The summer intern in the Department of Stem Cell Transplantation and Cellular Therapy was most likely on a campus shuttle bus when she lost a thumb drive. The home of the director of research informatics at the Genitourinary Cancer Center was burglarized and a thief absconded with his work laptop. A visiting infectious disease researcher from Brazil wasn’t sure what happened to her thumb drive; it disappeared from her desk over Thanksgiving break.

The three incidents involving investigators from the University of Texas MD Anderson Cancer Center cumulatively affected data for nearly 34,000 individuals. MD Anderson reported the losses of unencrypted data, which occurred in 2012 and 2013, to the HHS Office for Civil Rights (OCR), as breaches of protected health information (PHI).

But when OCR tried to fine it $4.38 million, MD Anderson later argued in court (among other defenses) that research data was exempt from HIPAA and that the institution itself—as an arm of the government—was immune from enforcement action.

Nearly 10 years later, a trio of justices from the Fifth Circuit Court of Appeals ruled MD Anderson actually owed nothing, but not because of the research and immunity arguments.^[1] Instead, the win turned on the circuit court’s finding that OCR had misinterpreted the definitions of encryption and disclosure.^[2] OCR arrived at the total fine by calculating $3 million for the two impermissible disclosures and $1.384 million for lack of encryption.

MD Anderson and its attorneys were “thrilled that the Fifth Circuit agreed with our interpretation of the law,” attorney Scott McBride told RRC in his first wide-ranging interview about the unique case. The litigation ended there because HHS officials didn’t appeal that January 2021 ruling, but “we would have been happy to go to the Supreme Court if they wanted to,” said McBride, a partner in the Houston office of Morgan, Lewis & Bockius LLP.

Although the case wasn’t free to pursue—McBride wouldn’t disclose MD Anderson’s legal costs but said they were less than the fine would have been—it continues to pay dividends for other covered entities (CEs) and business associates (BAs) who now have a defined “path” to combat “overly aggressive” OCR enforcement of HIPAA regulations, said McBride.

Universities that have a medical school or other arms that conduct human subjects research are also CEs and need to be aware of developments like the MD Anderson decision and regulatory changes imposed at both the state and federal levels. They can also thank MD Anderson for at least a temporary tenfold reduction in civil money penalties (CMPs).

Just after MD Anderson’s appeals were filed in April 2019, OCR issued a notification of enforcement discretion, acknowledging that the $1.5 million annual caps it had relied on—and which MD Anderson challenged as too high—were not appropriate under a new interpretation of the HITECH Act.^[3]

OCR set new annual maximums that would have reduced MD Anderson’s fine to $450,000; the agency promised to follow up with revised regulations.