Skip to main content


U.S. flag
      An official website of the United States government
              Here’s how you know
        Here’s how you knowDot gov**Official websites use .gov**
                 A **.gov** website belongs to an official government organization in the United States.
                  HTTPS**Secure .gov websites use HTTPS**
                 A **lock** (A locked padlock) or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites. 
  Menu Close
          HHS Search (hipaa)
    Search
        








  
  
    

  
      

                                      About HHS
    
                        
                              
      
      
      Programs & Services
    
                        
                              
      
      
      Grants & Contracts
    
                        
                              
      
      
      Laws & Regulations                  
Health Information Privacy
  HIPAA for Individuals
    
                        
                                            
      
      
      Filing a Complaint
    
                        
                                            
      
      
      HIPAA for Professionals
    
                        
                                            
      
      
      Newsroom

              

    



Breadcrumb
    HHS
                              HIPAA Home
                              For Professionals
                              HIPAA Compliance and Enforcement
                              Enforcement Data
                              Enforcement Highlights - Current
                              Enforcement Highlights - September 2017


    

    

    Navigate to:
  HIPAA for Professionals
    
                                    
                                            
            
      
      
      
      Regulatory Initiatives
    
                                                  
                                                                  
            
      
      
      
      Privacy
                                            
            
            Summary of the Privacy Rule
    
                                                  
                                            
            
      
      
      
      Guidance
    
                                                  
                                            
            
      
      
      
      Combined Text of All Rules
    
                                                  
                                            
            
      
      
      
      HIPAA Related Links
    
                                                  
                                                                  
            
      
      
      
      Security
                                            
            
            Summary of the Security Rule
    
                                                  
                                            
            
      
      
      
      Security Guidance
    
                                                  
                                            
            
      
      
      
      Cyber Security Guidance
    
                                                  
                                                                  
            
      
      
      
      Breach Notification
                                            
            
            Breach Reporting
    
                                                  
                                            
            
      
      
      
      Guidance
    
                                                  
                                            
            
      
      
      
      Reports to Congress
    
                                                  
                                            
            
      
      
      
      Regulation History
    
                                                  
                                                                  
            
      
      
      
      Compliance & Enforcement
                                            
            
            Enforcement Rule
    
                                                  
                                            
            
      
      
      
      Enforcement Process
    
                                                  
                                            
            
      
      
      
      Enforcement Data
    
                                                  
                                            
            
      
      
      
      Resolution Agreements
    
                                                  
                                            
            
      
      
      
      Case Examples
    
                                                  
                                            
            
      
      
      
      Audit
    
                                                  
                                            
            
      
      
      
      Reports to Congress
    
                                                  
                                            
            
      
      
      
      State Attorneys General
    
                                                  
                                                                  
            
      
      
      
      Special Topics
                                            
            
            HIPAA and Part 2
    
                                                  
                                            
            
      
      
      
      Change Healthcare Cybersecurity Incident FAQs
    
                                                  
                                            
            
      
      
      
      HIPAA and COVID-19
    
                                                                
                                                                  
            
      
      
      
      HIPAA and Reproductive Health
                          
            
            HIPAA and Final Rule Notice
    
                                                  
                                            
            
      
      
      
      HIPAA and Telehealth
    
                                                  
                                            
            
      
      
      
      HIPAA and FERPA
    
                                                  
                                            
            
      
      
      
      Research
    
                                                  
                                            
            
      
      
      
      Public Health
    
                                                  
                                            
            
      
      
      
      Emergency Response
    
                                                  
                                            
            
      
      
      
      Health Information Technology
    
                                                  
                                            
            
      
      
      
      Health Apps
    
                                                  
                                                                  
            
      
      
      
      Patient Safety
                                            
            
            Statute & Rule
                          
            
            PSQIA Statute
    
                                                  
                                            
            
      
      
      
      Patient Safety Rule
    
                                                  
                                            
            
      
      
      
      Enforcement
    
                                                  
                                            
            
      
      
      
      Guidance
    
                                                  
                                                                  
            
      
      
      
      Covered Entities & Business Associates
                                            
            
            Business Associate Contracts
    
                                                  
                                            
            
      
      
      
      Business Associates
    
                                    
                                            
            
      
      
      
      Training & Resources
    
                                    
                                            
            
      
      
      
      FAQs for Professionals
    
                                    
                                            
            
      
      
      
      Other Administrative Simplification RulesText resize icon

                    




Enforcement Highlights - September 2017








  
  
    

  
      





