court assumed without deciding that the center could be treated as a “person” subject to HIPAA penalties because the penalty order failed on other grounds.

## Legal Principles

- Under the APA, courts must set aside agency action that is arbitrary, capricious, an abuse of discretion, or not in accordance with law; agencies must supply a lawful rationale grounded in the governing text and the record.
- A HIPAA security standard requiring implementation of a “mechanism” to encrypt/decrypt ePHI is not satisfied—or violated—by a per se rule equating any instance of an unencrypted device with non-implementation when the entity has implemented an encryption mechanism.
- A HIPAA privacy prohibition on impermissible “disclosures” of PHI cannot be sustained on a record that shows only device loss/theft, without evidence that PHI was actually accessed or obtained by an unauthorized person, where the agency’s interpretation departs from the regulation’s ordinary meaning.
- Agency enforcement decisions and penalty amounts must be explained in a rational manner consistent with statutory caps, the agency’s own regulations/guidance, and consistent application; unexplained disparate treatment can support an APA challenge.
- Post hoc efforts to revise a penalty figure on appeal do not cure an agency’s failure to articulate a lawful penalty theory in the administrative decision.

## Conclusion

The Fifth Circuit vacated HIPAA civil monetary penalties against a state-run cancer center because the agency misconstrued HIPAA’s encryption and disclosure regulations, failed to address concerns about inconsistent enforcement, and did not justify its penalty calculation within the statutory and regulatory limits, requiring remand for further proceedings.


Univ. of Tex. M.D. Anderson Cancer Ctr. v. U.S. Dep’t of Health & Hum. Servs., 985 F.3d 472 (5th Cir. 2021)