HHS Office Resolves More Than Half of HIPAA Complaints Without Investigation
An HHS office has resolved more than half of complaints about possible violations of the medical privacy rule issued after the passage of the Health Insurance Portability and Accountability Act without investigation, according to a Des Moines Register review of state and federal records. Since the rule took effect in 2003, 38,000 U.S. residents have filed complaints with the HHS Office for Civil Rights, and the office has resolved 56% of those complaints without investigation, the review found. The review also found that OCR has referred only 437 complaints, less than 2% of the total, to federal prosecutors. Abner Weintraub of the HIPAA Group said, "There are no HIPAA cops out there looking for violations," adding, "Enforcement at the Office for Civil Rights is virtually nonexistent. Technically, they've still not issued a single fine -- not even down to the $100 level, and they could toss those around like candy, if only to wake people up about the seriousness of compliance."
According to Weintraub, one of the main problems with enforcement of the rule is that health care providers do not have to report internal violations. "This is a tremendous loophole," he said, adding, "Enforcement is left to the health care community to sort of self-police itself, and to the Office of Civil Rights, which has done virtually nothing." Deborah Peel, head of Patient Privacy Rights, also said that the rule does not include adequate restrictions on cases in which providers can share the medical records of patients without their consent. Under the rule, "there is no real privacy right to be violated," she said, adding, "That's why we're not seeing any prosecutions."
OCR Response
According to Susan McAndrew, deputy director of health information privacy at OCR, the office has resolved 6,800 complaints through corrective action orders. She said, "We have found that this is the most effective way to obtain industry compliance with the privacy rule." In addition, McAndrew said, "OCR has investigated complaints against many different types of entities, including national pharmacy chains, major medical centers, group health plans, hospital chains and small-provider offices" (Kauffman, Des Moines Register, 8/17).
American Public Media's "Marketplace" on Friday examined companies that can sell medical records online despite the rule (Henn, "Marketplace," American Public Media, 8/15).
