Skip to main content
 HHS.gov
 Search
 U.S. Department of Health & Human Services
  Search Close
 A-Z Index
 About HHS
Programs & Services
Grants & Contracts
Laws & Regulations
 Home > About > News > OCR Issues Audit Report on Health Care Industry Compliance with the HIPAA Rules
 Text Resize  
                                A
                                A
                                A
                            Print
                            Share
 Search News Releases
View 2016 - 1991 archive
 FOR IMMEDIATE RELEASEDecember 17, 2020Contact: HHS Press Office202-690-6343[email protected]OCR Issues Audit Report on Health Care Industry Compliance with the HIPAA RulesToday, the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) released its 2016-2017 HIPAA Audits Industry Report that reviewed selected health care entities and business associates for compliance with certain provisions of the HIPAA Privacy, Security, and Breach Notification Rules.
The Health Information Technology for Economic and Clinical Health (HITECH) Act requires HHS to periodically audit covered entities and business associates for their compliance with the HIPAA Rules.   OCR conducted audits of 166 covered entities and 41 business associates and has notified these organizations of OCR’s findings.  OCR is publishing this Industry Report to share the overall findings on compliance with the audited provisions of the HIPAA Rules within a sample of the regulated industry.  A summary of the audit findings includes:
Most covered entities met the timeliness requirements for providing breach notification to individuals;
	Most covered entities that maintained a website about their customer services or benefits satisfied the requirement to prominently post their Notice of Privacy Practices on their website;
	Most covered entities failed to provide all of the required content for a Notice of Privacy Practices;
	Most covered entities failed to provide all of the required content for breach notification to individuals;
	Most covered entities failed to properly implement the individual right of access requirements such as timely action within 30 days and charging a reasonable cost-based fee;
	Most covered entities and business associates failed to implement the HIPAA Security Rule requirements for risk analysis and risk management.“The audit results confirm the wisdom of OCR’s increased enforcement focus on hacking and OCR’s Right of Access initiative,” said OCR Director Roger Severino. “We will continue our HIPAA enforcement initiatives until health care entities get serious about identifying security risks to health information in their custody and fulfilling their duty to provide patients with timely and reasonable, cost-based access to their medical records.”
The 2016-2017 HIPAA Audits Industry Report may be found at:  https://www.hhs.gov/sites/default/files/hipaa-audits-industry-report.pdf*
* People using assistive technology may not be able to fully access information in this file. For assistance, contact the HHS Office for Civil Rights at (800) 368-1019, TDD toll-free: (800) 537-7697, or by emailing [email protected].###Note: All HHS press releases, fact sheets and other news materials are available at https://www.hhs.gov/news.Like HHS on Facebook, follow HHS on Twitter @HHSgov, and sign up for HHS Email Updates.Last revised: December 17, 2020 Sign Up for News Release UpdatesEnter your email:
Email Subscribe to RSSReceive latest updates Related News ReleasesOCR Settles Thirteenth Investigation in HIPAA Right of Access Initiative
  OCR Issues Guidance on HIPAA, Health Information Exchanges, and Disclosures of Protected Health Information for Public Health Purposes
  HHS to Disallow $200M in California Medicaid Funds Due to Unlawful Abortion Insurance Mandate; Refers Vermont Medical Center to DOJ for Lawsuit Over Conscience Violations
 Public Affairs Contacts
HHS Media InformationASPA Press ContactsHHS Agency Press Contacts
**View all**
 Connect With Us
 Sign Up for Email Updates To sign up for updates or to access your subscriber preferences, please enter your contact information below. Email
 HHS Headquarters U.S. Department of Health & Human Services
						200 Independence Avenue, S.W.
						Washington, D.C. 20201
						Toll Free Call Center: 1-877-696-6775​
 Contact HHS
                        Careers
                        HHS FAQs
                        Nondiscrimination Notice
 HHS Archive
                        Accessibility
                        Privacy Policy
                        Viewers & Players
 Budget/Performance
                        Guidance Portal 
                        Inspector General
                        EEO/No Fear Act
 FOIA
                        The White House
                        USA.gov


Back to *T*op