Health Information Compliance Alert

Read the situation below and decide how you would handle it before you compare it to our expert's advice.

Question: We're adding to our privacy compliance handbook a section on how to respond to a phone call from an investigator with HHS' Office for Civil Rights. What should we include in our instructions?

Answer: If the OCR suspects an entity of a violation, the enforcement agency will make direct, verbal contact with your organization. Make sure you get in touch with the OCR immediately upon receiving their message, advises William Pierce, a spokesperson with HHS. If you receive a message from the OCR, contacting them immediately to address the complaint will earn you some good credibility.

Don't panic -- just cooperate: The worst thing you can do if you receive a call from OCR is panic. Sure, it'd be frustrating to receive a call like this, but remember: OCR knows that sometimes a violation sent by an angry patient really isn't a privacy rule violation at all. The agency's first goal is to determine what violation, if any, occurred.

If a violation did happen, they want to know why. The best thing you can do is answer OCR's questions as honestly and as fully as possible. After that OCR will work with you to fix any problems and to ensure that a privacy breach doesn't occur again. After all, the complaint could've arisen from "a simple mistake or error -- or it could be a lack of knowledge [about the privacy rule]," says Pierce.

Also, keep in mind that OCR must show "clear cause and motivation" when it submits a complaint to the DOJ. As long as you cooperate with the agency and answer all of the investigator's questions, you shouldn't have to worry about any on-site investigations, much less incurring a fine, assures Pierce.

Straight from the source: Pierce sums up OCR's enforcement goals with some advice for covered entities: What OCR really wants is for you to know what you're supposed to do and to implement it.

Remember: "The ultimate goal of the privacy rule is to protect an individual patient's medical records. Everyone shares that goal. Nobody's working at crosspurposes here," Pierce says.