Resources for Health Insurance Portability and Accountability Act (HIPAA)

Compliance and Enforcement: What OCR Considers During Intake & Review of a Complaint

www.hhs.gov

The Office for Civil Rights (OCR) is the agency within the U. S. Department of Health and Human Services that investigates complaints about failures to protect the privacy of health information. It does so under its authority to enforce the Privacy Rule.

OCR carefully reviews all complaints that it receives. Under the law, OCR only may take action on complaints that meet the following conditions.

* The alleged action must have taken place after April 14, 2003. Compliance with the Privacy Rule was not required until April 14, 2003. Therefore, OCR can not investigate complaints about actions that took place before that date.

* The complaint must be filed against an entity that is required by law to comply with the Privacy Rule. Not all organizations are covered by the Privacy Rule. Entities subject to the Privacy Rule are considered “covered entities.”

View the Resource

Share or bookmarklet this web page at: