Civil Rights and Privacy Rule Compliance Activities

 

The Office for Civil Rights (OCR) in the Department of Health and Human Services (HHS) promotes and ensures that people have equal access to and the opportunity to participate in and receive services from all HHS-funded programs without facing unlawful discrimination, and that the privacy of their health information is protected. OCR protects the civil rights of all individuals who are subjected to discrimination in health and human services programs, and protects the health information privacy rights of consumers, and ensures that electronic protected health information is safeguarded against unauthorized use of disclosure through investigations, voluntary dispute resolution, enforcement, technical assistance, policy development and information services.

Deleted 04/02/2020 (Archived.) 93.001 Agency: Department of Health and Human Services
Office: Office of the Secretary ADVISORY SERVICES AND COUNSELING; INVESTIGATION OF COMPLAINTS Fiscal Year 2014: Fiscal Year 2014: 21,247 total complaints received (4,412 civil rights discrimination cases and 16,835 Privacy Rule cases). Fiscal Year 2015: ). Fiscal Year 2015: OCR projects that approximately 22,000 individual complaints will be filed in FY 2015 (4,700 civil rights discrimination cases and 17,300 Privacy Rule cases). Fiscal Year 2016: Fiscal Year 2016: OCR annually resolves about 24,000 citizen complaints, alleging discrimination or a health information privacy or security violation. Civil Rights Act of 1964, Title VI, as amended; Rehabilitation Act of 1973, Sections 504 and 508, as amended; Education Amendments of 1972, Title IX, as amended; Age Discrimination Act of 1975, as amended; Nondiscrimination Provisions of the Public Health Service Act, Titles VI, VII, VIII, and XVI, as amended; Omnibus Budget Reconciliation Act of 1981, Public Law 97-35, as amended; Drug Abuse Offense and Treatment Act of 1972, Section 407; Comprehensive Alcohol Abuse and Alcoholism Prevention, Treatment and Rehabilitation Act of 1970, Section 321, as amended; Low-Income Home Energy Assistance Act of 1981, 42 U.S.C. 8625; Community Services Block Grant Act, 42 U.S.C. 398; Family Violence Prevention and Services Act, as amended, Section 307 (a)(1) and (2), Public Law 98-457; Americans with Disabilities Act of 1990, Title II, Subtitle A, Public Law 101-336; Small Business Job Protection Act of 1996, Section 1808, Public Law 104-188; Section 1557 of the Patient Protection and Affordable Care Act; Section 1553 of the Affordable Care Act; Federal Health Care Conscience Protection Statutes, which include the Church Amendments, (42 U.S.C. § 300a-7); Health Insurance Portability and Accountability Act of 1996 (HIPAA), 42 U.S.C. 1320d-8, 45 CFR Part 160 and Subparts A, C and E of Part 164--Standards for Privacy of Individually Identifiable Health Information (the "Privacy Rule") and Standards for the Protection of Electronic Protected Health Information (the "Security Rule"); Public Health Service Act, Title IX, 42 U.S.C. 299b-22, as amended by the Patient Safety and Quality Improvement Act of 2005, Public Law 109-41; Part C of title XI of the Social Security Act, 42 U.S.C. 1320d-d-8, as amended by Section 105 of the Genetic Information Nondiscrimination Act of 2008 (GINA), Public Law 110–233; Subtitle D of the Health Information Technology for Economic and Clinical Health (HITECH) Act, Public Law 111-5, 123 Stat. 115 (2009), and 45 CFR Subpart D of Part 164 - Breach Notification for Unsecured Protected Health Information (the "Breach Notification Rule"). Anyone who believes he or she has been discriminated against in the manner outlined, seeks information concerning civil rights, and recipients of Federal financial assistance who desire technical assistance and information for the purpose of assuring their compliance with nondiscrimination laws. Regarding the HIPAA Privacy and Security Rules, anyone who believes that the Privacy and/or Security Rules have been violated in the manner outlined or who seeks information about these Rules; consumers that need to know their rights under the Privacy Rule; and entities that need technical assistance and information for the purpose of assuring compliance with the Privacy and Security Rules. Individuals subject to discrimination and recipients who require technical assistance and information. Regarding the HIPAA Privacy Rule, individuals subject to violation of their health information privacy, covered entities, and others needing or seeking technical assistance and information concerning the Rule. No Credentials or documentation are required. This program is excluded from coverage under 2 CFR 200, Subpart E - Cost Principles. Preapplication coordination is not applicable. Environmental impact information is not required for this program. This program is excluded from coverage under E.O. 12372. This program is excluded from coverage under 2 CFR 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Complaints of discrimination and alleged violations of the HIPAA Privacy and Security Rules may be filed, and technical assistance information and public education may be requested, at the Headquarters and Regional Office locations of the Office for Civil Rights. None. Not Applicable. A complaint must be filed not later than 180 days of the alleged discrimination, unless the time for filing is waived for good cause. Complaints under the Privacy and/or Security Rules must be filed within 180 days of the date when the complainant knew, or should have known, that the act or omission complained of occurred, unless the time limit is waived for good cause. Complaint processing time varies considerably based on the type of complaint, the complexity of the issues, and current OCR caseload. Individuals can appeal a civil rights discrimination complaint determination in some instances by submitting, in writing, a request for reconsideration to the Director, Office for Civil Rights. OCR imposes civil money penalties (CMPs) on covered entities and their business associates found to be in violation of the HIPAA Privacy, Security and/or Breach Notification Rules. If CMPs are imposed, the covered entity, or any applicable business associates, may request a hearing in which an HHS administrative law judge (ALJ) decides if the CMPs are supported by the evidence in the case. OCR is required to present the evidence to support the imposition of CMPs to the ALJ. The covered entity and/or business associate(s) may also then appeal the ALJ's decision to the HHS Departmental Appeals Board (DAB) and ultimately to the U.S. Courts of Appeal. Not Applicable. Not Applicable. The Office for Civil Rights (OCR) in the Department of Health and Human Services (HHS) is responsible for promoting and ensuring that people have equal access to and the opportunity to participate in and receive services from all HHS-funded programs without facing unlawful discrimination, that the privacy of their health information is protected, and that electronic protected health information is safeguarded against unauthorized use or disclosure. These HHS funded programs are provided through state agencies, nursing homes, skilled nursing facilities, medical laboratories, hospitals, day care centers, social service agencies and other providers. Any person who believes that an individual has been discriminated against in the provision of these services because of race, color, national origin, disability, age, sex or religion, may file a complaint with OCR. An individual who believes that discrimination on the basis of disability has occurred in a health or social services program of a state or local government entity may file a complaint with OCR under Title II of the Americans with Disabilities Act of 1990, regardless of whether the entity receives Federal funds. Individuals may also file complaints of denials of health care for reasons other than the need and availability of services, by recipients of Hill-Burton grants and loans. In addition, a person may file a complaint under the Multiethnic Placement Act of 1994, as amended by Section 1808 of the Small Business Job Protection Act of 1996, alleging that an adoption or foster care agency or entity funded by HHS discriminatorily relied on a parent’s or child's race, color, or national origin in making a placement decision. OCR will investigate complaints and take steps to ensure compliance with applicable civil rights laws.

