HHS Office for Civil Rights Delivers Annual Reports to Congress on HIPAA Compliance and Breaches of Unsecured Protected Health Information

Reports highlight for regulated entities where to focus HIPAA compliance efforts

On February 14, 2024, the U.S. Department of Health & Human Services Office for Civil Rights issued two Reports to Congress on Health Insurance Portability and Accountability Act of 1996 (HIPAA) compliance and enforcement, specifically, on HIPAA Privacy, Security, and Breach Notification Rule Compliance and Breaches of Unsecured Protected Health Information.  These reports are required to be submitted to Congress annually by the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009.  The HIPAA Rules provide the minimum required privacy and security safeguards for protected health information, and give individuals rights with respect to that information, such as the right to access their health information.  These reports, delivered to Congress, help regulated entities (such as most health care providers, health plans, and healthcare clearinghouses) and their business associates in their HIPAA compliance efforts by sharing steps taken by OCR to investigate complaints, breach reports, and compliance reviews regarding potential violations of the HIPAA Rules.  The reports include important data on the number of HIPAA cases investigated, areas of noncompliance, and insights into trends such as cybersecurity readiness.  The action is the latest step by HHS in supporting the privacy and security of health information.  In December 2023, HHS released a department-wide Cybersecurity strategy for the health care sector and in January 2024, HHS released voluntary cybersecurity performance goals to enhance cybersecurity across the health sector.

“OCR’s Reports to Congress provide useful information for everyone on trends in HIPAA complaints and breach reporting,” said OCR Director Melanie Fontes Rainer.  “Our health care systems should take note of these trends and address potential HIPAA compliance issues before they experience a breach or receive notice of an OCR investigation.  My staff and I stand ready to continue to work with Congress and the health care industry to drive compliance and protect against security threats.”

The 2022 Report to Congress on HIPAA Privacy, Security, and Breach Notification Rule Compliance identifies the number of complaints received, the method by which those complaints were resolved, the number of compliance reviews initiated by OCR, and the outcome of each review.  Some highlights include:

• OCR received 30,435 new complaints alleging violations of the HIPAA Rules
• OCR resolved 32,250 complaints alleging violations of the HIPAA Rules
• OCR resolved 17 complaint investigations with Resolution Agreements and Corrective Action Plans (RA/CAPs) and monetary settlements totaling $802,500, and one complaint investigation with a civil money penalty in the amount of $100,000
• OCR completed 846 compliance reviews and required subject entities to take corrective action or pay a civil money penalty in 80% (674) of these investigations.  Three compliance reviews were resolved with RA/CAPs and monetary payments totaling $2,425,640.

The 2022 Report to Congress on Breaches of Unsecured Protected Health Information identifies the number and nature of breaches of unsecured protected health information (PHI) that were reported to the Secretary of HHS during calendar year 2022 and the actions taken in response to those breaches.  It also highlights the continued need for regulated entities to improve compliance with the HIPAA Security Rule requirements, including:

• risk analysis and risk management;
• information system activity review;
• audit controls;
• response and reporting; and
• person or entity authentication.

As in previous years, hacking/IT incidents remain the largest category of breaches occurring in 2022 affecting 500 or more individuals, and affected the most individuals, comprising 77% of the reported breaches.  Network servers continued as the largest category by location for breaches involving 500 or more individuals at 58% of reported large breaches.  OCR’s 2022 Report to Congress on HIPAA Privacy, Security, and Breach Notification Rule Compliance may be found at: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/reports-congress/index.html.  OCR’s 2022 Report to Congress on Breaches of Unsecured Protected Health Information may be found at:  https://www.hhs.gov/hipaa/for-professionals/breach-notification/reports-congress/index.html.  OCR is committed to enforcing the HIPAA Rules and supporting the privacy and security of peoples’ health information.  If you believe that your or another person’s health information privacy or civil rights have been violated, you can file a complaint with OCR at: https://www.hhs.gov/ocr/complaints/index.html.