In February 2023, the Office for Civil Rights (OCR) announced a $1.3 million settlement with a health plan that failed to provide timely access to protected health information. The case was one of dozens in OCR's Right of Access Initiative — and a sharp reminder that HIPAA enforcement is active, funded, and increasingly aggressive. If you've ever asked what office enforces HIPAA, the answer is OCR, and understanding how they operate is essential for every covered entity and business associate.

What Office Enforces HIPAA? Understanding OCR's Authority

The Office for Civil Rights sits within the U.S. Department of Health and Human Services (HHS). Congress gave OCR the authority to enforce the HIPAA Privacy Rule (45 CFR Part 164, Subpart E), the Security Rule (45 CFR Part 164, Subpart C), and the Breach Notification Rule (45 CFR Part 164, Subpart D). This means OCR investigates complaints, conducts compliance reviews, and imposes civil monetary penalties when organizations fail to protect PHI.

OCR is not the only enforcement body in play. The Department of Justice (DOJ) handles criminal HIPAA violations — cases involving willful neglect, fraud, or intentional misuse of protected health information. But for the vast majority of healthcare organizations, OCR is the office you will hear from if something goes wrong.

How OCR Investigates HIPAA Complaints

OCR receives between 25,000 and 35,000 HIPAA complaints every year. Most investigations begin with an individual complaint filed through OCR's online portal. Patients, workforce members, and even competitors can file complaints alleging that a covered entity or business associate violated HIPAA.

Once a complaint is received, OCR evaluates whether it has jurisdiction and whether the allegation, if true, would constitute a violation. If it meets the threshold, OCR opens a formal investigation. Your organization will receive a data request letter — a detailed demand for policies, procedures, risk analyses, training records, and incident logs.

This is where most organizations stumble. In my work with covered entities, the problem is rarely a single dramatic breach. It is the inability to produce documentation proving ongoing compliance. OCR doesn't accept verbal assurances. They want evidence — and they want it organized.

Complaint Resolution vs. Formal Penalties

Not every complaint ends in a fine. OCR resolves the majority of cases through technical assistance or voluntary corrective action. However, when OCR finds systemic failures — missing risk analyses, absent workforce training, ignored breach notification obligations — the penalties escalate quickly.

The HIPAA penalty tiers, updated under the Omnibus Rule, range from $137 to $68,928 per violation, with an annual cap of over $2 million per violation category. In cases of willful neglect left uncorrected, there is no discretion — OCR must impose a penalty.

The Three Enforcement Mechanisms OCR Uses Against Your Organization

OCR exercises its enforcement authority through three primary mechanisms:

  • Complaint investigations: Reactive investigations triggered by patient or workforce member complaints.
  • Compliance reviews: Proactive audits initiated by OCR, often following a reported breach or as part of a broader audit program.
  • Breach investigations: Automatic reviews triggered when your organization reports a breach affecting 500 or more individuals to HHS. These large breaches appear on OCR's public Breach Portal — often called the "Wall of Shame."

Since 2003, OCR has investigated over 330,000 cases and resolved more than 97% of them. Settlements and civil monetary penalties have totaled well over $140 million. These are not hypothetical risks.

What OCR Looks for During an Investigation

When OCR examines your organization, they focus on several core requirements. Missing any one of them can turn a routine inquiry into a costly enforcement action.

  • Risk analysis: Has your organization conducted and documented a comprehensive risk analysis under 45 CFR §164.308(a)(1)(ii)(A)? This is the single most cited deficiency in OCR settlements.
  • Policies and procedures: Are your Privacy Rule and Security Rule policies written, current, and accessible to your workforce?
  • Workforce training: Can you demonstrate that every workforce member — not just clinical staff — has received HIPAA training appropriate to their role? OCR has specifically penalized organizations for inadequate or undocumented training programs.
  • Minimum necessary standard: Does your organization limit PHI access and disclosure to the minimum necessary for each function?
  • Notice of Privacy Practices: Have you provided your NPP to patients and posted it as required?
  • Business associate agreements: Are your BAAs executed, current, and inclusive of Omnibus Rule requirements?

Organizations that invest in comprehensive HIPAA training and certification before an investigation are overwhelmingly better positioned to respond to OCR data requests with the documentation that actually matters.

The Workforce Training Requirement Most Organizations Underestimate

OCR has made clear — through enforcement actions and published guidance — that workforce training is not a one-time checkbox. The Privacy Rule at 45 CFR §164.530(b) requires training for every new workforce member and retraining when policies materially change. The Security Rule at 45 CFR §164.308(a)(5) adds security awareness training to the mandate.

Healthcare organizations consistently struggle with proving training completion across distributed workforces — remote billing staff, contracted IT teams, temporary clinical workers. If your organization cannot produce signed attestations or digital completion records for every individual with PHI access, OCR treats that as a compliance gap.

This is exactly why platforms like HIPAA Certify for workforce HIPAA compliance exist — to give covered entities and business associates a defensible, documented training program that holds up under OCR scrutiny.

State Attorneys General: The Other Enforcement Layer

While OCR is the primary federal office that enforces HIPAA, the HITECH Act granted state attorneys general the authority to bring civil actions on behalf of state residents for HIPAA violations. Several states — including Indiana, New Jersey, Minnesota, and New York — have pursued independent HIPAA enforcement actions resulting in significant settlements.

This dual-enforcement structure means your organization faces accountability at both the federal and state level. A breach that triggers OCR attention may simultaneously draw a state AG investigation, compounding your legal exposure and remediation costs.

Protect Your Organization Before OCR Comes Knocking

Now you know what office enforces HIPAA — and more importantly, how OCR builds cases against non-compliant organizations. The enforcement landscape in 2024 and 2025 shows no signs of slowing. OCR's budget requests have consistently prioritized HIPAA enforcement capacity, and breach reports continue to climb.

The organizations that survive OCR investigations are the ones that invested in compliance infrastructure before the complaint was filed: documented risk analyses, current policies, executed BAAs, and — critically — a workforce training program with verifiable completion records. Reactive compliance is expensive compliance. Build your documentation now, train your workforce consistently, and treat every OCR requirement as an audit waiting to happen.