OCR also enforces the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule and Security Rule as well as the HITECH Breach Notification Rule and the confidentiality provisions of the Patient Safety and Quality Improvement Act (PSQIA) of 2005. OCR's activities under the Privacy, Security and Breach Notification Rules include enforcement actions, including conducting investigations, taking compliance actions, and making penalty determinations, and conducting public education, technical assistance and other outreach activities: to health care providers, health care clearinghouses, health plans, and business associates of covered entities to ensure that they understand their responsibilities under the Rules; to other entities that may be impacted by the Rules, including Federal, State and local government agencies, and researchers; and to consumers, to inform them of their rights under the Privacy Rule. Anyone who believes that a person, agency or organization covered under the HIPAA Privacy and Security Rules ("a covered entity") has violated the Privacy and/or Security Rules may file a complaint with OCR. In addition, the Breach Notification Rule requires HIPAA covered entities to promptly notify affected individuals of a breach, as well as the HHS Secretary and the media in cases where a breach affects more than 500 individuals; OCR is required to publish a list of entities that incur large breaches. Where a breach of unsecured protected health information occurs at or by a business associate, the business associate must notify the covered entity following the discovery of the breach. Additionally, the HITECH Act now makes business associates accountable for protecting the privacy and security of protected health information and directly liable for criminal and civil penalties for violations of HIPAA and Security Rules.

