Source: http://www.hipaasurvivalguide.com/hipaa-regulations/160-312.php
Timestamp: 2017-05-28 16:23:39
Document Index: 37501095

Matched Legal Cases: ['§160', '§160', '§160', '§160', '§160', '§160', '§160', '§160']

HIPAA Complaints and Compliance Reviews
Take Our 15 MinuteCompliance Challenge800-516-7903Watch this for more info... HIPAA Compliance Plan & Tools* HIPAA Privacy Rule Checklist
Copyright Notice Terms of Use Privacy Policy About HIPAA 160.312
« Previous Page — HIPAA Regulations Table of Contents — Next Page » Make sure you are Omnibus Rule Compliant: HIPAA Privacy Checklist. §160.312 Secretarial action regarding complaints and compliance reviews.
(a) Resolution when noncompliance is indicated.
(1) If an investigation of a complaint pursuant to §160.306 or a compliance review pursuant to §160.308 indicates noncompliance, the Secretary may attempt to reach a resolution of the matter satisfactory to the Secretary by informal means. Informal means may include demonstrated compliance or a completed corrective action plan or other agreement.
(2) If the matter is resolved by informal means, the Secretary will so inform the covered entity or business associate and, if the matter arose from a complaint, the complainant, in writing.
(3) If the matter is not resolved by informal means, the Secretary will--
(i) So inform the covered entity or business associate and provide the covered entity or business associate an opportunity to submit written evidence of any mitigating factors or affirmative defenses for consideration under §§160.408 and 160.410 of this part. The covered entity or business associate must submit any such evidence to the Secretary within 30 days (computed in the same manner as prescribed under §160.526 of this part) of receipt of such notification; and
(ii) If, following action pursuant to paragraph (a)(3)(i) of this section, the Secretary finds that a civil money penalty should be imposed, inform the covered entity or business associate of such finding in a notice of proposed determination in accordance with §160.420 of this part.
(b) Resolution when no violation is found. If, after an investigation pursuant to §160.306 or a compliance review pursuant to §160.308, the Secretary determines that further action is not warranted, the Secretary will so inform the covered entity or business associate and, if the matter arose from a complaint, the complainant, in writing.
Download a FREE copy of the HIPAA Survival Guide 4th Edition.