Final
Issued by: Office for Civil Rights (OCR)
HIPAA Enforcement
HHS’ Office for Civil Rights is responsible for enforcing the Privacy and Security Rules. Enforcement of the Privacy Rule began April 14, 2003 for most HIPAA covered entities. Since 2003, OCR's enforcement activities have obtained significant results that have improved the privacy practices of covered entities. The corrective actions obtained by OCR from covered entities have resulted in systemic change that has improved the privacy protection of health information for all individuals they serve.
HIPAA covered entities were required to comply with the Security Rule beginning on April 20, 2005. OCR became responsible for enforcing the Security Rule on July 27, 2009.
As a law enforcement agency, OCR does not generally release information to the public on current or potential investigations.
Enforcement Process
Learn how OCR enforces the Privacy and Security Rules and learn what OCR considers during its initial intake and review of a complaint. A flow diagram shows the HIPAA Complaint Process.
Enforcement Highlights
See a summary of OCR’s enforcement activities and up to date monthly results, including the number of cases in which corrective action was obtained, no violation was found, or other resolutions were achieved.
Enforcement Data
View our annual numbers of enforcement cases shown nationally and by state.
Case Examples and Resolution Agreements
View examples of the corrective actions OCR has obtained from covered entities.
HHS is committed to making its websites and documents accessible to the widest possible audience, including individuals with disabilities. We are in the process of retroactively making some documents accessible. If you need assistance accessing an accessible version of this document, please reach out to the guidance@hhs.gov.
DISCLAIMER: The contents of this database lack the force and effect of law, except as authorized by law (including Medicare Advantage Rate Announcements and Advance Notices) or as specifically incorporated into a contract. The Department may not cite, use, or rely on any guidance that is not posted on the guidance repository, except to establish historical facts.