Make Enhanced HIPAA Compliance a New Year’s Resolution

In the order of frequency, the most commonly-alleged complaints were:
• Impermissible uses and disclosures of protected health information (PHI);
• Lack of safeguards of PHI;
• Lack of patient access to their PHI;
• Lack of administrative safeguards of electronic PHI; and
• Use or disclosure of more than the minimum necessary PHI.

The most common types of covered entities that have been alleged to violate HIPAA, in order of frequency, are general hospitals, private practices and physicians, pharmacies, outpatient facilities, and community health centers.

The takeaway is that the most frequent HIPAA complaints received by the OCR are largely preventable by having in place a robust HIPAA compliance program, one or more HIPAA compliance officials, security safeguards, and frequent and meaningful staff training.