Department of Health and Human Services 
OFFICE OF 
 
INSPECTOR GENERAL 
 
 
 
 
 
 
OCR S S
  HOULD  TRENGTHEN 
 
 
I F  
TS  OLLOWUP OF 
 
 
B P
REACHES OF  ATIENT 
 
 
H I
EALTH  NFORMATION 
R C
EPORTED BY  OVERED 
E  
NTITIES 
 
Suzanne Murrin 
Deputy Inspector General for 
Evaluation and Inspections 
 
September 2015 
OEI-09-10-00511   
   
EXECUTIVE SUMMARY:  OCR SHOULD STRENGTHEN ITS FOLLOWUP OF BREACHES 
OF PATIENT HEALTH INFORMATION REPORTED BY COVERED ENTITIES  
OEI-09-10-00511 
 
WHY WE DID THIS STUDY  
 
Recent news illustrates that a data breach can affect millions of individuals.  Breaches of protected health 
information (PHI)such as patients names, test results, medical conditions, prescriptions, or treatment 
historiescould expose patients to privacy invasion, fraud, identity theft, and/or other harm.  The Breach 
Notification Rule of the Health Insurance Portability and Accountability  Act (HIPAA), along with  
HIPAAs Privacy and Security Rules, established HIPAA standards that aim to safeguard PHI.  The 
Breach Notification Rule requires that covered entities report breaches of unsecured PHI to the Office for 
Civil Rights (OCR). OCRs oversight of covered entities compliance with the HIPAA standards is 
critical to help ensure that covered entities address the problems that led to breaches.  
 
HOW WE DID THIS STUDY  
 
To assess OCRs oversight of covered entities that reported breaches, we (1) reviewed a statistical sample 
of large breaches (i.e., breaches affecting 500 or more individuals) and small breaches (i.e., breaches 
affecting fewer than 500 individuals) that covered entities reported to OCR from September 2009 
through March 2011; (2) surveyed OCR staff; and (3) interviewed OCR officials. We also reviewed 
OCRs investigation policies. We surveyed a statistical sample of Medicare Part B providers and 
reviewed documents that they provided to determine the extent to which they addressed three selected 
breach administrative standards.  
   
WHAT WE FOUND 
 
OCR should strengthen its followup of breaches of PHI reported by covered entities.  OCR investigated 
the large breaches, as required, and in almost all of the closed large-breach cases, it determined that 
covered entities were noncompliant with at least one HIPAA standard.  Although OCR documented 
corrective action for most of the closed large-breach cases in which it made determinations of 
noncompliance, 23 percent of cases had incomplete documentation of corrective actions taken by covered 
entities. OCR also did not record small-breach information in its case-tracking system, which limits its 
ability to track and identify covered entities with  multiple small breaches.  Although 61 percent of OCR 
staff checked at least sometimes as to whether covered entities had reported prior large breaches,  
39 percent rarely or never did so.  If OCR staff wanted to check, they may face challenges because its 
case-tracking system has limited search functionality and OCR does not have a standard way to enter 
covered entities names in the system.  Finally, from  our review of the documents that Medicare Part B 
providers submitted, most addressed all three selected breach administrative standards but 27 percent did 
not. These providers may not be adequately safeguarding PHI. 
 
WHAT WE RECOMMEND   
 
OCR should (1) enter small-breach information into its case-tracking system or a searchable database 
linked to it; (2) maintain complete documentation of corrective action; (3) develop an efficient method in 
its case-tracking system to search for and track covered entities that reported prior breaches; (4) develop a 
policy requiring OCR staff to check whether covered entities reported prior breaches; and (5) continue to 
expand outreach and education efforts to covered entities.  OCR concurred with all five recommendations 
and described its activities to address them.   
 
 
   
   
TABLE OF CONTENTS 
 
Objectives ....................................................................................................1 

Background..................................................................................................1 

Methodology................................................................................................5 

Findings........................................................................................................8 

OCR investigated all large breaches, as required; however,  

OCR did not record small-breach information in its  

case-tracking system, which limits its ability to track and  

identify covered entities with multiple small breaches ....................8 

In almost all of the closed large-breach cases, OCR determined  

that covered entities were noncompliant with at least one  

HIPAA standard ...............................................................................9 

OCR documented corrective action for about three-quarters of 

closed large-breach cases in which it made determinations of 

noncompliance; however, 23 percent of cases had incomplete 

documentation ..................................................................................9 

Sixty-one percent of OCR staff checked at least sometimes as  

to whether covered entities had reported prior large breaches;  

however, 39 percent rarely or never did so ....................................10 

OCRs case-tracking system has limited search functionality  ......11 
 
Almost three-quarters of Part B providers addressed all three 

selected breach administrative standards; however, 27 percent  

of Part B providers did not.............................................................11 
 
Conclusion and Recommendations ............................................................13 

Agency Comments.........................................................................15 

Appendixes ................................................................................................16 

A: Detailed Methodology .............................................................16 

B: Point Estimates and Confidence Intervals................................21 

C: Agency Comments  ...................................................................23 

Acknowledgments......................................................................................26 

   
 
 
   
OBJECTIVES 
1. 	  To assess the Office for Civil Rights (OCR) oversight of covered 
entities that reported breaches of protected health information (PHI).  
2. 	  To determine the extent to which Medicare Part B providers addressed 
three selected breach administrative standards.  
BACKGROUND 
The Health Insurance Portability and Accountability Act (HIPAA) 
includes the Breach Notification Rule, Privacy Rule, and Security Rule.1   
These rules established breach, privacy, and security standards, which aim 
to safeguard health information.  We  collectively refer to these standards 
as HIPAA standards.  In general, the Breach Notification Rule requires 
that covered entitiessuch as doctors, pharmacies, and health insurance 
companiesmake certain notifications when they discover a breach of 
unsecured protected health information (PHI)2 and follow standards that 
safeguard PHI. A breach of unsecured PHI is the unauthorized access or 
use of individually identifiable health information that has not been 
destroyed or rendered indecipherable.3  
OCR is responsible for overseeing covered entities compliance with the 
HIPAA standards, including the Breach Notification Rule.  OCR oversight 
is critical given the increased use of health information technologies, such 
as electronic health records, and the potential for breaches that may result 
in an invasion of privacy, identity theft, or other fraud.  In a report to 
Congress, covered entities reported to OCR more than 78,000 breaches 
 
1 The Breach Notification Rule was established by the Health  Information Technology  
for Economic and Clinical Health Act (HITECH Act), which was enacted as part of the 
American Recovery and Reinvestment Act of  2009, P.L. No. 111-5.  45 CFR pt. 164, 
subpt. D.  The Privacy Rule establishes national standards to  protect individuals medical 
records and other personal  health information.  An example of a privacy standard is  
safeguarding health information by  using locks and keys to  secure medical records.   
45 CFR  pt. 164, subpt. E.  The Security Rule establishes national standards to  protect  
individuals electronic personal health information.  An example of a security standard is  
properly disposing of electronic media or devices that maintain  health information.   
45  CFR pt. 164, subpt. C.    
2 Unsecured PHI is individually identifiable health information (in electronic, oral, or  
paper form) that has not been rendered unusable, unreadable, or indecipherable to  
unauthorized persons through the use of  encryption or destruction such as shredding.   
Examples of PHI include an individuals name, Medicare number, or medical history.    
45  CFR  160.103.    
3 HITECH Act,   13400(l).   
 