OCR's activities under PSQIA include administering an enforcement program regarding the confidentiality protections, including conducting investigations, taking compliance actions, making penalty determinations, and interpreting standards for confidentiality protections and the enforcement program for guidance and technical assistance to Patient Safety Organizations (PSOs), providers and public information. No reports are required. No audits are required for this program. None. This program has no statutory formula.
This program has no matching requirements.
This program does not have MOE requirements. Not applicable. See the following for information on how assistance is awarded/released: Not applicable. See Regional Agency Offices. Region I - Boston (Connecticut, Maine, Massachusetts, New Hampshire, Rhode Island, Vermont)
Susan Pezzullo-Rhodes, Regional Manager
Office for Civil Rights
U.S. Department of Health and Human Services
Government Center
J.F. Kennedy Federal Building - Room 1875
Boston, MA 02203
Voice phone 800-368-1019
FAX (617) 565-3809
TDD (617) 565-1343

Region II - New York (New Jersey, New York, Puerto Rico, Virgin Islands)
Linda C. Colon, Regional Manager
Office for Civil Rights
U.S. Department of Health and Human Services
Jacob Javits Federal Building
26 Federal Plaza - Suite 3312
New York, NY 10278
Voice Phone 800-368-1019
FAX (212) 264-3039
TDD (212) 264-2355

Region III - Philadelphia (Delaware, District of Columbia, Maryland, Pennsylvania, Virginia, West Virginia)
Barbara Holland, Regional Manager
Office for Civil Rights
U.S. Department of Health and Human Services
150 S. Independence Mall West
Suite 372, Public Ledger Building
Philadelphia, PA 19106-9111
Main Line 800-368-1019
FAX (215) 861-4431
TDD (215) 861-4440

Region IV - Atlanta (Alabama, Florida, Georgia, Kentucky, Mississippi, North Carolina, South Carolina, Tennessee)
Timothy Noonan, Regional Manager
Office for Civil Rights
U.S. Department of Health and Human Services
Atlanta Federal Center, Suite 3B70
61 Forsyth Street, S.W.
Atlanta, GA 30303-8909
Voice Phone 800-368-1019
FAX (404) 562-7881
TDD (404) 331-2867

Region V - Chicago (Illinois, Indiana, Michigan, Minnesota, Ohio, Wisconsin)
Celeste Davis, Regional Manager
Office for Civil Rights
U.S. Department of Health and Human Services
233 N. Michigan Ave., Suite 240
Chicago, IL 60601
Voice Phone 800-368-1019
FAX (312) 886-1807
TDD (312) 353-5693

Region VI - Dallas (Arkansas, Louisiana, New Mexico, Oklahoma, Texas)
Marisa Smith, Regional Manager
Office for Civil Rights
U.S. Department of Health and Human Services
1301 Young Street, Suite 1169
Dallas, TX 75202
Voice Phone 800-368-1019
FAX (214) 767-0432
TDD (214) 767-8940

Region VII - Kansas City (Iowa, Kansas, Missouri, Nebraska)
Steven Mitchell, Deputy Regional Manager
Office for Civil Rights
U.S. Department of Health and Human Services
601 East 12th Street - Room 248
Kansas City, MO 64106
Voice Phone 800-368-1019
FAX (816) 426-3686
TDD (816) 426-7065

Region VIII - Denver (Colorado, Montana, North Dakota, South Dakota, Utah, Wyoming)
Andrea Oliver, Regional Manager
Office for Civil Rights
U.S. Department of Health and Human Services
1961 Stout Street, Rm. 08-148
Denver, CO 80294
Voice Phone 800-368-1019
FAX (303) 844-2025
TDD (303) 844-3439

Region IX - San Francisco (American Samoa, Arizona, California, Guam, Hawaii, Nevada)
Michael Leoz, Regional Manager
Office for Civil Rights
U.S. Department of Health and Human Services
90 7th Street, Suite 4-100
San Francisco, CA 94103
Voice Phone 800-368-1019
FAX (415) 437-8329
TDD (415) 437-8311

Region X - Seattle(Alaska, Idaho, Oregon, Washington)
Linda Yuu Connor, Regional Manager
Office for Civil Rights
U.S. Department of Health and Human Services
701 Fifth Avenue, Suite 1600, MS-11
Seattle, WA 98104
Voice Phone 800-368-1019
FAX (206) 615-2297
TDD (206) 615-2296.

