TMB received the following information from Office of the Attorney General of Texas:

 

 The Medicaid Fraud Control Unit field office in Dallas, was alerted to a scheme involving an entity named “The Office for HIPPA(sic) Compliance” sending invoices to medical professionals for the HIPPA Compliance Report. This situation came to the attention of the Dallas field office due to a direct contact from one of the individuals who was

sent one of these invoices.

 

Upon receiving a letter and a copy of an invoice with The Office of HIPPA Compliance listed as the entity who was billing medical personnel., an investigation was conducted. There were several indications that this was not a valid organization, including the misspelling of the street name and the use of “HIPPA” instead of “HIPAA,” which is the correct acronym. The address given on the invoice goes to a UPS Store in Crystal Lake, Illinois. The UPS Store rents private mailboxes to individuals and these type of mailboxes are sometimes used to hide the identity of individuals involved in criminal activities. An inquiry was made to the Health Assistance Partnership in Illinois, with confirmation that there was no requirement for medical professionals to pay for the “HIPPA Compliance Report” and they were unaware of an official entity called “The Office for HIPPA Compliance.”

 

The Medicaid Fraud Control Unit in Illinois was contacted by telephone and this information was provided for their investigation of the person or persons responsible for this scheme. Because of the ease of perpetuating such a scheme, it was determined that medical personnel and their oversight agencies needed to be alerted in order to avoid falling victim.

 

There is no requirement for medical personnel to pay for a HIPAA Compliance Report. These individuals are being sent invoices for the amount of $19.99, which may result in many being paid without office managers and medical personnel checking to determine whether or not this

is a legitimate billing. All medical personnel and their oversight agencies need to be aware that no one is required to pay for reports relating to HIPAA compliance and that such invoices are most likely false. Information regarding HIPAA compliance is readily available through the Internet, including such sites as http://www.hipaa.org/ All medical personnel should be encouraged to utilize known resources for information regarding HIPAA compliance, rather than paying for information from any organization.