Health Insurance Portability and Accountability Act – Year in Review

4,750 Complaints filed in first year

The Office of Civil Rights has received during the first year since the Privacy Rule’s compliance date (April 14, 2003) 4,750 complaints.  Complaints have most often dealt with the improper use and disclosure of protected health information; a health care provider’s refusal to give a patient access to his/her medical records; allegations that more information was disclosed than was necessary; and failure to provide privacy notices to patients.

The Office of Civil Rights is charged with enforcing the HIPAA Privacy Rule.  Its current approach is to attempt resolution of privacy complaints informally at first and then, if necessary, to assess fines.  Penalties can be imposed on people who knew or should have known that they were violating the Privacy Rule.