OCR Should Strengthen Its Followup of Breaches Reported by  Covered Entities (OEI-09-10-00511)  1 
 
   
   
from when the Breach Notification Rule went into effect in 
September 2009 to the end of 2012.4  
Covered Entities 
The Breach Notification Rule applies  to three types of covered entities.5   
Covered entities are defined as (1) health plans, (2) health care 
clearinghouses, and (3) health care providers that transmit health 
information in electronic form in connection with a HIPAA-covered 
transaction.6  Health plans are individual or group plans that provide or 
pay for medical care, and include governmental plans, such as Medicare 
and Medicaid.7  Health care clearinghouses include businesses that process  
or help to process health information received from another covered entity,  
as well as businesses that receive HIPAA-covered transactions from  
another covered entity.8  Examples of health care clearinghouses are 
companies that provide services related to billing, claims processing, or 
the management of health information.  Health care providers include 
individual practitioners (including those who participate in the Medicare 
and Medicaid programs), hospitals, and pharmacies.9  
Breach Notification Rule Standards for Covered Entities 
Covered entities must comply with standards established in the Breach 
Notification Rule (breach standards).   The breach standards include 
notification standards and administrative standards, and apply to breaches 
occurring on or after September 23, 2009. 
The notification standards require that, in the event of a breach, covered 
entities notify individuals affected by the breach, the Secretary of Health 
and Human Services, and the media.10, 11  Covered entities must provide 
written notification to individuals affected by the breach without 
unreasonable delay and in no case later than 60 days after discovery of the 
 
4 74 Fed. Reg. 4274042770  (Aug. 24, 2009).  OCR, Annual Report to Congress on 
 
Breaches of  Unsecured Protected Health  Information For  Calendar Years 2011  and
  
2012.  Accessed at http://www.hhs.gov/ocr/privacy/hipaa/administrative/ 
 
breachnotificationrule/breachreport2011-2012.pdf on  June 19, 2015. 
 
5  The Breach Notification Rule also applies to covered entities business associates. A 

business associate is a person  or entity that performs certain functions  or activities that 

involve the use or  disclosure of PHI on  behalf  of, or  provides services to, a covered 

entity.  45 CFR   160.103.  

6  HIPAA-covered transactions generally consist of  billing and  payments for services or 
 
insurance coverage.  Examples of  HIPAA-covered transactions include patient 
 
enrollment, claims, benefits, and eligibility inquiries.  42 U.S.C. 1320d-2(a)(2).  

7  45  CFR  160.103.  

8 Ibid. 

9 Ibid.  Social Security Act,  1172(a)(3), 42  U.S.C. 1320d-1(a)(3). 

10  45 CFR pt. 164, subpt. D.   

11 The notification standards also  require business associates (see footnote 5) to notify 

covered entities of a breach. 

 
OCR Should Strengthen Its Followup of Breaches Reported by  Covered Entities (OEI-09-10-00511)    2  
   
   
   
breach.12  They must also notify the Secretary of Health and Human 
Servicesvia OCRof any breaches affecting 500 or more individuals 
(large breaches) without unreasonable delay,13 and annually notify OCR of 
any breaches affecting fewer than 500 individuals (small breaches).14 In 
the event of a large breach, covered entities must also notify prominent 
media outlets.15  
The breach administrative standards outline covered entities  
responsibilities for safeguarding PHI.  These standards address when and 
how covered entities can use, share, and disclose PHI, and how covered 
entities should secure PHI.16  
OCR Oversight of Covered Entities 
OCRs oversight of covered entities depends primarily on covered entities  
self-reporting of breaches.  OCRs oversight role also includes responding  
to complaints, tips, or media reports about breaches.  Pursuant to OCR 
policy, OCR must investigate large breaches but is not required to 
investigate small breaches.  Also, the HITECH Act requires OCR to offer 
guidance and education to covered entities on their rights and 
responsibilities related to privacy and security standards that aim to 
prevent breaches of PHI.17  
OCR Investigation of Breach Cases.  OCR may open a breach case after a 
covered entity reports a breach to OCR.  The breach report includes 
information such as the covered entitys name; the type of covered entity; 
the estimated number of individuals affected by the breach; the type of 
breach (e.g., theft, hacking, or unauthorized access); and any corrective 
action taken by the covered entity in response to the breach.  OCR verifies 
this information and then initiates its breach investigation.  
OCR has discretion on how to investigate breach cases and the techniques  
it uses include, but are not limited to, conducting interviews, document 
reviews, and onsite visits.18  During its investigation, OCR determines the 
cause of the breach and whether the covered entity complied with the 
HIPAA standards.  It may check whether a covered entity reported prior 
 
12 45 CFR   164.400 and 164.404. 
  
13 45 CFR   164.408.  For large breaches, covered entities must notify the Secretary of 

Health and Human Services without unreasonable delay and in  no case later than  60 days 

following the breach. 

14 OCR requires covered entities to maintain a log  or other documentation of any small 

breaches and to submit the information to OCR no later than  60 days after the end of the 

calendar year during which the breaches  were discovered.  45 CFR  164.408. 

15 45 CFR   164.406.  
   
16  45  CFR  164.414.  
 
17  HITECH Act,  13403.  

18  45  CFR  160.310(c)(1).  
 
 
OCR Should Strengthen Its Followup of Breaches Reported by  Covered Entities (OEI-09-10-00511)    3  
   
   
   
breaches. When appropriate, OCR may provide technical assistance to 
covered entities.  This technical assistance may include, but is not limited 
to, helping the covered entity understand the HIPAA standards.19  
OCR Resolutions of Breach Cases.   After OCR investigates, it may resolve 
a breach case with a determination of no violation of HIPAA standards, or,  
if there is an indication of noncompliance with standards, by requesting 
that the covered entity take corrective action.20   A determination of no 
violation means that OCR did not identify a violation of the standards or 
that the evidence was insufficient to make a determination of a violation.  
A determination that the covered entity should take corrective action 
indicates that the covered entity may not have complied with at least one 
HIPAA standard.  Corrective action can include retraining staff on existing 
PHI policies, revising policies, and training staff on these new policies.  
Because OCR may investigate more than one standard per breach case, a 
single investigation can result in multiple determinations.   
OCR may also resolve a breach case by entering into a resolution 
agreement with the covered entity.21  Resolution agreements typically 
require that the covered entity take corrective action.  In more serious 
circumstances, OCR may impose a civil monetary penalty (CMP) on a 
covered entity.22, 23  In determining a CMP amount, OCR may consider, 
among other factors, whether the current breach was similar to other 
breaches reported by the covered entity, or if the covered entity has a 
history of noncompliance with the HIPAA standards.24    
If OCR makes a determination that the covered entity did not violate the 
HIPAA standards, OCR may close the case.  If OCR makes a 
determination of noncompliance, it may request that the covered entity 
take appropriate corrective action. OCR would then close the case after it 
concludes that the covered entity has taken such action. 
 
