HIPAA is governed primarily by the U.S. Department of Health and Human Services, which writes the rules through its Office for Civil Rights (OCR) and enforces most of them the same way. But OCR is not the whole picture. The Department of Justice prosecutes criminal violations, the Centers for Medicare & Medicaid Services handles a narrower set of technical standards, state attorneys general can bring civil suits on behalf of their residents, and the Federal Trade Commission polices health data from companies HIPAA does not reach at all. Which agency matters to you depends on who mishandled the information and how.
HHS Writes the Rules
Congress gave HHS the authority to draft and implement the regulations that turn the HIPAA statute into working law. That includes the Privacy Rule (finalized in 2000, modified in 2002), the Security Rule (finalized in 2003), the Breach Notification Rule, and the Enforcement Rule that spells out how violations are handled.1HHS.gov. HIPAA for Professionals
Those rules bind three categories of “covered entities”: healthcare providers who transmit health information electronically, health plans, and healthcare clearinghouses.2Centers for Disease Control and Prevention. Health Insurance Portability and Accountability Act of 1996 (HIPAA) They also bind business associates, which are outside companies or individuals that handle protected health information on a covered entity’s behalf: billing services, IT contractors, law firms reviewing medical records, cloud storage providers, and the like. The HITECH Act of 2009 made business associates directly liable under HIPAA rather than merely contractually bound through their agreements with covered entities.3HHS.gov. Business Associates
HHS itself does not run day-to-day enforcement. It delegates that work to sub-agencies, primarily OCR.
OCR Handles Most Enforcement
When people talk about “HIPAA enforcement,” they usually mean the Office for Civil Rights. This office inside HHS enforces the Privacy Rule, the Security Rule, and the Breach Notification Rule.4HHS.gov. HIPAA Enforcement It does that through three main channels: investigating individual complaints, running compliance reviews on its own initiative, and conducting periodic audits.
Most enforcement begins with a complaint. Anyone who believes a covered entity or business associate violated their health information privacy rights can file one with OCR. When OCR finds a problem, it usually tries to resolve the matter informally. The entity may agree to a corrective action plan, or the two sides may sign a resolution agreement that includes specific compliance obligations and, sometimes, a settlement payment. Civil money penalties come into play only when informal resolution fails.5HHS.gov. Resolution Agreements and Civil Money Penalties Penalties are tiered by culpability, from genuine ignorance at the low end to uncorrected willful neglect at the top, with amounts adjusted for inflation each year.6Office of the Law Revision Counsel. 42 USC 1320d-5 General Penalty for Failure to Comply with Requirements and Standards
OCR also runs an audit program required by the HITECH Act. Audits let the office identify risks and vulnerabilities that never surface through complaints. The 2024–2025 cycle focused on 50 entities’ compliance with Security Rule provisions related to hacking and ransomware.7HHS.gov. OCR’s HIPAA Audit Program
Breach reporting flows through OCR as well. Covered entities that discover a breach of unsecured protected health information must notify affected individuals without unreasonable delay and no later than 60 days after discovering the breach. Breaches affecting 500 or more people must be reported to HHS through OCR’s online tool within that same window, along with prominent media outlets in the affected states.8eCFR. 45 CFR 164.408 – Notification to the Secretary Smaller breaches can be reported to HHS annually. OCR maintains a public list of larger breaches that functions as both a transparency tool and a deterrent.
CMS Handles Administrative Simplification
The Centers for Medicare & Medicaid Services enforces the Administrative Simplification provisions of HIPAA. These are the less headline-grabbing standards for electronic transactions, code sets, and unique health identifiers. CMS investigates complaints and conducts compliance audits related to these standards, and much of its work is educational, teaching providers, health plans, and clearinghouses how to format and transmit data properly.9Centers for Medicare & Medicaid Services. Enforcement and Compliance If a compliance inquiry lands on your desk about electronic transaction formats rather than a data breach, CMS is likely the agency behind it.
The Department of Justice Prosecutes Criminal Violations
OCR handles the civil side. When someone knowingly violates HIPAA, the case can turn criminal, and OCR refers those matters to the Department of Justice, which prosecutes under 42 U.S.C. § 1320d-6. Criminal penalties are tiered by intent:10Office of the Law Revision Counsel. 42 U.S. Code 1320d-6 – Wrongful Disclosure of Individually Identifiable Health Information a knowing violation carries up to a $50,000 fine and one year in prison; a violation under false pretenses, up to $100,000 and five years; and a violation committed with intent to sell, use for commercial advantage, or cause malicious harm, up to $250,000 and ten years.
