Civil Rights and Privacy Rule Compliance Activities

As the Department's civil rights, conscience and religious freedom, and health privacy rights law enforcement agency, OCR investigates complaints, enforces rights, and promulgates regulations, develops policy and provides technical assistance and public education to ensure understanding of and compliance with non-discrimination and health information privacy laws.

Anyone who believes he or she has been discriminated against in the manner outlined, seeks information concerning civil rights, and recipients of Federal financial assistance who desire technical assistance and information for the purpose of assuring their compliance with nondiscrimination laws. Regarding the HIPAA Privacy and Security Rules, anyone who believes that the Privacy and/or Security Rules have been violated in the manner outlined or who seeks information about these Rules; consumers that need to know their rights under the Privacy Rule; and entities that need technical assistance and information for the purpose of assuring compliance with the Privacy and Security Rules.

Individuals subject to discrimination and recipients who require technical assistance and information. Regarding the HIPAA Privacy Rule, individuals subject to violation of their health information privacy, covered entities, and others needing or seeking technical assistance and information concerning the Rule.

The Office for Civil Rights (OCR) in the Department of Health and Human Services (HHS) is responsible for promoting and ensuring that people have equal access to and the opportunity to participate in and receive services from all HHS-funded programs without facing unlawful discrimination, that the privacy of their health information is protected, and that electronic protected health information is safeguarded against unauthorized use or disclosure. These HHS funded programs are provided through state agencies, nursing homes, skilled nursing facilities, medical laboratories, hospitals, day care centers, social service agencies and other providers. Any person who believes that an individual has been discriminated against in the provision of these services because of race, color, national origin, disability, age, sex or religion, may file a complaint with OCR. An individual who believes that discrimination on the basis of disability has occurred in a health or social services program of a state or local government entity may file a complaint with OCR under Title II of the Americans with Disabilities Act of 1990, regardless of whether the entity receives Federal funds. Individuals may also file complaints of denials of health care for reasons other than the need and availability of services, by recipients of Hill-Burton grants and loans. In addition, a person may file a complaint under the Multiethnic Placement Act of 1994, as amended by Section 1808 of the Small Business Job Protection Act of 1996, alleging that an adoption or foster care agency or entity funded by HHS discriminatorily relied on a parent's or child's race, color, or national origin in making a placement decision. OCR will investigate complaints and take steps to ensure compliance with applicable civil rights laws. OCR also enforces the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule and Security Rule as well as the HITECH Breach Notification Rule and the confidentiality provisions of the Patient Safety and Quality Improvement Act (PSQIA) of 2005. OCR's activities under the Privacy, Security and Breach Notification Rules include enforcement actions, including conducting investigations, taking compliance actions, and making penalty determinations, and conducting public education, technical assistance and other outreach activities: to health care providers, health care clearinghouses, health plans, and business associates of covered entities to ensure that they understand their responsibilities under the Rules; to other entities that may be impacted by the Rules, including Federal, State and local government agencies, and researchers; and to consumers, to inform them of their rights under the Privacy Rule. Anyone who believes that a person, agency or organization covered under the HIPAA Privacy and Security Rules ("a covered entity") has violated the Privacy and/or Security Rules may file a complaint with OCR. In addition, the Breach Notification Rule requires HIPAA covered entities to promptly notify affected individuals of a breach, as well as the HHS Secretary and the media in cases where a breach affects more than 500 individuals; OCR is required to publish a list of entities that incur large breaches. Where a breach of unsecured protected health information occurs at or by a business associate, the business associate must notify the covered entity following the discovery of the breach. Additionally, the HITECH Act now makes business associates accountable for protecting the privacy and security of protected health information and directly liable for criminal and civil penalties for violations of HIPAA and Security Rules. OCR's activities under PSQIA include administering an enforcement program regarding the confidentiality protections, including conducting investigations, taking compliance actions, making penalty determinations, and interpreting standards for confidentiality protections and the enforcement program for guidance and technical assistance to Patient Safety Organizations (PSOs), providers and public information.

Complaints of discrimination and alleged violations of the HIPAA Privacy and Security Rules may be filed, and technical assistance information and public education may be requested, at the Headquarters and Regional Office locations of the Office for Civil Rights.

A complaint must be filed not later than 180 days of the alleged discrimination, unless the time for filing is waived for good cause. Complaints under the Privacy and/or Security Rules must be filed within 180 days of the date when the complainant knew, or should have known, that the act or omission complained of occurred, unless the time limit is waived for good cause. Complaint processing time varies considerably based on the type of complaint, the complexity of the issues, and current OCR caseload.

Individuals can appeal a civil rights discrimination complaint determination in some instances by submitting, in writing, a request for reconsideration to the Director, Office for Civil Rights. OCR imposes civil money penalties (CMPs) on covered entities and their business associates found to be in violation of the HIPAA Privacy, Security and/or Breach Notification Rules. If CMPs are imposed, the covered entity, or any applicable business associates, may request a hearing in which an HHS administrative law judge (ALJ) decides if the CMPs are supported by the evidence in the case. OCR is required to present the evidence to support the imposition of CMPs to the ALJ. The covered entity and/or business associate(s) may also then appeal the ALJ's decision to the HHS Departmental Appeals Board (DAB) and ultimately to the U.S. Courts of Appeal.