Health Information Compliance Alert

The latest enforcement update comes with some words of wisdom from HHS

 Ring ... ring! You answer the phone and an investigator with HHS' Office for Civil Rights is on the horn. What you say and do during this phone call could mean the difference between a slap on the wrist and a visit from OCR's investigators.
 

Enforcement Update:  

As of Jan. 12, there have been more than 3,900 privacy rule complaints submitted to OCR. That number has risen from 3,700 complaints since the end of 2003.
 
Roughly 40 percent of all complaints have been resolved.

No civil monetary penalties have been imposed thus far.

While statistics are always interesting, what's ultimately of greater value is knowing what to do if you receive a call from OCR. Here's a bit of advice that could wind up saving you from an on-site investigation: 
 
Answer All Correspondence ASAP: In cases for which OCR suspects an entity of a violation, the enforcement agency will make direct, verbal contact with your organization. Make sure you get in touch with OCR immediately upon receiving their message, advises William Pierce, a spokesperson with HHS. If you receive a message from OCR, contacting them immediately to address the complaint will earn you some good credibility. 
 
Don't Panic - Just Cooperate: The worst thing you can do if you receive a call from OCR is panic. Sure, it'd be frustrating to receive a call like this, but remember: OCR knows that sometimes a violation sent by an angry patient really isn't a privacy rule violation at all. The agency's first goal is to determine what violation, if any, occurred.

If a violation did happen, they want to know why. The best thing you can do is answer OCR's questions as honestly and as fully as possible. After that OCR will work with you to fix any problems and to ensure that a privacy breach doesn't occur again. After all, the complaint could've arisen from "a simple mistake or error - or it could be a lack of knowledge [about the privacy rule]," says Pierce.

Also, keep in mind that OCR must show "clear cause and motivation" when it submits a complaint to the DOJ. As long as you cooperate with the agency and answer all of the investigator's questions, you shouldn't have to worry about any on-site investigations, much less incurring a fine, assures Pierce.

Straight From The Source: Pierce sums up OCR's enforcement goals with some advice for covered entities: "What [OCR] really wants to do is, they want you to know what the rule is - to know what you're supposed to do - and to implement it. Remember: "The ultimate goal of the privacy rule is to protect an individual patient's medical records. Everyone shares that goal. Nobody's working at cross-purposes here," Pierce tells Eli.