Criminal cases are relatively uncommon compared with civil enforcement. The typical defendant is not a hospital administrator who made a policy mistake but someone who deliberately accessed records for personal reasons: snooping on a celebrity’s chart, looking up an ex-spouse, or stealing patient data to commit identity theft. The “knowingly” element is what separates civil from criminal territory. An accidental exposure stays civil. Pulling up records you have no business viewing is where criminal liability begins.11Department of Justice. Scope of Criminal Enforcement Under 42 USC 1320d-6
State Attorneys General Can Sue
HIPAA enforcement was exclusively federal until 2009. The HITECH Act changed that by giving state attorneys general the power to bring civil actions on behalf of their residents for Privacy Rule and Security Rule violations.12HHS. State Attorneys General A state AG can seek financial damages for affected individuals or ask a court to enjoin an ongoing violation.
There is a coordination step. Before filing suit, a state attorney general must serve HHS with a copy of the complaint at least 48 hours in advance. The only exception is when immediate injunctive relief is necessary, and even then the state must notify HHS as soon as possible afterward. The requirement exists because OCR may already be investigating the same entity, and overlapping enforcement can complicate both cases.
State attorneys general have become more active in this space, especially after large data breaches affecting their residents. Their involvement gives patients a second enforcement track that often moves faster than OCR and responds more directly to localized harm.
The FTC Covers Health Data Outside HIPAA
HIPAA reaches only covered entities and their business associates. A large and growing category of health-related companies falls outside that scope entirely: fitness trackers, period-tracking apps, mental health platforms, telehealth startups that do not qualify as covered providers, and direct-to-consumer genetic testing services. These companies handle deeply personal health data, and HIPAA does not touch them.
The Federal Trade Commission fills that gap. It enforces the Health Breach Notification Rule (16 CFR Part 318), which applies to vendors of personal health records and related entities that are not HIPAA covered entities or business associates.13eCFR. Part 318 Health Breach Notification Rule The rule requires these companies to notify consumers when their health information is breached or improperly shared, and violations are treated as unfair or deceptive trade practices under the FTC Act, which carries civil penalties.
In 2023, the FTC imposed a $1.5 million civil penalty on GoodRx for sharing consumers’ health information with advertising companies without notifying users, the agency’s first enforcement action under the Health Breach Notification Rule.14Federal Trade Commission. FTC Enforcement Action to Bar GoodRx from Sharing Consumers Sensitive Health Info for Advertising If you use a health app that has no connection to your doctor or insurance plan, the FTC, not OCR, has jurisdiction over your data.
You Cannot Sue Under HIPAA Yourself
This is the single biggest misconception about HIPAA enforcement. HIPAA does not give individuals a private right of action. You cannot sue a hospital, doctor’s office, or insurance company for violating HIPAA. Federal courts have consistently refused to recognize such a right.
Your recourse under HIPAA itself is limited to filing a complaint with OCR, which may or may not investigate and may or may not impose penalties. Any fines collected go to the federal government, not to you. The same facts that make out a HIPAA violation can, however, support state law claims: negligence, invasion of privacy, breach of fiduciary duty, or a claim under state medical privacy or data breach statutes. Attorneys sometimes use HIPAA standards as evidence of the duty of care a provider owed, even though HIPAA is not the legal basis for the suit.
How to File a Complaint With OCR
If you believe a covered entity or business associate mishandled your health information, OCR is the agency to contact. The deadline is 180 days from the date you learned about the violation, though OCR can extend that window for good cause.15HHS.gov. How to File a Health Information Privacy or Security Complaint
Your complaint needs to include your full name, address, phone number, and email; the name, address, and phone number of the person or organization you are complaining about; a description of how, why, and when you believe your rights were violated; and your signature and the date. OCR will not investigate anonymous complaints. If you are filing for someone else, include that person’s name too. Complaints can be submitted through OCR’s online portal, by mail, or by email.
OCR first checks the complaint for jurisdiction and merit, then decides whether to investigate. Most complaints resolve without financial penalties, often because the entity simply agrees to fix the problem. But the complaint creates a record, and patterns of complaints against the same entity can trigger the kind of compliance review that does lead to enforcement.