The U.S. Department of Health and Human Services Office for Civil Rights enforces the HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification Rule for HIPAA Covered Entities and Business Associates, while the U.S. Department of Justice prosecutes criminal violations of HIPAA and the Centers for Medicare and Medicaid Services enforces HIPAA Administrative Simplification standards for certain electronic transactions.
The Office for Civil Rights administers the federal civil enforcement program for most HIPAA compliance obligations that apply to protected health information, including investigating complaints, reviewing breach reports, conducting compliance reviews, and resolving cases through corrective action and, when warranted, civil monetary penalties. Office for Civil Rights jurisdiction covers HIPAA Covered Entities and Business Associates and focuses on compliance with requirements for uses and disclosures of protected health information, safeguards for electronic protected health information, individual rights, administrative requirements, and breach notification obligations.
The U.S. Department of Justice has criminal enforcement authority for knowing misconduct involving protected health information, including prohibited obtaining or disclosure in circumstances addressed by the criminal provision of HIPAA. The Office for Civil Rights refers matters to the U.S. Department of Justice when facts indicate potential criminal conduct, and the U.S. Department of Justice determines whether to pursue investigation and prosecution under applicable federal criminal statutes.
The Centers for Medicare and Medicaid Services enforces HIPAA Administrative Simplification standards related to certain electronic transactions, code sets, unique identifiers, and operating rules that support standardized administrative health care transactions. State Attorneys General also have authority to bring civil actions in federal court on behalf of state residents for violations of the HIPAA Privacy Rule and HIPAA Security Rule, including seeking injunctive relief and monetary remedies within the limits set by federal law.