HIPAA Enforcement
The Office for Civil Rights (OCR) within HHS is responsible for enforcing both the Privacy and Security Rules.100 There is no private right of action for individuals whose information has been improperly used or disclosed. Instead, aggrieved individuals can file a complaint with OCR, which may enforce HIPAA on their behalf. While initial enforcement of the Privacy and Security Rules was minimal, in recent years, OCR has ramped up its enforcement efforts. This can be seen through the increasing number of high profile settlements.101
Footnotes
- 100. HIPAA Privacy and Security Rules, 45 C.F.R. pt. 160, 162, 164 (2010); Press Release, Dep’t of Health & Human Services, HHS Delegates Authority for the HIPAA Security Rule to Office for Civil Rights (Aug. 3, 2009) (on file with author), available at http://www.hhs.gov/news/press/2009pres/08/20090803a.html (last visited April 27, 2012).
- 101. McGuire Woods, Providers Beware: OCR Continues Aggressive Enforcement of the HIPAA Privacy and Security Rules. (April 18, 2012), available at: http://www.mcguirewoods.com/news-resources/item.asp?item=6601 (last accessed April 27, 2012).
.png)