On April 3, 2020, the Department of Health and Human Services Office for Civil Rights (“OCR”) released an alert warning covered entities and business associates of an individual posing as an OCR Investigator to obtain protected health information. According to the alert, “[t]he individual identifies themselves as an OCR Investigator on the telephone, but does not provide an OCR complaint transaction number or any other verifiable information relating to an OCR investigation.”

HIPAA covered entities and their business associates are encouraged to warn their workforce of potential scams and remind them of basic verification steps, such as asking for the Investigator’s email address (which will end in @hhs.gov) and asking for a confirmation email sent from the Investigator’s hhs.gov email.

Organizations can send questions and concerns to OCRMail@hhs.gov. Additionally, suspected incidents of individuals impersonating federal law enforcement should be reported to the Federal Bureau of Investigation (“FBI”). The FBI has also released a public service announcement regarding COVID-19-related fraud schemes.