Which entity may investigate complaints under HIPAA?

The Department of Health and Human Services (HHS) is the entity responsible for investigating complaints filed under the Health Insurance Portability and Accountability Act (HIPAA). HHS operates through its Office for Civil Rights (OCR), which is tasked with enforcing HIPAA regulations, protecting patient rights, and ensuring compliance with privacy standards.

When individuals believe their HIPAA rights have been violated, they can file a complaint with HHS. The OCR investigates these complaints to determine whether there has been a breach of the privacy and security rules established under HIPAA. If violations are found, HHS has the authority to impose penalties, engage in compliance reviews, and take corrective action to address issues.

Local health departments, individual healthcare providers, and state courts do not hold the same investigatory authority under HIPAA as HHS does. While local health departments may have a role in public health issues, they do not enforce HIPAA. Individual healthcare providers are primarily responsible for compliance rather than investigation. State courts generally handle legal disputes and may interpret HIPAA in the context of specific cases but do not conduct investigations related to HIPAA complaints. Therefore, the correct answer highlights the pivotal role of HHS in overseeing HIPAA compliance and protecting patient rights.