19 45  CFR  160.304(b).  
  
20  45  CFR  160.312.  
 
21 A resolution agreement is a contractsigned  by OCR and  a covered entityin which 

the covered entity agrees to perform certain  obligations (e.g., staff training) and to submit 

progress reports to OCR, generally for a period of  3 years.  OCR, Resolution Agreements. 

Accessed at http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/index.html on 

June 5, 2015.  

22 For example, OCR may impose a CMP if a covered entity fails to implement all of the 

corrective actions or was uncooperative with the investigation.  

23 45 CFR pt. 160, subpt. D. 
 
24 45 CFR   160.408.  
  
 
OCR Should Strengthen Its Followup of Breaches Reported by  Covered Entities (OEI-09-10-00511)    4  
   
   
   
OCR Program Information Management System  
OCR staff use the Program Information Management System (PIMS) to 
electronically document their investigation of breach cases.25  Specifically, 
they use this case-tracking system to record (1) action that OCR staff and 
the covered entity take, (2) evidence gathered during the investigation, 
(3) OCRs determinations, and (4) any supporting documents that OCR 
receives from the covered entity.  OCRs policy is to ensure that staff  
include in PIMS the documentation of covered entities  corrective action.  
OCR staff can also use PIMS to search for prior breaches or other 
HIPAA-related investigations of covered entities. 
Related OIG Work  
This report is part of the Office of Inspector Generals (OIGs) body of 
work on the security of health information.  In a May 2011 report, OIG 
found that electronic PHI in seven hospitals was vulnerable to 
unauthorized access, use, and disclosure.26  In a November 2013 report, 
OIG found that OCR did not meet all Federal requirements in its oversight 
and enforcement of the Security Rule.27   Additionally, in conjunction with  
this report, OIG is issuing a report on OCRs oversight of covered entities  
compliance with standards established by the Privacy Rule.28  
METHODOLOGY 
Data Collection and Analysis 
To assess OCRs oversight of covered entities that reported breaches of 
PHI, we (1) reviewed a statistical sample of large and small breaches, 
respectively, that covered entities reported to OCR; (2) surveyed OCR 
staff; and (3) interviewed OCR officials.  To supplement our 
understanding of OCRs investigation process, we reviewed OCRs 
policies and procedures. To determine the extent to which covered entities 
addressed three selected breach administrative standards, we surveyed and  
collected documents from a statistical sample of Part B providers.  See 
 
25 67  Fed.  Reg. 5701157012 (Sept. 6, 2002). 
26 At the time of the audit, the Centers for Medicare & Medicaid Services (CMS) had 
oversight authority for the HIPAA Security Rule.  The report was issued  to OCR because 
the HITECH Act redelegated oversight and enforcement of the HIPAA Security Rule 
from CMS to OCR.  OIG, Nationwide Rollup Review of the Centers for  Medicare  &  
Medicaid  Services Health  Insurance Portability and Accountability Act of 1996  
Oversight, A-04-08-05069, May 2011.  Accessed at 
http://oig.hhs.gov/oas/reports/region4/40805069.pdf on June 19, 2015.  
27 OIG,  The Office for Civil Rights Did Not Meet All Federal Requirements in  Its 
Oversight and  Enforcement of the Health Insurance Portability and Accountability Act 
Security Rule, A-04-11-05025.  Accessed at http://oig.hhs.gov/oas/reports/region4/ 
41105025.pdf  on June 19, 2015. 
28 OIG,  OCR Should  Strengthen  Its Oversight of Covered Entities Compliance With the 
HIPAA Privacy Standards, OEI-09-10-00510. 
 
OCR Should Strengthen Its Followup of Breaches Reported by  Covered Entities (OEI-09-10-00511)    5  
   
   
   
Appendix A for the detailed methodology and Appendix B for the point 
estimates and confidence intervals.  We project our estimates at the  
95-percent confidence level.  
Review of Large Breaches. We reviewed large breaches that covered 
entities reported to OCR to determine how OCR investigated and resolved  
them, and to determine the extent to which OCR documented covered 
entities corrective action in PIMS.  We selected a simple random sample 
of 100 large breaches from a population of 264 large breaches that covered 
entities reported to OCR during the period of September 23, 2009, to 
March 31, 2011.  We focused our analysis on the large-breach cases that 
had been closed.  Except where noted, we project our estimates to the 
subpopulations of (1) closed large-breach cases and (2) closed large-
breach cases in which OCR made determinations of noncompliance.  
Review of Small Breaches. We reviewed small breaches that covered 
entities reported to OCR to determine how OCR investigated and resolved  
them.  We selected a simple random sample of 150 small breaches from a 
population of 30,284 small breaches that covered entities reported to OCR 
during the period of September 23, 2009, to March 31, 2011.  We project 
our estimates of the small breaches to this population. 
Survey of OCR staff. We surveyed all 83 OCR staff who worked on 
breach cases and asked how they investigated these cases.  We had a 
100-percent response rate. Of the 83 OCR staff, 61 reported that they 
worked on large breaches and 52 reported that they worked on small 
breaches.29  
Interviews With OCR Officials and Review of OCR Documents. We  
interviewed OCR officials to understand how OCR investigates breach 
cases, and we reviewed OCRs policies and procedures to supplement our 
understanding of OCRs investigation process. 
Survey of Part B Providers. We reviewed survey responses and 
documents submitted to OIG from a statistical sample of Part B providers  
to determine the extent to which they addressed three selected breach 
administrative standards that require them to have:      
(1)  established a sanctions policy for staff;  
(2)  provided all staff with training on the covered entitys policies and 
procedures with respect to PHI; and 
 
 
29 These two figures are not mutually exclusive, as  OCR staff worked on  one or  both  
types of breach cases.    
 
OCR Should Strengthen Its Followup of Breaches Reported by  Covered Entities (OEI-09-10-00511)    6  
   
   
   
(3)  implemented policies and procedures.30  
We selected a simple random sample of 150 Part B providers from the 
population of 913,235 Part B providers that submitted at least 1 Medicare 
claim in 2011.  We administered an electronic survey to our sample of Part  
B providers and obtained 132 responses, an 88-percent response rate.  We  
project our estimates to 88 percent of our population, which is about 
803,647  Part B providers that submitted at least 1 Medicare claim in 2011.  
Limitations 
Our analysis of the breach cases is limited to the information provided by 
OCR. We did not contact covered entities to verify information regarding  
breach cases, such as corrective action that was recorded in PIMS.  We did 
not determine whether each breach case was appropriately resolved by 
OCR staff.  We did not examine the determinations reached by OCR or the 
corrective action taken in prior breach cases that involved the same  
covered entities. Our analysis of the OCR staff survey is from  
self-reported data. Our analysis of the Part B provider survey is from  
self-reported data and documents submitted by Part B providers.  
Standards 
This study was conducted in accordance with the Quality Standards for 
Inspection and Evaluation issued by the Council of the Inspectors General 
on Integrity and Efficiency. 
   
