Turning 7, HIPAA Tops 51,000 Privacy Complaints
The Office for Civil Rights released its HIPAA enforcement data for April, offering a snapshot of the complaints logged in the seven years of the privacy rule.
Since April 2003, when the privacy rule took effect, through April 2010, OCR has received 51,762 complaints. Of those, it has resolved more than 46,000 (89 percent).
Not all resolutions required an investigation. Of the more than 16,000 cases that did, OCR obtained corrective action on two thirds. No violations were found in the remaining one third.
The number of complaints received per year peaked in 2008 at 8,701. That was up from 6,541 in the first full year of the rule. Slightly more than 7,500 complaints were received in 2009. Total resolutions also peaked in 2008, at just over 9,000. As shown in the graph below, resolutions finally topped complaints in 2008 and remained that way in 2009.
Impermissible uses and disclosures were the most frequent violation in 2009, as they had been since 2004. Following in order were violations of safeguards, access, and minimum necessary, also consistent with past years.
Enforcement of the HIPAA security rule transferred to OCR in July 2009. Since the office began reporting its enforcement results in October, it has received 82 complaints. It has closed 40 complaints and had 119 open complaints and compliance reviews as of April 30.