Headquarters Office (152):
Director, Office for Civil Rights, Hubert H. Humphrey Building - Mail Stop Room 509-F6, 200 Independence Ave. S.W., Washington, District of Columbia 20201 Email: OCRMail@hhs.gov Phone: 800-368-1019
Website Address (153):
http://www.hhs.gov/ocr
Related Programs (160):
Not Applicable.
Examples of Funded Projects (170):
Not Applicable.
Criteria for Selecting Proposals (180):
Not Applicable. Director, Office for Civil Rights, Hubert H. Humphrey Building - Mail Stop Room 509-F6, 200 Independence Ave. S.W., Washington, District of Columbia 20201 Email: OCRMail@hhs.gov Phone: 800-368-1019 http://www.hhs.gov/ocr 75-0135-0-1-751. (Investigation of Complaints) FY 14 $38,798,000; FY 15 est $38,798,000; and FY 16 est $42,705,000 Not applicable. Title VI of the Civil Rights Act of 1964--the implementing regulation (45 CFR 80), "Your Rights Under Title VI of the Civil Rights Act of 1964 fact sheet, "Know Your Rights" brochure regarding national origin discrimination and limited English proficiency, a video in VHS and DVD formats entitled "Title VI Limited English Proficiency"; Section 504 of the Rehabilitation Act of 1973--the implementing regulation for HHS funded programs and activities (45 CFR 84), and fact sheets "Your Rights Under Section 504," "Your Rights as a Person with HIV Infection, AIDS, or Related Conditions," "Your Rights Under Section 504 and the Americans with Disabilities Act," and the HHS Section 504 federally conducted regulation (45 CFR 85); Age Discrimination Act of 1975--implementing regulations, HHS (45 CFR 91) and government-wide (45 CFR 90), and fact sheet "Your Rights Under the Age Discrimination Act"; Federal Health Care Provider Conscience Protection Statutes (including the Church Amendments, Section 245 of the Public Health Service Act, and the Weldon Amendment) implementing regulation (45 CFR 88), and, "Your Rights Under the Federal Health Care Provider Conscience Protection Laws" fact sheet, Community Service Assurance of the Hill-Burton regulation (42 CFR 124) and fact sheet "Community Service Assurance Under the Hill-Burton Act"; Sex Discrimination in Health-Related Training Programs regulation (45 CFR 83); fact sheets on: Section 1808/Multiethnic Placement Act (MEPA); the Americans with Disabilities Act (ADA); "How to File a Discrimination Complaint with OCR"; "Know Your Civil Rights"; Civil Rights Frequently Asked Questions; a video presentation: OCR guidance on Temporary Assistance for Needy Families (TANF) and Disability; OCR guidance documents and questions and answers on MEPA; various technical assistance materials for Medicare providers and applicants, including a sample nondiscrimination policy, LEP policy, auxiliary aids policy, accessibility policy, and grievance procedure, and various other civil rights publications.

HIPAA regulations and standards: The Privacy Rule and the Security Rule, 45 CFR Part 160 and Subparts A, C and E of Part 164; the Breach Notification Rule, 45 CFR Subpart D of Part 164; "Your Health Information Privacy Rights"; "Privacy, Security, and the Electronic Health Record"; "Understanding the HIPAA Notice, and Sharing Health Information with Family and Friends." These consumer-facing brochures are also available in eight languages: Korean, Vietnamese, Simplified Chinese, Traditional Chinese, Polish, Russian, Tagalog, and Spanish. OCR also has sight videos available on various aspects of the HIPAA Privacy Rule for consumers and two designed for health care providers, as well as posters and a brochure entitled "Information is Powerful Medicine," which targets HIV-positive individuals and addresses their right to access and manage their medical records under the HIPAA Privacy Rule. Materials designed for covered entities designed for covered entities and their business associates include "Guidance on Risk Analysis Requirements Under the Security Rule" fact sheets and guidance on specific aspects of the Privacy and Security Rules, and additional compliance tools such as "Am I a Covered Entity", "the Security Rule Educational Paper Series", and Frequently Asked Questions (FAQs). A complete list of Privacy Rule publications is available.

There is also a brochure titled "Safeguarding Civil Rights Health Information Privacy," which provides general information about the Office for Civil Rights and its services. All literature is available at no charge; however, because of budgetary constraints and availability of stock, quantities may be limited. Most publications can be downloaded from OCR's website and are available in languages other than English. All publications are available in alternative formats for individuals with disabilities.
Not Applicable.