Jefferson County Board hears HIPAA compliance pitch, delays decision

A vendor team briefed the Jefferson County Board of Supervisors on Health Insurance Portability and Accountability Act (HIPAA) compliance requirements and service options during the Dec. 8 meeting, and the board agreed to take time to review materials instead of selecting a vendor immediately.

The presentation described HIPAA as a federal standard requiring protection of patient health information and highlighted enforcement risks. "The median fine and penalty right now is about $60,000 for a single breach," the vendor representative said, and added that reputational and ancillary costs can exceed regulatory penalties.

The presenters described three packaged options — a comprehensive program the vendor called "HIPAA Select" (presenter-stated price around $16,500 per year), a mid-level package (~$9,500) and a limited "Express" option (~$3,900) — and said the Select product includes an indemnity for up to $100,000 toward fines or penalties under certain conditions. The vendor emphasized workforce training as a primary weak point: "Training is one of the areas where people are least compliant," the presenter said, noting some clients train at low rates.

Supervisors asked how HIPAA applies across county functions that handle health data, including the ambulance service, public health and the jail. The county attorney noted the legal complexity and said some departments can make the county a covered entity even if they are not traditional health-care providers. Health department staff encouraged internal conversation between elected officials and department heads to identify specific responsibilities.

Supervisor comments emphasized caution about committing budgeted funds immediately. One supervisor said the board should study the county’s current practices before contracting, and another asked the vendor to provide more detailed written materials. The vendor agreed to compile a more detailed proposal and return for further discussion during the budget process.

Next steps: the board requested follow-up materials from the vendor and will consider the item as part of upcoming budget deliberations rather than approving a contract at this meeting.