Investigation finds OCR levies few HIPAA fines
The Department of Health and Human Services' (HHS) Office for Civil Rights (OCR) has rarely levied financial penalties against healthcare organizations that have reported breaches of patient privacy.
According to a ProPublica investigation, OCR levied just 22 fines since October 2009 even though there were more than 1,140 large breaches affecting more than 41 million people and more than 120,000 small breaches affecting fewer than 500 people each.
The investigation also found that OCR sometimes takes several years to levy those few fines.
Some industry experts say OCR could be doing more but others says the agency is trying balance enforcement of the law with helping healthcare organizations improve their security.
OCR issed a statement saying that it "agressively" investigates "high-impact cases that send strong enforcement messages about important compliance issues" and that most cases involving fines "involved systemic and/or long-standing" issues.
Editor
Editor Beth earned a bachelor’s degree in journalism and master’s in health communication. She has worked in hospital, academic and publishing settings over the past 20 years. Beth joined TriMed in 2005, as editor of CMIO and Clinical Innovation + Technology. When not covering all things related to health IT, she spends time with her husband and three children.