When HITECH required breach reporting, there was an expectation that patient HIPAA complaints would increase after Sept. 23, 2009, when covered entities were required to report incidents affecting more than 500 patients after that date.

More complaints also were expected because of requirements to notify patients of breaches affecting fewer than 500 patients as well. As of April 15, there have been 79,000 reports of small breaches.

While the number of HIPAA privacy complaints has risen generally; the breach reporting has not had a significant affect, according to OCR Deputy Director Sue McAndrew. Presenting at the April 17 Melamedia webinar, A Decade of HIPAA Enforcement, McAndrew observed that few patient complaints are resulting from the federal breach reporting rules, although the agency has received an occasional complaint generated by state breach notification rules.

She suggested that covered entities may be doing a good job of explaining the breaches and their implications to patients. In turn, patients have felt little need to submit a HIPAA privacy complaint.

Meanwhile, health data breaches involving more than 500 patients rose to 571 from 543 as OCR posted 28 new breaches, according to a HIP/SA analysis of agency data from March 18 through April 17. The number of affected patients of the major breaches rose modestly to 21,744,113 from 21,516,294.

BA's were involved in 11 of the 28 newly reported breaches.

The full analysis of the health data breaches is available in Health Information Privacy/Security Alert.

Funds that OCR receives from its resolution agreements are plowed back into enforcement, OCR Deputy Director Sue McAndrew said in an April 17 Melamedia webinar. The sequestration may affect the agency's appropriation from Congress, but the funds from the fines and penalties are treated differently.

That arrangement could provoke fears that the agency may try to offset sequestered funds with more penalties. However, that is unlikely, in part, because if OCR demonstrates that it can survive off fines in some fashion, Congress is likely to cut its annual appropriations further.

Even more significantly, such a strategy could compromise public support for the enforcement effort.
Meanwhile, OCR reported it received 79,920 complaints, suggesting that it received 1,049 complaints in March. It received 994 in February after receiving 686 in January. The statistics suggest that OCR is finding more problems with CEs in recent months.

OCR stated recently that the higher levels of enforcement were not attributable to increased breach reporting under HITECH.

Of the 27,973 HIPAA complaints that fell within OCR's jurisdiction, 19,306 required corrective actions by covered entities (CEs).

An analysis by HIP/SA found that the agency determined that 379 complaints required CE action in March compared to 216 in February and 152 in January.

The remaining 9,146 complaints within OCR's jurisdiction found no violation.

The agency said it had resolved more than 91% of all the complaints that it had received. However, that statistic included a large number of complaints (44,118) that did not fall within HHS's jurisdiction.
OCR's numbers indicated that it had 7,350 complaints in some phase of the investigative process in March compared to 7,316 complaints in February and 7,077 in January.

Overall, about 26.6% of total complaints resulted in some corrective action by CEs.

OCR referred more than 515 cases to the Justice Department for possible criminal prosecution. That indicated the agency made one referral in February. It made five referrals in January and six referrals in December.

.The privacy areas investigated most often were:

OCR released a memo to the public reminding them and the healthcare community, that patients are entitled to access to their medical records at reasonable costs.

OCR said that it received 691 complaints alleging a security rule violation since Oct. 1, 2009 when it took over security enforcement from CMS. That suggested it received 23 complaints in March compared to 18 complaints in February and 11 complaints in January.

OCR closed 499 complaints after investigation and corrective action. That indicated that OCR closed 11 complaints in March compared to three cases in February and 18 in January.

The agency also reported that it had 271 open complaints in February compared to 258 in February and 238 in January.