 
 
30 These three breach administrative standards are located at 45 CFR  164.530(e)(1), 
164.530(b)(1), and 164.530(i)(1).     
 
OCR Should Strengthen Its Followup of Breaches Reported by  Covered Entities (OEI-09-10-00511)    7  
   
   
   
FINDINGS 
OCR investigated all large breaches, as required; 
however, OCR did not record small-breach information 
in its case-tracking system, which limits its ability to 
track and identify  covered entities with multiple small 
breaches    
OCR followed its policy of investigating large breaches that were reported 
by covered entities. OCR opened a case for each of the large breaches in 
our sample and investigated them.31 It closed 69 percent of these 
large-breach cases; the remaining 31 percent of large-breach cases were 
open at the time of our review.  The closed large-breach cases in our 
sample involved 68 covered entities and affected more than 1.1 million 
individuals.    
OCR investigated the large-breach cases by reviewing documents and/or 
contacting individuals involved in the cases.  For the closed large-breach  
cases that were in our sample, OCR staff frequently requested and 
reviewed documents from covered entities, such as policies and 
procedures related to the appropriate use and disclosure of PHI.  Also, 
OCR staff often conducted phone interviews to gather information needed 
for the investigation. Although OCR has authority to conduct onsite visits, 
it did not do so for any of the closed large-breach cases that were in our 
sample. 
OCR did not record information about small breaches in PIMS, nor did it 
investigate the small breaches that covered entities reported to OCR.32   
Without including information about the small breaches in PIMS, OCR 
cannot effectively identify covered entities that have a history of 
noncompliance with the HIPAA standards.  Although OCR has authority 
to investigate small breaches, it did not do so in any of the cases that were 
in our sample. 
   
 
31 We project with  95-percent confidence that OCR investigated between 97 percent and 
100 percent of all large-breach cases  in our population of large breaches.  

32 We project with  95-percent confidence that OCR investigated between 0 percent and 

2 percent of all small breaches in our population of small breaches. 

 
OCR Should Strengthen Its Followup of Breaches Reported by  Covered Entities (OEI-09-10-00511)    8  
   
   
   
In almost all of the closed large-breach cases, OCR 
determined that covered entities were noncompliant 
with at least one HIPAA standard 
OCR determined that covered entities were noncompliant with at least one 
HIPAA standard in 93 percent of closed large-breach cases.33   Among 
these cases that were in our sample, the most common type of 
noncompliance was the failure to implement the safeguard-related privacy 
and/or security standards. Such noncompliance may result in an invasion 
of privacy, identity theft, or other harm. 
OCR staff worked with covered entities to identify corrective action 
needed to address the noncompliance.  Examples of these corrective action  
included training or retraining staff on safeguarding PHI, performing risk 
assessments, and implementing policies on notifying affected individuals.  
OCR staff also provided some covered entities with technical assistance.  
Although OCR has authority to enter into resolution agreements with 
covered entities and to impose CMPs, it did not use either of these 
mechanisms for the closed large-breach cases in our sample in which it 
had made determinations of noncompliance.34  
OCR documented corrective action for about 
three-quarters of closed large-breach cases in which it 
made determinations of noncompliance; however, 
23 percent of cases had incomplete documentation 
OCR lacked complete documentation in PIMS of corrective action for  
23 percent of closed large-breach cases in which it determined that 
covered entities were noncompliant.  For the remaining 77 percent, OCR 
had complete documentation in PIMS of corrective action.  Without 
complete documentation, OCR cannot verify whether covered entities 
took corrective action to address noncompliance with the HIPAA  
standards.  
   
 
33 The remaining 7 percent  of closed large-breach cases include 6 percent in  which OCR 
determined that covered entity did  not violate the HIPAA standards (i.e., OCR did  not 
identify a violation  or the evidence was insufficient to make a determination  of a 
violation), and 1 percent that involved an entity not covered by  HIPAA.  
34 After we conducted  our data collection, OCR entered into  resolution agreements with  
seven covered entities as the result of investigations opened in response to breach reports 
that occurred from 2009 through 2012.   OCR,  Annual  Report to Congress on Breaches of  
Unsecured Protected  Health Information For Calendar Years 2011 and 2012. Accessed 
at http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/ 
breachreport2011-2012.pdf on  June 22, 2015.  
 
OCR Should Strengthen Its Followup of Breaches Reported by  Covered Entities (OEI-09-10-00511)    9  
   
   
   
Sixty-one percent of OCR staff checked at least 
sometimes as to whether covered entities had 
reported prior large breaches; however, 39 percent 
rarely or never did so  
Although OCR staff have the discretion to check whether a covered entity 
has reported prior large or small breaches, many reported that they rarely 
or never did so. Thirty-nine percent of OCR staff reported that they rarely 
or never checked whether a covered entity had reported prior large 
breaches. The reasons they gave for rarely or never checking varied, 
including that they thought that other OCR staff might have already 
checked for prior breaches, that they did not think prior breaches were 
relevant to the investigation, and/or that there was no efficient way to 
search for covered entities in PIMS.  Checking whether a covered entity 
has reported prior breacheslarge and/or smallmay help OCR staff 
identify those that have a history of noncompliance with the HIPAA  
standards. See Table 1 for the percentages of OCR staff who checked at 
various frequencies as to whether a covered entity reported prior large and 
small breaches. 
Table 1: Percentages of  OCR staff who checked at various frequencies as  
to whether a covered entity had reported prior large or small breaches  
Percentage of OCR staff  Percentage of OCR staff 
Frequency  of checking for prior 
who checked for prior large  who checked for prior  
breaches reported by a covered entity  
breaches    small breaches  
Rarely or never   39%   50%  
Usually or sometimes  38%   29%  
Always  23%   21%  
Total  100%   100%  
Source:  OIG analysis of data from survey of OCR staff, 2015. 
From September 2009 through March 2011, some covered entities 
reported multiple breaches to OCR.  From our population of large-breach 
cases, we identified 15 covered entities that reported multiple large 
breaches to OCR. One of these covered entities reported three large 
breaches that affected more than 500,000 individuals.35  From our sample 
of small breaches, we identified six covered entities that reported multiple 
small breaches to OCR.  They reported between 2 and 18 small breaches 
to OCR. Because covered entities are required to report small breaches 
only annually, OCR may not know for up to a year that a covered entity 
has had multiple small breaches.  Without checking whether a covered 
 
35 The numbers of affected individuals is approximate because some covered entities 
reported  being uncertain about the number of individuals affected by a breach.  Accessed  
at http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/ 
breachreport2011-2012.pdf  on July 21, 2015.   
 
