Enforcement Highlights February 2014

HIPPA Privacy Rule Enforcement Highlights and Results as of February 2014.

Final

Issued by: Office for Civil Rights (OCR)

Issue Date: July 06, 1905

Enforcement Highlights

(As of February 28, 2014)

The HIPAA Privacy Rule is a set of federal standards to protect the privacy of patients' medical records and other health information maintained by covered entities: health plans, which include many governmental health programs, such as the Veterans Health Administration, Medicare and Medicaid; most doctors, hospitals and many other health care providers; and health care clearinghouses. These standards provide patients with access to their medical records and with significant control over how their personal health information is used and disclosed. Compliance with the standards was required as of April 14, 2003 for most entities covered by HIPAA. On that date, OCR began accepting complaints involving the privacy of personal health information in the health care system.

The HIPAA Security Rule establishes national standards for the security of electronic protected health information. The final rule adopting HIPAA standards for security was published in the Federal Register on February 20, 2003. This final rule specifies a series of administrative, technical, and physical security procedures for covered entities to use to assure the confidentiality of electronic protected health information. The standards are delineated into either required or addressable implementation specifications. Compliance with the standards was required as of April 20, 2005, for most entities covered by HIPAA. The authority to administer and enforce the Security Rule was transferred to OCR on July 27, 2009.

Enforcement Results as of the Date of This Summary

HHS / OCR has investigated and resolved over 22,222 cases by requiring changes in privacy practices and other corrective actions by the covered entities. Corrective actions obtained by HHS from these entities have resulted in change that is systemic and that affects all the individuals they serve. HHS has successfully enforced the HIPAA Rules by applying corrective measures in all cases where an investigation indicates noncompliance by the covered entity. OCR has investigated complaints against many different types of entities including: national pharmacy chains, major medical centers, group health plans, hospital chains, and small provider offices.
In another 10,005 cases, our investigations found no violation had occurred.
In the rest of our completed cases (54,944) HHS determined that the complaint did not present an eligible case for enforcement. These include cases in which:

- OCR lacks jurisdiction under HIPAA – such as a complaint alleging a violation prior to the compliance date or alleging a violation by an entity not covered by HIPAA;
- the complaint is untimely, or withdrawn or not pursued by the filer
- the activity described does not violate the Rules – such as when the covered entity has disclosed protected health information in circumstances in which the Rules permits such a disclosure.

In summary, since the compliance date in April 2003, HHS has received over 92,975 HIPAA complaints. We have resolved ninety-four percent of complaints received (over 87,171): through investigation and enforcement (over 22,222); through investigation and finding no violation (10,005); and through closure of cases that were not eligible for enforcement (54,944).

From the compliance date to the present, the compliance issues investigated most are, compiled cumulatively, in order of frequency:

Impermissible uses and disclosures of protected health information;
Lack of safeguards of protected health information;
Lack of patient access to their protected health information;
Uses or disclosures of more than the minimum necessary protected health information; and
Lack of administrative safeguards of electronic protected health information.

The most common types of covered entities that have been required to take corrective action to achieve voluntary compliance are, in order of frequency:

Private Practices;
General Hospitals;
Outpatient Facilities;
Health Plans (group health plans and health insurance issuers); and,
Pharmacies.

Security Rule Enforcement Results as of the Date of This Summary

With regard to the subset of complaints specifically pertaining to the Security Rule, since OCR began reporting its Security Rule enforcement results in October 2009, HHS has received approximately 813 complaints alleging a violation of the Security Rule. During this period, we closed 598 complaints after investigation and appropriate corrective action. As of February 28, 2014, OCR had 280 open complaints and compliance reviews.

Referrals

OCR refers to the Department of Justice (DOJ) for criminal investigation appropriate cases involving the knowing disclosure or obtaining of protected health information in violation of the Rules. As of the date of this summary, OCR made over 522 such referrals to DOJ.

Watch for monthly updates reporting the number of cases received, investigated or resolved.

HHS is committed to making its websites and documents accessible to the widest possible audience, including individuals with disabilities. We are in the process of retroactively making some documents accessible. If you need assistance accessing an accessible version of this document, please reach out to the guidance@hhs.gov.

DISCLAIMER: The contents of this database lack the force and effect of law, except as authorized by law (including Medicare Advantage Rate Announcements and Advance Notices) or as specifically incorporated into a contract. The Department may not cite, use, or rely on any guidance that is not posted on the guidance repository, except to establish historical facts.