Amid a “severe strain” and “limited staff and resources,” the HHS Office for Civil Rights (OCR) released its calendar year 2021 compliance activity report to Congress, which shows OCR investigated just 4.3% of complaints of potential HIPAA violations.^[1] Although no details were provided, OCR said it found “insufficient evidence that a violation of the HIPAA Rules had occurred” in 50% of the cases it did investigate.

The report, required under the HITECH Act, also showed OCR didn’t conduct any audits of HIPAA-covered entities or business associates, despite the law’s requirement that it “undertake periodic audits.” According to RPP’s review of prior annual reports, the last audits were conducted in 2017 as part of the second and final phase of a pilot. OCR released the results of the pilot in December 2020.^[2]

Issued last month, the 2021 report marks the first time OCR cited a reason for the audit inactivity, stating, “OCR did not perform any audits in 2021 due to a lack of financial resources.”

Most of the 25-page report is devoted to background information about OCR’s responsibilities when it comes to HIPAA oversight; a recitation of its enforcement actions in 2021 fills the final 10 pages.

A lack of financial resources is a strong theme in the report, which was submitted to the Senate Committee on Health, Education, Labor, and Pensions and House Ways and Means and Energy and Commerce Committees.