OCR Warns of Postal Scam Targeting HIPAA Compliance Officers
The Department of Health and Human Services’ Office for Civil Rights is warning healthcare organizations about a potential phishing scam being conducted by mail that has been designed to scare compliance officers into visiting a website or taking other immediate action with respect to a mandatory HIPAA risk assessment.
Postcards have been sent to several healthcare organizations that masquerade as an official communication from the Office for Civil Rights. The postcards are addressed to the HIPAA compliance officer and state a mandatory HIPAA compliance risk assessment must be performed. The postcards warn that “HIPAA violations cost your practice. The federal fines for noncompliance are based on perceived negligence found within your organization at the time of the HIPAA violation.” The postcards remind the recipient that “fines can range from $100 to $50,000 per violation (or per record), with a maximum penalty of $1.5 million per year for each violation.”
The postcards claim to have been sent by the Secretary of Compliance of the HIPAA Compliance Division – a position that does not exist – and have a Washington D.C. return address. The link that compliance officers are requested to visit markets consulting services and is a non-governmental site.
OCR has advised all covered entities to alert their workforce about the misleading communication, which appears to have been sent by a private company. OCR stressed that this is not a communication sent by the HHS or OCR.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
OCR advises HIPAA covered entities and business associates to take steps to verify the legitimacy of any communication that claims to be from the HHS or OCR, and explained that any written communications from OCR will include the following address:
Office for Civil Rights
U.S. Department of Health and Human Services
200 Independence Avenue, SW
Room 509F, HHH Building
Washington, D.C. 20201
Any request to make contact via email will provide an email address for contact that has an @hhs.gov suffix.
The impersonation of federal law enforcement is a crime and any suspected cases should be reported to the Federal Bureau of Investigation.