OCR Should Strengthen Its Followup of Breaches Reported by  Covered Entities (OEI-09-10-00511)    10  
   
   
   
entity has reported multiple large and/or small breaches, OCR cannot 
identify entities that may have systemic issues in safeguarding PHI.  
OCRs case-tracking system has limited search 
functionality 
OCR staff reported that PIMS has limited functionality when searching for 
covered entities. Variations in how OCR staff enter a covered entitys  
name into PIMS (e.g., abbreviations and capitalization) may limit OCR 
staffs ability to identify covered entities that reported multiple breaches.  
For example, one OCR staff person may enter ABC Company into PIMS  
as ABC Company, Inc. while another may enter it as ABC Co., Inc. or 
ABC Comp. As a result, a single covered entity could appear in PIMS 
as three different covered entities.  An OCR official explained that OCR 
staff may need to enter all possible variations of a covered entitys name to 
identify any prior breaches reported by a covered entity.  Without a 
standard method to search for and track covered entities in PIMS, OCR 
may not be able to identify covered entities that have a history of 
noncompliance, which is one of the factors that OCR can use to determine 
the amount of a CMP.  
Almost three-quarters of Part B providers addressed 
all three selected breach administrative standards; 
however, 27 percent of Part B providers did not 
According to our analysis of supporting documents that Part B providers 
submitted, 27 percent of Part B providers did not address all three selected  
breach administrative standards.  By not addressing these standards, Part B 
providers could be placing PHI at risk of misuse or inappropriate 
disclosure.  Because OCR relies on covered entities self-reporting of 
breaches, OCR may not be aware of Part B providersor covered entities, 
in generalthat do not address the breach administrative standards.  See 
Table 2 for the percentages of Part B providers that did not address the 
selected breach administrative standards. 
Table 2: Percentage of Part B providers that did not address each of the 
selected breach administrative standards  
Percentage of Part B providers that 
Selected breach  administrative standard  
did not address the standard  
Established sanctions policy for staff   24%  
Provided some or all staff with training on the covered entities 
21%  
policies and procedures with respect to PHI 
Implemented PHI policies and procedures that complied with the 
17%  
Breach Notification Rule  
Source:  OIG analysis of data from survey of Part B providers, 2015. 
   
 
OCR Should Strengthen Its Followup of Breaches Reported by  Covered Entities (OEI-09-10-00511)    11  
   
   
   
The remaining 74 percent of Part B providers addressed all three selected 
breach administrative standards.  As examples of how they addressed the 
selected breach administrative standards, Part B providers submitted to 
OIG their organizational policies on protecting patient health information 
and handling breaches, their training  materials on the HIPAA standards,  
and their policies on sanctions for employees who fail to safeguard PHI. 
Sixty-two percent of Part B providers expressed interest in learning more 
about OCR and the Breach Notification Rule.  Some Part B providers 
were interested in receiving additional information on the breach standards 
such as sample policies and procedures, examples of notifications, and 
other providers best practices.  Thirty-five percent of Part B providers 
reported that they were unfamiliar with OCRs jurisdiction over the 
Breach Notification Rule. Without knowing that OCR has this 
jurisdiction, Part B providers may not be aware ofand may not access 
OCR resources on how to comply with the Breach Notification Rule.  
 
OCR Should Strengthen Its Followup of Breaches Reported by  Covered Entities (OEI-09-10-00511)    12  
   
   
   
CONCLUSION AND RECOMMENDATIONS 
As we have seen in recent media reports, a single data breach can affect 
millions of individuals.  Breaches of PHI could expose patients to privacy  
invasion, fraud, identity theft, or other harm.  OCR oversight of covered 
entities compliance is critical to help ensure that covered entities provide 
the required notifications, address the problems that led to breaches, and 
comply with the HIPAA standards.  
OCR should strengthen its followup of breaches of PHI reported by 
covered entities.  OCR followed its policy of investigating the large 
breaches that covered entities reported to it.  In almost all of the closed 
large-breach cases that OCR investigated, it determined that covered 
entities were noncompliant with at least one HIPAA standard.  Although 
OCR documented corrective action for most of the closed large-breach 
cases in which it made determinations of noncompliance, 23 percent of 
cases had incomplete documentation of corrective actions taken by 
covered entities.  OCR also did not record small-breach information in 
PIMS, which limits its ability to track and identify covered entities with 
multiple small breaches.  Further, although 61 percent of OCR staff 
checked at least sometimes as to whether covered entities had reported 
prior large breaches, 39 percent rarely or never did so.  If OCR staff 
wanted to check for prior breaches, they may face challenges because 
OCR does not have a standard way to enter covered entities names in 
PIMS. Lastly, because OCR relies on covered entities to self-report 
breaches, it may not be aware of the Part B providers that we identified as  
not addressing three selected breach administrative standards.  
We recommend that OCR: 
Enter information regarding the small breaches into PIMS or a 
searchable database linked to PIMS  
This could enable OCR staff to electronically track small breaches in 
PIMS or a searchable database linked to PIMS.  OCR could use this 
information to identify and oversee covered entities that report multiple 
small breaches.  Covered entities that report multiple small breaches may 
be experiencing systemic problems that compromise PHI. 
Maintain complete documentation in PIMS of corrective 
actions 
OCR should maintain complete documentation in PIMS of corrective 
actions. OCR should develop a processe.g., a checklistin PIMS to 
identify the corrective-action documentation that it receives and the 
documentation that covered entities still need to submit.  Having complete 
documentation could enable OCR to verify whether a covered entity took 
corrective action to address noncompliance. 
 
