OCR Issues National HIV/AIDS Compliance Review Report to Strengthen Civil Rights and Health Information Privacy Protections for People Living with HIV/AIDS

The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) today issued a report on its National HIV/AIDS Compliance Review Initiative.  This important Initiative began in 2014, when OCR conducted coordinated compliance reviews at twelve hospitals – one hospital in each of the twelve cities most impacted by HIV/AIDS:  Atlanta, GA; Baltimore, MD; Chicago, IL; Dallas, TX; Houston, TX; Los Angeles, CA; Miami, FL; New York City, NY; Philadelphia, PA; San Francisco, CA; San Juan, PR; and Washington, DC.  The compliance reviews examined the ways in which each hospital ensures:  (1) equal access for HIV-positive individuals to programs and services; (2) meaningful access for limited English proficient (LEP) individuals; and (3) the privacy and security of individuals’ health information and their rights with regard to that information. 

OCR evaluated each hospital’s policies and practices and found that all of the hospitals under review had implemented some policies and practices to promote equal access and protect health information.  In addition, many of the hospitals had implemented evidence-based interventions to increase the number of newly diagnosed individuals entering or retained in care.  However, OCR also found that in some of the hospitals, there were opportunities for improvement; OCR provided those hospitals with technical assistance.  This report summarizes OCR’s findings and identifies additional steps that hospitals and other health care providers can take to protect the civil rights and health information privacy of people living with HIV/AIDS. 

Civil Rights:  For example, hospitals and other health care providers (“covered entities”) must:

  • Adopt and post Notices and Nondiscrimination Statements which explain that the covered entity does not discriminate on the basis of race, color, national origin, sex, age, or disability, including HIV status;
  • Designate Civil Rights Coordinators to establish and implement grievance procedures for patients and consumers;
  • Provide auxiliary aids and services to ensure effective communication for individuals with disabilities;
  • Take reasonable steps to provide meaningful access to each LEP individual eligible to be served or likely to be encountered in the covered entity’s health programs or activities.  Reasonable steps may include:  (1) the provision of qualified interpreters to LEP individuals when oral interpretation is required to provide meaningful access; and (2) the provision of qualified translators to translate written documents or web content.
  • Ensure that such language assistance services are provided free of charge, are accurate and timely, and protect the privacy and independence of LEP individuals. Covered entities, with limited exceptions, are prohibited from allowing children, family members or friends of the patient to serve as interpreters.

Health Information Privacy:  Covered entities must:

  • Designate HIPAA Privacy and Security Officials responsible for developing and implementing policies and procedures to protect health information;
  • Provide a Notice of Privacy Practices that describes how individuals’ medical information may be used and disclosed and how they can get access to this information;
  • Develop and implement policies and procedures regarding individuals’ right to inspect and obtain a copy of their medical records, both in paper and electronic form;
  • Evaluate the potential risks and weaknesses to keeping electronic health information confidential, secure, and available and apply sufficient security measures to protect the information; and
  • Establish policies and procedures to ensure a notice of a health information breach is provided to affected individuals when needed, to OCR, and to the media (if necessary).

To read the full report, visit: https://www.hhs.gov/sites/default/files/compliance-review-initiative-report-2016.pdf.

Over the five-year period from FY 2010 to FY2015, OCR opened 145 matters to provide public education and address allegations that people living with HIV suffered violations of their civil rights or health information privacy.  The 145 new matters include public education campaigns, HIV-related civil rights complaint investigations, HIV-related health information privacy investigations and 24 compliance reviews.

Of particular note, in 2013, OCR launched its Information is Powerful Medicine public education campaign, which encourages those living with HIV to be proactive in their medical care.  The campaign explains individuals’ health information privacy rights, including how individuals can monitor and access a copy of their medical records.  The campaign reaches African American men who have sex with men and was featured at Black gay pride events in Atlanta, Chicago, New York City, Oakland and Washington, DC, as well as at the U.S. Conference on AIDS in New Orleans.  To download and share the Information Is Powerful Medicine brochure, poster and/or web banners with others who might find the information useful, visit https://www.hhs.gov/hipaa/for-professionals/special-topics/information-is-powerful-medicine/index.html.

For additional information on OCR’s work on HIV/AIDS issues, visit:  www.hhs.gov/civil-rights/for-individuals/special-topics/HIV/index.html.  

To learn more about non-discrimination and health information privacy laws, your civil rights, and privacy rights in health care and human service settings, and to find information on filing a complaint, visit us at www.hhs.gov/ocr.

Follow OCR on Twitter at https://twitter.com/HHSOCR.

Content last reviewed