Although reporters and complainants may wish to remain anonymous, if HHS´ Office for Civil Rights investigated anonymous reports, it could lead to an increase in false reports and unjustified complaints – stretching the Office for Civil Rights´ resources and potentially reducing the amount of technical assistance available for organizations that need it.
Additionally, the Privacy Rule protects genuine reporters and complainants from retaliation under §160.316. Under this standard, a covered entity or business associate “may not threaten, intimidate, coerce, harass, discriminate against, or take any other retaliatory action against any individual or other person” who:
Files a complaint or reports a HIPAA violation,
Assists in an investigation into the complaint/report, or
Refuses to take an action that would violate HIPAA.