Office for Civil Rights

Subscribe to Office for Civil Rights via RSS

HIPAA and $15 Million in 2016

By Joseph J. Lazzarotti on July 27, 2016

Posted in Data Security, Health Information Technology, HIPAA, Identity Theft, Information Risk, Written Information Security Program

For years, many questioned whether the HIPAA privacy and security rules would be enforced. The agency responsible for enforcement, Health and Human Services’ Office for Civil Rights (OCR), promised it would enforce the rules, but just after a period “soft” enforcement and compliance assistance. That period appears to be ending. During the first seven months…

Check Your Spam Filter, You Might Have Been Selected for a HIPAA Audit!

By Joseph J. Lazzarotti & Michael R. Bertoncini on March 22, 2016

Posted in Data Security, Health Information Technology, HIPAA, Information Management, Information Risk, Written Information Security Program

Yesterday, the federal Office for Civil Rights (OCR) announced Phase 2 of its HIPAA Audit Program (Program). In its announcement, the OCR reports that the Program is underway and provides some helpful FAQs for covered entities and business associates about the Program. Preparation is critical and there are some key points covered entities and business…

HIPAA Covered Entities Not Responsible For Intercepted Transmission of PHI When Individual Requested Unsecured Transmission, Office for Civil Rights Concludes

By Joseph J. Lazzarotti on February 28, 2016

Posted in Data Security, Health Information Technology, HIPAA, Written Information Security Program

Earlier this month, the Office for Civil Rights (OCR) issued guidance on an individual’s right to access the individual’s health information. That an individual has a broad right to access has been recognized in the HIPAA privacy regulations since they became effective in 2003. OCR has found, however, that individuals are facing obstacles to accessing…

Million Dollar HIPAA Settlements Are About Compliance, Not Harm to Individuals

By Joseph J. Lazzarotti on December 6, 2015

Posted in Data Security, Health Information Technology, HIPAA, Identity Theft, Information Management, Information Risk, Written Information Security Program

In the last two weeks, the Office for Civil Rights (OCR) announced two substantial settlements under HIPAA that together totaled $4.35 million. These large amounts seem to be driven not by actual harm to individuals, but in significant part by alleged HIPAA compliance failures identified by OCR following investigations commenced in response to receipt of…

HIPAA Phase 2 Audits to Start in Early 2016, OCR States In Response to OIG Recommendations

By Michael R. Bertoncini on October 19, 2015

Posted in Data Security, Health Information Technology, HIPAA, Information Risk, Written Information Security Program

Responding to a Department of Health and Human Services Office of Inspector General (OIG) report recommending stronger oversight of covered entities’ compliance with the HIPAA Privacy Rule, the Office for Civil Rights (OCR) stated that in early 2016 it will launch Phase 2 of its audit program measuring compliance with HIPAA’s privacy, security and breach…

HIPAA Audits Maybe, But Audit Preparedness Definitely!

By Joseph J. Lazzarotti on September 11, 2015

Posted in Consumer Privacy, Data Security, Health Information Technology, HIPAA, Information Risk, Online Privacy, Written Information Security Program

According to a Bloomberg article, the second phase of HIPAA audits by the Office for Civil Rights (OCR), originally set to commence in 2014, may be coming soon. This update came at a HIPAA conference co-hosted by OCR during which OCR Director Jocelyn Samuels said the agency was in the process of confirming contact…

Cancer Care Group to Pay $750,000 to Settle HIPAA Breach, as KPMG Finds 81 Percent of Hospitals and Health Insurance Companies had a Breach in the Past Two Years

By Joseph J. Lazzarotti on September 8, 2015

Posted in BYOD, Data Security, Health Information Technology, HIPAA, Identity Theft, Information Risk, Written Information Security Program

On September 2, the Office for Civil Rights (OCR) reported that it agreed to settle potential violations of the HIPAA privacy and security regulations with Cancer Care Group, Inc. The dollar amount of the settlement, $750,000, is significant, and the agreement to adopt a robust, multi-year corrective action plan under the watchful eye of the…

OCR Issues Ebola Guidance on HIPAA Privacy

By Joseph J. Lazzarotti on November 11, 2014

Posted in ADA, Health Information Technology, HIPAA, Information Management, Information Risk, Workplace Privacy, Written Information Security Program

According to the New York Times, Bellevue Hospital Center patient Craig Spencer, the first New Yorker to be infected with Ebola, is scheduled to be released today. And while the intense reporting about Ebola has subsided, perhaps indicating a lowering of the perceived threat of Ebola spreading further in the U.S. (although many continue…

HIPAA Privacy Rule Also Affected By Supreme Court’s DOMA Decision in U.S. v. Windsor

By Joseph J. Lazzarotti on September 17, 2014

Posted in HIPAA

When the U.S. Supreme Court decided United States v. Windsor, it declared section 3 of the Defense of Marriage Act (DOMA) to be unconstitutional. For many companies, the decision meant changes to certain of their employee benefit plans, as well as the tax treatment of employee contributions for same sex spouses. However, declaring section…

HIPAA Reminders – Business Associate Agreement Deadline and Continuation of OCR Audits

By Joseph J. Lazzarotti on September 15, 2014

Posted in Data Security, Health Information Technology, HIPAA, Information Management, Information Risk, Workplace Privacy, Written Information Security Program

I recently had the pleasure of speaking to a great group at the Connecticut Assisted Living Association (CALA) about HIPAA and a range of related practical issues. Many covered entities and business associates, particularly those that are small businesses, continue to work on understanding the privacy and security standards, and how to best apply them…

Workplace Privacy, Data Management & Security Report