Privacy Complaints Remain High in December

The HHS Office for Civil Rights (OCR) reported it received more than 66,736 complaints, suggesting that it received 821 complaints in December. It received 874 complaints in November and 915 in October.

The overall level of complaints in the 800-plus range in the last few months suggest that OCR may be consistently receiving complaints at a higher level per month than in previous years. The increase in complaints could be the result of more alerts by covered entities to their patients that breaches have occurred. Nothing stops a patient from filing a complaint upon being informed of a breach by a covered entity.

Of the 23,070 HIPAA complaints that fell within OCR’s jurisdiction, 15,176 required corrective actions by covered entities (CEs).

An analysis by HIP/SA found that the agency determined that an additional 251 HIPAA complaints required actions by covered entities in December. In November, 157 covered entities had to make changes and 241 covered entities made changes in October.

The remaining 7,725 complaints within OCR’s jurisdiction found no violation.

The agency said it had resolved more than 91% of all the complaints it had received. However, that statistic included a large number of complaints (37,275) that did not fall within HHS’s jurisdiction.

Overall, about 23% of total complaints resulted in some corrective action by CEs.

The statistics do not reflect investigations that OCR initiated on its own in response to the tens of thousands of smaller incidents reported by CEs under the HITECH breach notification rules.

OCR referred more than 499 cases to the Justice Department for possible criminal prosecution. That suggested the agency made no referrals in December.

The Justice Department has not calculated how many of the referrals have resulted in action or how many had been returned to OCR. It told a Senate panel in November that it would start work on specifically tracking how many of these referrals were pursued.

However, in recent months, the Justice Department has shown more interest in using HIPAA as a criminal enforcement tool as the FBI and federal prosecutors become more comfortable with the law – particularly after the HITECH Act clarified that the criminal penalties do apply to individuals and not only to covered entities.

The privacy areas investigated most often were: