Lesson 1:  Ways OCR Enforces the HIPAA Rules
Activity 1: Scenario

On May 1, 2010, OCR receives a phone call from an individual with a complaint that her PHI
was disclosed by her physician to a marketing firm without her permission.
The disclosure took place in December 2008, but she only recently discovered the problem.
Which of the following criteria establishing OCR jurisdiction to investigate was not met for this complaint?