Who Enforces HIPAA
The Office for Civil Rights within the Department of Health and Human Services is the primary enforcer of the HIPAA Privacy, Security, and Breach Notification Rules. State attorneys general also have authority to bring civil actions on behalf of state residents affected by HIPAA violations.
The Tiered Civil Monetary Penalty Structure
HIPAA penalties are assessed based on the level of culpability. The tiers generally range from violations where the covered entity did not know and could not have reasonably known of the violation, to violations due to reasonable cause, to violations due to willful neglect that are corrected within 30 days, and finally to willful neglect that is not corrected. Penalty amounts increase substantially at each tier, and annual caps apply per violation category.
Common Enforcement Triggers
- Complaints filed directly by patients or their representatives
- Breach reports submitted by covered entities themselves
- Compliance reviews initiated by OCR independent of a complaint
- Media reports of a potential breach or privacy violation
Resolution Agreements and Corrective Action Plans
Many OCR investigations conclude with a resolution agreement requiring the entity to pay a settlement amount and adopt a corrective action plan, often including a multi-year period of OCR monitoring, updated policies, and workforce retraining. RHIA candidates should understand that a resolution agreement is a negotiated settlement, not an admission of liability in the criminal sense.
Recurring Themes in Enforcement Actions
- Failure to conduct an accurate and thorough enterprise-wide risk analysis
- Impermissible disclosures of PHI to unauthorized parties
- Lack of appropriate access controls and audit logging
- Untimely breach notification
- Failure to execute business associate agreements before sharing PHI
- Denial or delay of patient right of access requests
The Right of Access Initiative
OCR launched a specific enforcement initiative focused on patient right of access, resulting in numerous settlements against providers who failed to provide timely access to medical records within the required timeframe. This is a high-yield exam topic because it connects enforcement trends directly to a core HIM function.
Exam Strategy
Expect scenario questions asking you to identify the appropriate penalty tier based on described facts, or to recognize which recurring compliance failure a scenario represents. Understanding the pattern of OCR's enforcement priorities helps you reason through unfamiliar fact patterns.
Key Takeaway
HIPAA enforcement is risk-based and pattern-driven. RHIA candidates should be able to connect penalty tiers to culpability levels and recognize the recurring compliance failures that drive OCR's enforcement priorities.