The HHS Office for Civil Rights (OCR) reported that it received 651 complaints in its HIPAA privacy enforcement program in July for a total of 53,789 since enforcement began in April 2003.

That was half the number it received in June when it received 1,376. In May, it received 652.

The large swing in the number of privacy complaints in June may have been due to the processing of the first annual batch of breach reports affecting less than 500 patients by covered entities.

Of the 17,381 complaints that have fallen within OCR’s jurisdiction, 11,421 required corrective actions by a covered entity (CE).

In other words, the agency reported that it determined that in July 250 addition complaints fell within its jurisdiction and required CE action. In June, it added 321 complaints; in May, it added 207.

Overall, about 21.2% of complaints resulted in some corrective action by a CE. The remaining 5,960 complaints did not uncover a HIPAA violation.

About 34% of the agency investigations did not uncover a HIPAA privacy violation.

The agency also revealed that it had resolved more than 90% of all the complaints it had received.

However, that number included the large number of complaints not within HHS’s jurisdiction.

After more than six years, HHS has not yet imposed a civil monetary penalty. HHS pointedly did not impose civil monetary penalties in its agreements with Providence Health or with CVS Caremark (08/08 HIP/SA, p.1; 02/09 HIP/SA, p.1) or with Rite Aid (see story, p. 8)

It referred more than 474 cases to the Justice Department for possible criminal prosecution. That suggested the agency made three referrals in July.

Referrals to the Justice Department do not necessarily mean that a criminal investigation will be initiated. Instead, it meant that OCR determined that these cases deserved assessment by federal prosecutors.

To date, there has been little evidence suggesting that HIPAA complaints to OCR have prompted any criminal prosecutions by the Justice Department.

Typically, the Justice Department has invoked HIPAA charges only after it had already sought the prosecution of an individual under other federal laws.