If the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) receives a HIPAA complaint, it will review it to see if it has jurisdiction over the matter. If OCR accepts the complaint for investigation, it notifies the complainant and the organization and requests relevant information. When practices send out results, referrals, or billing inquiries via email, the content of those messages is something that the OCR might scrutinize, as well as the underlying policies and the agreements with vendors.

The HHS received over 374,000 complaints between April 2003 and October 31st, 2024. Of those, 255,953 were deemed ineligible for enforcement, while 31,191 cases that proceeded to investigation resulted in a resolution.

The most common allegations were impermissible uses/disclosures of protected health information (PHI) and lack of safeguards. It illustrates how a misdirected email can fall afoul of both stipulations. If the OCR starts asking questions, this is precisely the kind of detail they'll expect.

 

Confirm whether OCR can act on the complaint

The HHS specifies that the OCR's capacity to take action is limited to events that occurred within the past six-year period. For the HHS to act, the company must be either a covered entity or business associate, and the complaint must describe conduct that, if proven, would violate HIPAA. Complaints must also be submitted within 180 days of when they knew or should have known about the issue. There is room for OCR to grant an exception to this deadline when good cause is established.

It is a point your compliance department can straightforwardly ascertain during their review of the complaint. OCR typically won't pursue complaints about a doctor sharing information with another provider for a consultation, given that the Privacy Rule permits such disclosures for treatment. Generally, a referral message exchanged between doctors involved in a patient's treatment would be covered. As a general rule, employers and life insurance entities are not subject to HIPAA's covered entity requirements. 

Read also: What triggers a HIPAA investigation?

 

Expect a notice and a request for information

In cases where OCR accepts the complaint, both the filer and the covered entity will be notified. Information about the incident will be sought from both involved parties. HHS clarifies that covered entities are mandated by law to cooperate with complaint investigations.

OCR can require you to provide certain information, so your organization should have that information readily available. This means furnishing the message being reviewed, your established email policy, training records for your team, and your contract with the email vendor.

The HHS defines a business associate as an entity that sends PHI on behalf of a covered entity. Consequently, any email vendor transporting PHI would be considered part of this group. Having a searchable archive means you can locate the message more rapidly. Paubox Email Suite Premium tier lets you archive all your incoming and outgoing emails, making them searchable by sender, recipient, subject, content, and any attached files.

 

Show why the email was permitted

A common inquiry in these email complaints is whether practices had permission to share the information. According to HHS FAQ 570, when it comes to communicating with patients via email, the answer is indeed yes, provided you implement reasonable safeguards. You can also proceed with email if the patient considers it a reasonable communication channel. As an illustration, HHS suggests using email for appointment reminders instead of mailing them out on postcards.

The patient's explicit authorization to email them isn't the single determinant of the practice's ability to disclose information. Under the Privacy Rule, disclosing information for treatment is permissible. A straightforward approach is to document the treatment nature of the communication and the patient's choice of email.

 

Document the safeguards behind the message

The fact that an organization has the ability to send information does not mean the email was secure. HHS guidance indicates that sending unencrypted emails for treatment-related patient communications is permissible. Other forms of security can be utilized when sending emails to patients. The Security Rule lists encryption as an addressable specification. The decision to use it comes down to whether your organization finds it reasonable and appropriate or if you document the rationale for not implementing it and the alternative measures in place.

Across numerous HHS resolution agreements documented in the Innovations in Clinical Neuroscience, the OCR has repeatedly discovered that organizations failed to conduct a "thorough and accurate" risk assessment.

In the 2026 Healthcare Email Security Report created by Paubox, we reviewed all 170 email-related breaches reported to OCR in 2025 and looked at each organization's public data. We found that 74% of organizations had no DMARC, or their policy was set to monitor only. Over half of the organizations we looked at had soft-fail or missing SPF records. None of the organizations we looked at had MTA-STS in place.

 

Understand how the case can end

The OCR will send notice to both parties in writing with the outcome of the investigation. If there was no violation, then the case will be dismissed. If the OCR finds a violation, it will attempt to resolve the matter through voluntary compliance, corrective action, resolution agreement, or some combination of all three. According to the HHS, most investigations end at this stage.

According to 45 CFR 160.312, if an informal resolution fails, the practice will be given notice and have 30 days to provide any information that would support a mitigating factor or affirmative defense to the OCR before they can decide on a civil money penalty. The penalty can be appealed before an HHS administrative law judge, and complainants are not awarded any portion of the money. The OCR can also decide to report any information that may be a violation of the Criminal HIPAA provision to the Department of Justice.

 

Recognize what a complaint process cannot settle

A resolved complaint signifies that one specific allegation has been dealt with. A determination of no violation doesn't guarantee that an organization's other email configurations are compliant. The OCR is also capable of initiating compliance reviews without receiving a complaint.

The enforcement figures on the HHS highlights page are current up to October 2024, meaning the latest counts might be different. The Paubox findings come from a vendor report on breached organizations only, with no comparison group, so they show common gaps but cannot show the settings that caused the breaches.

In December 2024, the HHS put forth its suggested amendments to the Security Rule, indicating the existing regulations would remain effective throughout the rulemaking process. Organizations must continue to meet existing obligations and monitor updates regarding mandated safeguards.

See also: HIPAA Compliant Email: The Definitive Guide (2026 Update)

 

FAQs

How long does a person have to file a HIPAA complaint with the OCR?

Complaints generally must be filed within 180 days of when the person knew or should have known about the alleged violation, although the OCR may waive the limit for good cause.

 

Does the OCR notify the organization when it accepts a complaint?

Yes, the OCR notifies both the person who filed the complaint and the covered entity named in it, then asks each to present information about the incident.

 

Does HIPAA require encrypting every email to patients?

Not in every circumstance, because the Security Rule currently treats encryption as an addressable specification, although the Privacy Rule still requires reasonable safeguards for patient email.