OCR Should Strengthen Its Followup of Breaches Reported by  Covered Entities (OEI-09-10-00511)    13  
   
   
   
Develop an efficient method in PIMS to search for and track 
covered entities that reported prior breaches 
To effectively record, track, and search for covered entities that reported 
prior breaches, OCR could enter unique provider identifiers in PIMS, such 
as the National Provider Identifier or Employer Identification Number.36   
This could resolve problems with variations in how OCR staff enter and 
search for a covered entitys name in PIMS.  It would also assist in 
identifying covered entities with a history of noncompliance. 
Develop a policy requiring OCR staff to check whether covered 
entities reported prior breaches 
If OCR staff check whether a covered entity has reported other breaches, 
they could identify those that may have systemic problems in safeguarding 
PHI. Covered entities that reported multiple large and/or small breaches 
to OCR may not be addressing underlying privacy or security issues.  
Once it identifies covered entities with multiple breaches, then OCR could 
initiate compliance reviews and/or conduct onsite visits, as appropriate.  In 
addition, OCR could consider a covered entitys history of noncompliance 
in determining an appropriate resolution, such as entering into a resolution 
agreement or imposing a CMP.  
Continue to expand outreach and education efforts to covered 
entities such as Part B providers 
To improve covered entities compliance with the HIPAA standards, OCR 
could target industry and professional health care associations to educate 
covered entities about OCR and the HIPAA standards.  OCR could 
(1) conduct additional presentations for these associations; (2) continue to 
use electronic mediasuch as posting information on its Web site or 
sending updates via its listservto announce recent changes to the HIPAA  
standards; (3) continue to provide resources, such as Web seminars on 
compliance and how to prevent breaches, and templates of various breach 
policies and procedures; and (4) assess the impact of its outreach and 
education efforts to focus on those that OCR determines to be effective.  
OCR could also work with CMSthe agency that oversees Medicareto 
increase Part B providers compliance with the HIPAA standards. 
   
 
36 HIPAA required employers to  have standard  national  numbers that identify them on 
general transactions.  CMS selected the Employee Notification  Number as the identifier 
for employers, effective July 2002. 
 
OCR Should Strengthen Its Followup of Breaches Reported by  Covered Entities (OEI-09-10-00511)    14  
   
   
   
AGENCY COMMENTS 
OCR concurred with all five of OIGs recommendations and described 
ongoing activities in support of them. As of September 2015, OCR 
reported that its case-tracking system has been upgraded, which enables 
OCR staff to capture small-breach information in a database and to search 
for and track covered entities history of compliance.  OCR also reported 
that it is working on implementing policies to ensure that when staff  
investigate cases, they review the covered entitys history of  
investigations.  In addition, OCR indicated that it will work to ensure that 
all OCR staff who investigate cases understand the appropriate procedures 
for maintaining documentation of corrective action in PIMS.  
See Appendix C for the full text of OCRs comments. 
   
 
OCR Should Strengthen Its Followup of Breaches Reported by  Covered Entities (OEI-09-10-00511)    15  
   
   
   
APPENDIX A 
Detailed Methodology 
Scope 
We reviewed a sample of large and small breaches reported to OCR by 
covered entities during the period of September 23, 2009, to  
March 31, 2011.  Our review focused on the large breach cases that OCR 
had closed by the time of our review, and cases in which OCR made 
determinations of noncompliance. 
We surveyed and requested documents from a sample of Part B providers 
that submitted at least one Medicare claim in 2011.37   We selected three 
breach administrative standards covered by the Breach Notification Rule 
for which we could collect from providers documentation showing that 
they addressed the standards.  
Data Collection and Analysis 
We used five data sources for our evaluation:  (1) a review of large 
breaches that covered entities reported to OCR, (2) a review of small 
breaches that covered entities reported to OCR, (3) a survey of OCR staff, 
(4) interviews with OCR officials and a review of OCRs policies and 
procedures for investigating breach cases, and (5) a survey of Part B 
providers. 
Review of Large Breaches.   We requested from OCR a list of all large 
breaches that covered entities reported to OCR during the period of 
September 23, 2009, to March 31, 2011.  We received from OCR a list of  
264 large breaches.  We selected a simple random sample of 100 large 
breaches from this population, and we requested that OCR provide us with  
all data (e.g., action that OCR and the covered entity took, evidence 
gathered during the investigation, OCR determinations, and any 
supporting documentation from the covered entity) for each of the large 
breaches. OCR did not provide OIG with any other documentation  
(e.g., paper files) outside of the PIMS case data. 
We reviewed the large breaches that covered entities reported to OCR to 
determine whether OCR investigated them and estimated the percentage 
of large breaches that OCR investigated.  We considered a large breach to 
be a large-breach case if OCR investigated it.  We categorized each of the 
100 large-breach cases as open or closed.  We considered a large-breach 
case to be open if it was open as of April 17, 2012, the date on which we 
 
37 Part B providers may include  doctors, nurse practitioners, and physical therapists.  We 
focused on Part B providers because (1) OCR does not have a list of all covered entities 
under its jurisdiction,  (2) Part B providers were the population for which a list was 
available, and (3) Part B providers are covered entities. 
 
OCR Should Strengthen Its Followup of Breaches Reported by  Covered Entities (OEI-09-10-00511)    16  
   
   
   
received the large-breach case data from OCR.  We considered a 
large-breach case to be closed if it was closed before April 17, 2012.  Of 
the 100 large-breach cases, we identified 69 cases that OCR closed, and 
31 cases that were open at the time of our review.  We calculated the 
number of covered entities involved in the 69 closed large-breach cases 
and the number of individuals affected by these breaches.  Our estimates 
of the closed and open large-breach cases apply to our population of 
264 large-breach cases that were reported to OCR during the period of 
September 23, 2009, to March 31, 2011. 
We focused our analysis on the closed large-breach cases.  Except where 
noted, we project our estimates to the subpopulations of (1) closed 
large-breach cases and (2) closed large-breach cases in which OCR made 
determinations of noncompliance. 
We identified how OCR resolved the 69 closed large-breach cases.  We  
categorized each of these closed large-breach cases as either (1) cases in 
which OCR made a determination of no violation with the HIPAA  
standards (i.e., OCR did not identify a violation or the evidence was 
insufficient to make a determination of a violation), or (2) cases in which 
OCR made a determination of noncompliance with at least one HIPAA  
standard. We put five closed cases in the first category.   These are cases in 
which OCR determined that there was no evidence to indicate that the 
covered entity violated the HIPAA standards.  We put 64 closed cases in 
the second category.   These are cases in which OCR determined that the 
covered entity should take corrective action to address at least one of the 
HIPAA standards.  We estimated the percentage of all closed large-breach 
cases in which OCR made determinations of no violation or 
noncompliance.  Our estimates related to these 69 closed large-breach 
cases apply to a subpopulation of about 182 closed large-breach cases that 
covered entities reported to OCR during the period of September 23, 2009, 
to March 31, 2011. 
We further analyzed the 64 closed large-breach cases in which OCR 
determined that covered entities were noncompliant with the HIPAA  
standards. We identified the most common type of noncompliance and 
describe corrective action taken by covered entities.  Additionally, we 
reviewed the 64 closed large-breach cases to identify whether OCR had 
complete or incomplete documentation of corrective action in PIMS.  We  
considered a case to have either (1) complete documentation (if PIMS had 
evidence that the covered entity took corrective action to address each of 
the HIPAA standards) or (2) incomplete documentation (if there was no 
evidence in PIMS to demonstrate that the covered entity took all 
corrective action).  We estimated the percentage of cases that had complete 
or incomplete documentation of corrective action.   This estimate applies to 
 