(As of September 30, 2017)
The HIPAA Privacy Rule is a set of federal standards to protect the privacy of patients’ medical records and other health information maintained by covered entities (health plans, which include many governmental health programs, such as the Veterans Health Administration, Medicare and Medicaid; most doctors, hospitals and many other health care providers and health care clearinghouses) and by their business associates.  The Privacy Rule provides patients with access to their medical records and with other important rights.  Compliance with the Privacy Rule was required as of April 14, 2003 for most entities covered by HIPAA, and by September 23, 2013, for their business associates.
The HIPAA Security Rule establishes national standards for the security of electronic protected health information.  The Security rule specifies a series of administrative, technical, and physical security safeguards for covered entities and their business associates to assure the integrity, availability, and confidentiality of electronic protected health information.  Compliance with the Security rule was required as of April 20, 2005, for most entities covered by HIPAA, and by September 23, 2013, for their business associates.  The authority to administer and enforce the Security Rule was transferred to OCR on July 27, 2009.
The HIPAA Breach Notification Rule requires covered entities and their business associates to notify the Secretary, individuals, and in some cases, the media, regarding breaches of unsecured protected health information.  Compliance with the standards was required as of September 23, 2009.
Enforcement Results as of the Date of This Summary
Since the compliance date of the Privacy Rule in April 2003, OCR has received over 165,175 HIPAA complaints and has initiated over 851 compliance reviews.  We have resolved ninety-seven percent of the complaint cases (160,770).
OCR has investigated and resolved over 25,441 cases by requiring changes in privacy practices and corrective actions by, or providing technical assistance to, HIPAA covered entities and their business associates.  Corrective actions obtained by OCR from these entities have resulted in change that is systemic and that affects all the individuals they serve.  OCR has successfully enforced the HIPAA Rules by applying corrective measures in all cases where an investigation indicates noncompliance by the covered entity or their business associate, which may include settling with the entity in lieu of imposing a civil money penalty.  To date, OCR has settled 52 such cases resulting in a total dollar amount of $72,929,182.00.  OCR has investigated complaints against many different types of entities including:  national pharmacy chains, major medical centers, group health plans, hospital chains, and small provider offices.
In another 11,334 cases, our investigations found no violation had occurred.
Additionally, in 23,276 cases, OCR has intervened early and provided technical assistance to HIPAA covered entities, their business associates, and individuals exercising their rights under the Privacy Rule, without the need for an investigation.
In the rest of our completed cases, (100,719) OCR determined that the complaint did not present an eligible case for enforcement.  These include cases in which:
OCR lacks jurisdiction under HIPAA.  For example, in cases alleging a violation by an entity not covered by HIPAA;
	The complaint is untimely, or withdrawn by the filer.  The activity described does not violate the HIPAA Rules;
	The activity described does not violate the HIPAA Rules.  For example, in cases where the covered entity has disclosed protected health information in circumstances in which the Privacy Rule permits such a disclosure.From the compliance date to the present, the compliance issues investigated most are, compiled cumulatively, in order of frequency:
Impermissible uses and disclosures of protected health information;
	Lack of safeguards of protected health information;
	Lack of patient access to their protected health information;
	Lack of administrative safeguards of electronic protected health information; and
	Use or disclosure of more than the minimum necessary protected health information.The most common types of covered entities that have been required to take corrective action to achieve voluntary compliance are, in order of frequency:
Private Practices;
	General Hospitals;
	Outpatient Facilities;
	Pharmacies; and
	Health Plans (group health plans and health insurance issuers).Referrals
OCR refers to the Department of Justice (DOJ) for criminal investigation appropriate cases involving the knowing disclosure or obtaining of protected health information in violation of the Rules.  As of the date of this summary, OCR made 643 such referrals to DOJ.
Watch for monthly updates reporting the number of cases received, investigated or resolved.

                    
  


Content created by Office for Civil Rights (OCR) Content last reviewed November 9, 2017Back to top
    Contact HHS
    
                        
                                            
      
      
      Careers
    
                        
                                            
      
      
      HHS FAQs
    
                        
                                            
      
      
      Nondiscrimination NoticeHHS Archive
    
                        
                                            
      
      
      Accessibility Statement
    
                        
                                            
      
      
      Privacy Policy
    
                        
                                            
      
      
      Viewers & PlayersBudget/Performance
    
                        
                                            
      
      
      Inspector General
    
                        
                                            
      
      
      Web Site Disclaimers
    
                        
                                            
      
      
      EEO/No Fear ActFOIA
    
                        
                                            
      
      
      The White House
    
                        
                                            
      
      
      USA.gov
    
                        
                                            
      
      
      Vulnerability Disclosure Policy
        Sign Up for Email Updates

Receive the latest updates from the Secretary, Blogs, and News Releases.

Sign Up
  HHS Headquarters
          200 Independence Avenue, S.W.
                  Washington, D.C. 20201
                  Toll Free Call Center: 1-877-696-6775​Disclaimer Policy: Links with this icon () mean that you are leaving the HHS website.
              The Department of Health and Human Services (HHS) cannot guarantee the accuracy of a non-federal website.
                  Linking to a non-federal website does not mean that HHS or its employees endorse the sponsors, information, or products presented on the website. HHS links outside of itself to provide you with further information.
                  You will be bound by the destination website's privacy policy and/or terms of service when you follow the link.
                  HHS is not responsible for Section 508 compliance (accessibility) on private websites.For more information on HHS's web notification policies, see Website Disclaimers.
              Continue
                  Go back