OCR Exercises Its Enforcement Discretion

Last month we had the first case in which Office of Civil Rights used it HIPAA civil money penalty power, and it is a douzy. 


See full article here.


Note to self #1: respond to subpoena from the OCR. 


Note to self #2: when responding to a HIPAA violation complaint, do not include PHI on 4,500 patients outside the scope of the complaint.