OCR Should Strengthen Its Followup of Breaches Reported by  Covered Entities (OEI-09-10-00511)    17  
   
   
   
a subpopulation of about 169 closed large-breach cases in which OCR 
determined that covered entities were noncompliant. 
We determined that our population of 264 large-breach cases consisted of 
247 unique covered entities. We identified similarly named covered 
entities (e.g., ABC Company, Inc. and ABC Co., Inc.) and made 
case-by-case determinationson the basis of the available case 
informationas to whether they were the same covered entity or different 
ones. Using this approach, we counted the number of covered entities that 
had reported other large breaches to OCR. 
Review of Small Breaches. We requested from OCR a list of all small 
breaches that covered entities reported to OCR during the period of 
September 23, 2009, to March 31, 2011.  We received a list from OCR of 
30,284 small breaches.  We selected a simple random sample of  
150 small breaches from this population, and requested that OCR provide 
us with all data (e.g., covered entitys name, estimated number of 
individuals affected by the breach, type of breach, and corrective action 
taken by the covered entity in response to the breach) for each of the small 
breaches. We reviewed the 150 small breaches that covered entities 
reported to OCR to determine whether OCR investigated them.  We  
estimated the percentage of all small breaches investigated by OCR and 
project this estimate to our population of small breaches. 
We determined that our sample of 150 small breaches consisted of  
106 unique covered entities.  As with the large breaches, we identified 
similarly named covered entities (e.g., ABC Company, Inc. and ABC 
Co., Inc.) and made case-by-case determinations on the basis of the 
available case information as to whether they were the same covered 
entity or different covered entities.  Using this approach, we counted the 
number of covered entities that reported more than one small breach to 
OCR. We do not project our estimate of unique covered entities that 
reported small breaches to OCR during the period of September 23, 2009, 
to March 31, 2011. 
Survey of OCR Staff. We administered an electronic survey to all 83 OCR 
staff who worked on breach cases to determine how they investigated 
these cases.38   We had a 100-percent response rate.  Of the 83 OCR staff, 
61 indicated that they worked on large-breach cases during the period of 
September 23, 2009, to March 31, 2011, and 52 indicated that they worked 
 
38 We  use the term OCR staff to include  positions such as investigators, program staff 
assistants, interns, regional managers, and contractors who conducted preliminary reviews, 
assigned cases, contacted the covered entity or complainant, collected or reviewed  
documents, and/or reviewed  case determinations.    
 
OCR Should Strengthen Its Followup of Breaches Reported by  Covered Entities (OEI-09-10-00511)    18  
   
   
   
on small-breach cases during this period.39 For each group, we calculated 
the percentage of OCR staff who reported that they (1) always checked, 
(2) usually or sometimes checked, or (3) rarely or never checked whether 
covered entities had previously been investigated.  We described OCR 
staffs explanations of why they rarely or never checked. 
Interviews with OCR Officials and Review of OCR Documents.  We  
interviewed OCR officials to learn how OCR oversees covered entities 
that reported breaches of PHI.  We  asked these officials how breach cases  
are investigated and how OCR staff use PIMS during their investigations.   
We requested from OCR headquarters and regional offices all policies and 
procedures for investigating breach cases.  We reviewed these policies and 
procedures to understand how OCR staff investigate breach cases and how 
they ensure that covered entities take corrective action.  
Survey of Part B Providers. We selected a simple random sample of  
150 Part B providers from the population of 913,235 Part B providers that 
submitted at least 1 Medicare claim in 2011.  We used the National Claims  
History file to select a representative sample of Part B providers.  This file 
had the most complete and recent Medicare claims data available at the 
time of our data request.  
We surveyed the Part B providers to determine the extent to which they 
addressed three selected breach administrative standards.  We  
administered an electronic survey to 150 Part B providers and obtained 
132 responses, an 88-percent response rate.  We project our estimates to 
88 percent of our population which is about 803,647  Part B providers that 
,
submitted at least 1 Medicare claim in 2011.  Our 12-percent nonresponse 
rate consisted of Part B providers that either did not respond to the survey 
or did not receive the survey as a result of incomplete or inaccurate 
contact information.   
We asked the 132 Part B providers whether they had addressed three 
selected breach administrative standards that require them to have:  
(1) established a sanctions policy for staff; (2) provided some or all staff 
with training on the covered entitys policies and procedures with respect 
to PHI;40 and (3) implemented policies and procedures.  We considered a 
Part B provider to have addressed the three standards if the provider 
submitted documents to demonstrate that it had a sanctions policy,  
provided training, and implemented policies and procedures. 
 
39 The numbers of OCR staff who indicated that they worked on large-breach cases and 
small-breach cases during the period of September 23, 2009, to  March 31, 2011, are not 
mutually exclusive, as OCR staff worked on  one or  both types of  breach cases. 
40 Although the standard requires covered entities to train  all staff, we surveyed Part B 
providers to see whether they trained some or all staff.  45  CFR   164.530(b)(1).   
 
OCR Should Strengthen Its Followup of Breaches Reported by  Covered Entities (OEI-09-10-00511)    19  
   
   
   
We reviewed documents to determine whether they addressed all three 
selected breach administrative standards.  We estimated the percentages of 
Part B providers that (1) addressed all three selected breach administrative 
standards, (2) addressed each of the three breach administrative standards,  
(3) expressed interested in learning more about OCR and about the Breach 
Notification Rule, and (4) responded that they were unfamiliar with 
OCRs jurisdiction over the Breach Notification Rule. 
   
 
OCR Should Strengthen Its Followup of Breaches Reported by  Covered Entities (OEI-09-10-00511)    20  
   
   
   
APPENDIX B 
Table B-1:  Point Estimates and Confidence Intervals for the 
Subpopulation of Large Breach Cases 
95-Percent 
Point Estimate 
Estimate Description  Sample Size   Confidence 
(Number of Cases)  
Interval  
Subpopulation of closed large-breach 
182  163201  
cases  
100 large-breach  
Subpopulation of closed large-breach 
cases  
cases in which OCR made  169  149189  
determinations of noncompliance 
Source:  OIG analysis of data from OCR large-breach  cases, 2015. 
 
