Resources for Health Insurance Portability and Accountability Act (HIPAA)

How OCR Enforces the HIPAA Privacy Rule

www.hhs.gov

The Office for Civil Rights (OCR) is responsible for enforcing the HIPAA Privacy Rule (45 C.F.R. Parts 160 and 164, Subparts A and E). One of the ways that OCR carries out this responsibility is to investigate complaints filed with it. OCR may also conduct compliance reviews to determine if covered entities are in compliance, and OCR performs education and outreach to foster compliance with the Privacy Rule’s requirements.

OCR may only take action on certain complaints. See What OCR Considers During Intake and Review of a Complaint for a description of the types of cases in which OCR cannot take an enforcement action.

If OCR accepts a complaint for investigation, OCR will notify the person who filed the complaint and the covered entity named in it. Then the complainant and the covered entity are asked to present information about the incident or problem described in the complaint. OCR may request specific information from each to get an understanding of the facts. Covered entities are required by law to cooperate with complaint investigations.

If a complaint contains information about an incident or problem that could also be a violation of the HIPAA Security Rule (45 C.F.R. Parts 160 and 164, Subparts A and C), OCR coordinates its investigation with the Centers for Medicare & Medicaid Services (CMS), which is the agency within HHS that is responsible for enforcing the Security Rule. If a complaint describes an action that could be a violation of the criminal provision of HIPAA (42 U.S.C. 1320d-6), OCR may refer the complaint to the Department of Justice for investigation.

View the Resource

Share or bookmarklet this web page at: