Between April 2003 and October 31, 2024, the Office for Civil Rights (OCR) received over 374,000 HIPAA complaints. Of those, 31,191 proceeded to investigation and reached resolution. The most frequent allegations: impermissible uses or disclosures of Protected Health Information (PHI) and lack of safeguards. If your organization sends patient results, referrals, or billing inquiries via email, you're operating in the exact territory OCR scrutinizes most.
What the Numbers Reveal
255,953 complaints were dismissed as ineligible
Most complaints don't meet OCR's jurisdictional criteria. The event must involve a Covered Entity or Business Associate, describe conduct that would violate HIPAA if proven, and have occurred within the past six years. Complaints must be filed within 180 days of when the complainant knew or should have known about the issue, though OCR may grant exceptions for good cause.
Email security gaps are pervasive among breached organizations
A 2026 review of all 170 email-related breaches reported to OCR in 2025 found that 74% of organizations had no DMARC policy or set it to monitor-only. Over half had soft-fail or missing SPF records. None had implemented MTA-STS. These aren't exotic controls; they're foundational email authentication mechanisms that prevent spoofing and man-in-the-middle attacks.
Risk analysis failures appear in resolution agreements
OCR has repeatedly found that organizations failed to conduct a "thorough and accurate" risk assessment, as documented across numerous resolution agreements. The Security Rule requires you to assess risks and vulnerabilities in your environment. If you can't show OCR the analysis that informed your safeguard decisions, you can't defend those decisions.
Most investigations end with voluntary compliance
When OCR finds a violation, it attempts informal resolution through voluntary compliance, corrective action, or a resolution agreement. Most cases close at this stage. If informal resolution fails, you'll receive notice and have 30 days to present mitigating factors or affirmative defenses before OCR decides on a civil money penalty under 45 CFR 160.312.
What This Means for Your Team
A resolved complaint addresses one specific allegation. It doesn't validate your broader email practices, and it doesn't shield you from a compliance review. OCR can initiate reviews without receiving a complaint.
You need documentation that survives scrutiny. When OCR accepts a complaint, it notifies both parties and requests information. You're legally required to cooperate. That means producing the message in question, your email policy, training records, and your Business Associate Agreement with your email vendor. The HHS defines a Business Associate as an entity that sends PHI on behalf of a Covered Entity, so any email vendor transporting PHI falls into this category.
The Privacy Rule permits disclosing PHI for treatment purposes. A referral message between doctors involved in a patient's care is generally covered. But OCR will ask whether you had permission to share the information and whether you implemented reasonable safeguards. You can proceed with email if the patient considers it a reasonable communication channel. HHS FAQ 570 confirms you can use email for appointment reminders instead of mailing postcards, provided you implement reasonable safeguards.
The Security Rule lists encryption as an addressable specification. You must decide whether it's reasonable and appropriate, or document why you chose not to implement it and what alternative measures you put in place. Sending unencrypted emails for treatment-related patient communications is permissible under current HHS guidance, but only if other safeguards are present.
Action Items by Priority
Immediate: Conduct a documented risk analysis of your email environment
Assess risks and vulnerabilities specific to how your organization transmits PHI via email. Document the analysis, the safeguards you selected, and the rationale for addressable specifications you didn't implement. This is the foundation OCR expects to see.
Within 30 days: Implement email authentication controls
Configure DMARC with an enforcement policy (quarantine or reject, not monitor-only). Verify your SPF records are set to hard-fail. Deploy MTA-STS to prevent downgrade attacks. These controls reduce the attack surface for phishing and spoofing.
Within 60 days: Establish a searchable email archive
You need the ability to retrieve specific messages rapidly when OCR requests them. Archive all incoming and outgoing emails with search capability by sender, recipient, subject, content, and attachments.
Within 90 days: Document patient communication preferences and treatment context
For emails containing PHI, record the treatment nature of the communication and the patient's choice of email as a communication channel. This doesn't require explicit authorization for every message, but you should be able to demonstrate the disclosure was for treatment and the patient opted into email.
Ongoing: Review Business Associate Agreements with email vendors
Confirm your email vendor meets Business Associate requirements and that your agreement reflects their role in transmitting PHI. Update agreements when you change vendors or expand services.
Ongoing: Train staff on email policies and document completion
Maintain training records showing when staff completed email security and PHI handling training. OCR will request these records during an investigation.
