HHS: Fraudulent OCR investigator attempting to obtain PHI

The Department of Health and Human Services' Office for Civil Rights April 3 warned HIPAA-covered entities of an individual posing as an OCR investigator attempting to obtain patients’ protected health information. OCR is recommending that HIPAA-covered entities and business associates alert their workforce members and share steps to verify that someone is an OCR investigator, including asking for the individual’s email address, which will end in @hhs.gov, and asking for a confirming email from the OCR investigator’s hhs.gov email account. For additional questions or concerns, email OCRMail@hhs.gov.