How OCR Investigates a Health Information Privacy and Security Complaint

The Office for Civil Rights (OCR) investigates complaints related to violations of health information privacy and security, particularly under the HIPAA Rules. This process involves a thorough review of the submitted complaint, an investigation into whether a covered entity or business associate has failed to comply with HIPAA requirements, and, if necessary, the imposition of civil money penalties (CMPs). While there is no direct patient fee for filing a complaint or for the investigation itself, indirect costs may arise for healthcare providers or organizations found non-compliant. For patients and consumers, it’s important to understand the scope of OCR’s authority and to request itemized documentation if you are involved in a case, to ensure transparency regarding any potential charges or administrative actions.

Cost Breakdown

• Consumer/Patient Costs: There is no fee for filing a HIPAA complaint or for the OCR’s investigation process.
• Provider/Entity Costs: Entities found non-compliant may incur costs related to corrective actions, potential civil money penalties, and increased administrative oversight.
• Legal/Administrative: Covered entities have the right to a hearing if CMPs are imposed, which may involve legal representation costs.

Associated Costs

• Legal consultation fees for entities or associates responding to an OCR investigation.
• Potential costs for implementing corrective measures (e.g., staff training, updated security systems).
• Possible increases in liability insurance premiums for organizations with HIPAA violations.

Insurance & Payment Advice

• Patients do not need insurance or payment to file a complaint with OCR.
• Healthcare providers should review their insurance coverage for legal and administrative costs related to HIPAA investigations.
• Request itemized estimates from legal or compliance consultants if you are a provider facing an investigation.

Frequently Asked Questions

• What is the OCR’s role in health information privacy? The OCR investigates complaints regarding violations of health information privacy and security, primarily enforcing the HIPAA Rules.
• Is there a fee for filing a HIPAA complaint with the OCR? No, there is no fee for consumers to file a complaint regarding privacy or security of health information.
• What happens if a healthcare provider is found non-compliant? If a provider or business associate is non-compliant, they may have to take corrective action and could face civil money penalties if issues are not resolved.
• Can a provider dispute a penalty imposed by the OCR? Yes, the provider may request a hearing before an HHS administrative law judge to contest the civil money penalties.
• Will patients ever be billed for an OCR investigation? No, patients are not billed for OCR investigations or for filing a HIPAA complaint.
• What types of costs might healthcare providers incur due to an OCR investigation? Providers may incur costs for legal representation, corrective action implementation, and possible civil money penalties.
• Does the OCR provide itemized documentation of investigation outcomes? Yes, at the conclusion of the investigation, the OCR issues a letter describing the resolution and actions required, if any.
• Are there indirect costs for patients involved in a privacy complaint? There are no direct costs, but patients may want to track any related personal expenses, such as time taken off work or travel for meetings, though these are generally minimal.
• How can providers prepare for a potential OCR investigation? Providers should maintain thorough documentation, regularly train staff on HIPAA compliance, and ensure robust data security practices.
• What corrective actions may be required if a violation is found? Corrective actions can include staff education, policy updates, system security enhancements, and regular compliance audits.

OCR carefully reviews all health information privacy and security complaints. Under the law, OCR only may take action on complaints if:

• Your rights were violated by a covered entity or business associate
• You file your complaint within 180 days of the violation

What Happens After the Investigation

At the end of the investigation, OCR issues a letter describing the resolution of the investigation.

If OCR determines that a covered entity or business associate may not have complied with the HIPAA Rules, that entity or business associate must:

• Voluntarily comply with the HIPAA Rules
• Take corrective action
• Agree to a settlement

If the covered entity or business associate does not take satisfactory action to resolve the matter, OCR may decide to impose civil money penalties (CMPs) on the covered entity. If CMPs are imposed, the covered entity may request a hearing in which an HHS administrative law judge decides if the penalties are supported by the evidence in the case.