Table B-2:  Point Estimates and Confidence Intervals for Large 
Breaches and Small Breaches 
95-Percent 
Point 
Estimate Description  Sample Size   Confidence 
Estimate  
Interval  
Large breaches investigated during the period 
100 large breaches  100%   97.0%100%  
of September 23, 2009, to March 31, 2011  
Large-breach cases that were closed prior to 
69.0%  59.8%78.2%  
April 17, 2012   100 large-breach  
Large-breach cases that were open as of  cases  
31.0%  21.8%40.2%  
April 17, 2012  
Closed large-breach cases in which OCR 
determined covered entities were noncompliant  92.8%  83.9%97.6%  
with at least one HIPAA standard  
Closed large-breach cases in which OCR  69 closed large-
determined covered entities to be compliant  breach cases  5.8%  1.6%14.2%  
with the HIPAA standards  
Closed large-breach cases for which OCR did 
1.4%  0%7.8%  
not have any investigation information 
Closed large-breach cases in which OCR 
determined covered entities to be noncompliant 
23.4%  13.8%35.7%  
and did not have complete documentation of  64 closed 
corrective action in PIMS  large-breach cases 
in which OCR 
determined covered 
Closed large-breach cases in which OCR  entities to be 
determined covered entities to be noncompliant  noncompliant 
76.6%  64.3%86.2%  
and had complete documentation of corrective 
action in PIMS 
Small breaches investigated by  OCR during the 
period of September 23, 2009, to   150 small breaches  0%   0%2.4%  
March 31, 2011  
Source:  OIG analysis of data from OCR large and small-breach cases, 2015. 
 
 
OCR Should Strengthen Its Followup of Breaches Reported by  Covered Entities (OEI-09-10-00511)    21  
   
   
   
APPENDIX B 
Table B-3:  Point Estimate and Confidence Interval for the 
Subpopulation of Part B Providers 
Point Estimate  95-Percent 
Estimate Description  Sample Size   (Number of Part B  Confidence 
Providers)   Interval  
Subpopulation of Part B providers  
150 Part B providers  803,647   755,610851,684 
that responded to the survey  
Source:  OIG analysis of data from the Part B Provider survey, 2015. 
 
Table B-4:  Point Estimates and Confidence Intervals for the 
Part B Provider Survey  
95-Percent 
Point 
Estimate Description  Sample Size   Confidence 
Estimate  
Interval  
Part B providers that did not address all three 
26.5%  18.9%34.1%  
selected breach administrative standards  
Part B providers that addressed all three selected 
73.5%  65.9%81.1%  
breach administrative standards 
Part B providers that had not established a 
23.5%  16.5%31.6%  
sanctions policy for staff  
Part B providers that had not provided some or all 
staff with training on their organizations policies  21.2%  14.6%29.2%  
and procedures with respect to PHI 
132 Part B 
providers 
Part B providers that had not implemented PHI 
policies and procedures that complied with the  17.4%  11.4%25%  
Breach Notification Rule  
Part B providers that expressed interest in 
learning more about OCR and the Breach  62.1%  53.7%70.5%  
Notification Rule 
Part B providers that reported that they  were 
unfamiliar with OCRs jurisdiction over the Breach  34.8%  26.6%43.1%  
Notification Rule 
Source:  OIG analysis of data from the Part B Provider survey, 2015. 
 
 
   
 
OCR Should Strengthen Its Followup of Breaches Reported by  Covered Entities (OEI-09-10-00511)    22  
   
   
   
APPENDIX C 
Agency Comments 
 
   
 
OCR Should Strengthen Its Followup of Breaches Reported by  Covered Entities (OEI-09-10-00511)    23  
   
   
   
 
   
 
OCR Should Strengthen Its Followup of Breaches Reported by  Covered Entities (OEI-09-10-00511)    24  
   
   
   
 
OCR Should Strengthen Its Followup of Breaches Reported by  Covered Entities (OEI-09-10-00511)    25  
   
   
   
ACKNOWLEDGMENTS 
This report was prepared under the direction of Blaine Collins, Regional 
Inspector General for Evaluation and Inspections in the San Francisco 
regional office and Michael Henry, Deputy Regional Inspector General.  
Abby Amoroso served as the team leader for this study, and 
Christina Lester served as the lead analyst.  Other Office of Evaluation and 
Inspections staff from the San Francisco regional office who contributed 
to the study include Timothy Brady, Joyce Greenleaf, Camille Harper, and 
Linda Min. Central office staff who provided support include 
Heather Barton, Kevin Farber, Robert Gibbons, Christine Moritz, and 
Sherri Weinstein.    
 
OCR Should Strengthen Its Followup of Breaches Reported by  Covered Entities (OEI-09-10-00511)    26  
   
   
Office of Inspector General
http://oig.hhs.gov  
 
The mission of the Office of Inspector General (OIG), as mandated by Public Law 95452, as  
amended, is  to protect the integrity of the Department of  Health and Human Services  
(HHS) programs, as  well  as the health  and welfare of individuals served by those programs.  
This statutory mission is carried  out through a nationwide network of audits, investigations,  
and inspections conducted by the following operating components: 
Office of Audit Services 
The Office  of  Audit Services  (OAS) provides auditing services  for HHS, either by  conducting  
audits  with its own audit resources or by  overseeing  audit work done by others.  Audits  
examine the performance of HHS programs and/or its grantees and contractors in carrying  
out their respective responsibilities and are intended  to provide independent assessments of 
HHS programs and operations.  These assessments help reduce waste, abuse, and  
mismanagement and promote economy and efficiency  throughout  HHS. 
Office of Evaluation and Inspections 
The Office  of  Evaluation and Inspections (OEI)  conducts national evaluations to  provide 
HHS, Congress, and the public with timely, useful, and reliable information on significant 
issues.  These evaluations focus on preventing fraud,  waste, or abuse  and promoting  
economy, efficiency, and effectiveness of departmental programs.  To promote impact, OEI 
reports also present practical recommendations for improving program operations.  
Office of Investigations 
The Office of Investigations (OI) conducts criminal, civil, and administrative investigations  
of fraud and misconduct  related to HHS programs, operations, and individuals.  With  
investigators working in all 50 States and the District of Columbia, OI  utilizes its resources 
by actively  coordinating with the Department  of Justice  and other Federal, State, and local 
law enforcement authorities.  The investigative efforts of OI often lead to  criminal 
convictions, administrative sanctions,  and/or  civil monetary  penalties.  
Office of Counsel to the Inspector General 
The Office of Counsel to the  Inspector  General (OCIG) provides general legal services to 
OIG, rendering  advice and opinions on HHS programs and operations and  providing all  
legal support for OIGs  internal operations.  OCIG represents  OIG in all civil and 
administrative fraud and  abuse cases involving HHS programs, including False Claims Act, 
program exclusion, and civil monetary penalty cases.  In  connection with these cases, OCIG 
also negotiates and monitors corporate integrity agreements.  OCIG renders advisory 
opinions, issues compliance program  guidance, publishes fraud alerts, and provides other  
guidance  to  the health care industry concerning the anti-kickback statute and other  OIG  
enforcement authorities.