Posted by: Robert Markette
May 13, 2008
Topic: HIPAA - Privacy

The Department of Health and Human Services Office of Civil Rights (“OCR”) has added a new page to its website.  (Or at least updated an existing page.)  Interested people can now look up enforcement statistics at OCR’s website here.   Statistics they are tracking include number of complaints by year, number of complaints by state, a break down of resolutions each year, and the top 5 issues investigated each year.

One interesting fact from the website, not surprisingly, the number of complaints has gone up each year since HIPAA went into effect.  Last year, the number of complaints hit an all time high of 8,132 complaints.  That is up 800 from the year before.  The only bigger jump is between 2003 and 2004, of course you would expect to see a big jump there, because 2003 was a partial year.

It is interesting to look at these statistics, especially as Congress is considering major changes to HIPAA.   (The Health Information Privacy and Security Act is currently winding its way through Congress.)  Part of the motivation to amend HIPAA is a mistaken belief that HIPAA does not provide enough protection to individuals.  This is a result of the major security breaches that are reported on the news about once a quarter or so.

However, OCR’s statistics show a much larger number of complaints investigated and resolved without the need for corrective action.  On average, the charts (which do not contain a great deal of explanation) appear to say that corrective action was pursued in about 20% of the cases.  That would indicate that in 80% of the complaints, the providers were not doing anything wrong.  Within the 20% of cases where corrective action was obtained, it does not indicate how severe the violations were or how expansive the corrective action was. 

This would be interesting to know, because if the majority of the violations were not severe this would combine with the large number of complaints in which no violations was found to indicate that Congress does not need to overhaul HIPAA to provide more stringent protections and steeper penalties.  If the providers are complying under the current regime, why create a bigger stick to threaten them with. 

It is also interesting to note that the statistics show no fines or other penalties have been assessed against providers for violations.  At least for now, getting providers into compliance instead of punishing them appears to be OCR’s enforcement policy.  (A policy which I think makes a lot more sense.)

Admittedly, the data reported is relatively Spartan, but if you are interested in what OCR has been doing with HIPAA the last few years, this is an interesting site.

News

Health Care

[07/02] UnitedHealth cuts 4,000 jobs and 2008 outlook
[07/02] US contradicts itself over its own ID theft advice
[07/02] Center for medical intelligence expanding
[07/02] Salmonella probe adds foods served with tomatoes
[07/01] Dueling ads pressure Congress on Medicare
[06/26] Fidelity: $85k needed for long-term care costs
[06/25] Health insurance lags most in Southwest, CDC says
[06/24] Jury begins deliberating in Ky. diet drug case
[06/11] Why did food sellers treat tomatoes like hot potatoes?
[06/10] Tomatoes pulled off shelves amid salmonella scare
Read More

Web Resources

FindLaw
Thomson West
U.S. Courts
Westlaw
United States Chamber of Commerce
FirstGov
Legislative Branch
Library of Congress
White House
Internal Revenue Service
National Weather Service
Yahoo!Maps
YellowPages.com
New York Times
Newspapers Online
USA Today
Wall Street Journal
AOL
Google
Yahoo!Legal Blog Directory