Health Information Compliance Alert

Question: We're adding to our privacy compliance handbook a section on how to respond to a phone call from an investigator with HHS' Office for Civil Rights (OCR). What should we include in our instructions?

Answer: If the OCR suspects an entity of a violation, the enforcement agency will make direct, verbal contact with your organization. Make sure you get in touch with the OCR immediately upon receiving their message, advises an HHS spokesperson. If you receive a message from the OCR, contacting them immediately to address the complaint will earn you some good credibility.

Don't panic -- just cooperate: The worst thing you can do if you receive a call from OCR is panic. Sure, it'd be frustrating to receive a call like this, but remember: OCR knows that sometimes a violation sent by an angry patient really isn't a privacy rule violation at all. The agency's first goal is to determine what violation, if any, occurred.

If a violation did happen, they want to know why. The best thing you can do is answer OCR's questions as honestly and as fully as possible. After that, OCR will work with you to fix any problems and to ensure that a privacy breach doesn't occur again. After all, the complaint could've arisen from a simple mistake or error -- or it could be a lack of knowledge [about the privacy rule], says HHS.

Also, keep in mind that OCR must show "clear cause and motivation" when it submits a complaint to the Department of Justice (DOJ). As long as you cooperate with the agency and answer all of the investigator's questions, you shouldn't have to worry about any onsite investigations, much less incurring a fine, the HHS assures.

Straight from the source: Pierce sums up OCR's enforcement goals with some advice for covered entities: What OCR really wants is for you to know what you're supposed to do and to implement it. Remember: "The ultimate goal of the privacy rule is to protect an individual patient's medical records. Everyone shares that goal.

Nobody's working at cross-purposes here," the HHS spokesperson tells Eli.