Skip to main content


U.S. flag
      An official website of the United States government
              Here’s how you know
        Here’s how you knowDot gov**Official websites use .gov**
                 A **.gov** website belongs to an official government organization in the United States.
                  HTTPS**Secure .gov websites use HTTPS**
                 A **lock** (A locked padlock) or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites. 
  Menu Close
          Enter the terms you wish to search for.
    Search
        








  
  
    

  
      

                                      About HHS
    
                        
                              
      
      
      Programs & Services
    
                        
                              
      
      
      Grants & Contracts
    
                        
                              
      
      
      Laws & Regulations                  
Health Information Privacy
  HIPAA for Individuals
    
                        
                                            
      
      
      Filing a Complaint
    
                        
                                            
      
      
      HIPAA for Professionals
    
                        
                                            
      
      
      Newsroom

              

    



Breadcrumb
    HHS
                              HIPAA Home
                              For Professionals
                              HIPAA Compliance and Enforcement
                              Enforcement Data


    

    

    Navigate to:
  HIPAA for Professionals
    
                                    
                                            
            
      
      
      
      Regulatory Initiatives
    
                                                  
                                                                  
            
      
      
      
      Privacy
                                            
            
            Summary of the Privacy Rule
    
                                                  
                                            
            
      
      
      
      Guidance
    
                                                  
                                            
            
      
      
      
      Combined Text of All Rules
    
                                                  
                                            
            
      
      
      
      HIPAA Related Links
    
                                                  
                                                                  
            
      
      
      
      Security
                                            
            
            Summary of the Security Rule
    
                                                  
                                            
            
      
      
      
      Security Guidance
    
                                                  
                                            
            
      
      
      
      Cyber Security Guidance
    
                                                  
                                                                  
            
      
      
      
      Breach Notification
                                            
            
            Breach Reporting
    
                                                  
                                            
            
      
      
      
      Guidance
    
                                                  
                                            
            
      
      
      
      Reports to Congress
    
                                                  
                                            
            
      
      
      
      Regulation History
    
                                                  
                                                                                        
                          
      
      
      
      Compliance & Enforcement
                                            
            
            Enforcement Rule
    
                                                  
                                            
            
      
      
      
      Enforcement Process
    
                                                  
                                                                  
                          
      
      
      
      Enforcement Data
    
                                                  
                                            
            
      
      
      
      Resolution Agreements
    
                                                  
                                            
            
      
      
      
      Case Examples
    
                                                  
                                            
            
      
      
      
      Audit
    
                                                  
                                            
            
      
      
      
      Reports to Congress
    
                                                  
                                            
            
      
      
      
      State Attorneys General
    
                                                  
                                                                  
            
      
      
      
      Special Topics
                                            
            
            HIPAA and Part 2
    
                                                  
                                            
            
      
      
      
      HIPAA and COVID-19
    
                                                  
                                            
            
      
      
      
      HIPAA and Reproductive Health
    
                                                  
                                            
            
      
      
      
      HIPAA and Telehealth
    
                                                  
                                            
            
      
      
      
      HIPAA and FERPA
    
                                                  
                                            
            
      
      
      
      Research
    
                                                  
                                            
            
      
      
      
      Public Health
    
                                                  
                                            
            
      
      
      
      Emergency Response
    
                                                  
                                            
            
      
      
      
      Health Information Technology
    
                                                  
                                            
            
      
      
      
      Health Apps
    
                                                  
                                                                  
            
      
      
      
      Patient Safety
                                            
            
            Statute & Rule
                          
            
            PSQIA Statute
    
                                                  
                                            
            
      
      
      
      Patient Safety Rule
    
                                                  
                                            
            
      
      
      
      Enforcement
    
                                                  
                                            
            
      
      
      
      Guidance
    
                                                  
                                                                  
            
      
      
      
      Covered Entities & Business Associates
                                            
            
            Business Associate Contracts
    
                                                  
                                            
            
      
      
      
      Business Associates
    
                                    
                                            
            
      
      
      
      Training & Resources
    
                                    
                                            
            
      
      
      
      FAQs for Professionals
    
                                    
                                            
            
      
      
      
      Other Administrative Simplification RulesText resize icon

                    




Enforcement Data








  
  
    

  
      



Enforcement Highlights

See a summary of OCR’s enforcement activities and cumulative enforcement results from the implementation of the HIPAA Privacy Rule to the last month, including the number of cases in which OCR: obtained corrective action, did not find violations, referred the case to DOJ, or otherwise resolved.

For more information about how OCR reviews and investigates cases, here is a link to the HIPAA Privacy and Security Rule Complaint Process Flowchart: HIPAA Privacy and Security Rule Complaint Process.

Enforcement Results by Calendar Year

Cases that OCR closes fall into five categories:

Resolved after intake & review (no investigation)
	OCR closes these cases after determining that OCR lacks jurisdiction, or that the complaint, referral, breach report, news report, or other instigating event will not be investigated. For example, OCR will close cases where: the organization alleged to have violated the HIPAA Rules is not a covered entity or business associate and/or no protected health information (PHI) is involved; the behavior by the organization does not implicate the HIPAA Rules; the complainant refuses to provide consent for his/her information to be disclosed as part of the investigation; or OCR otherwise decides not to investigate the allegations.
	Technical Assistance (no investigation):
	OCR provides Technical Assistance to the covered entity, business associate, and complainant through early intervention by investigators located in Headquarters or a Regional Office.
	No Violation* (investigated):
	OCR investigates and does not find any violations of the HIPAA Rules.
	Corrective Action Obtained* (investigated):
	OCR investigates and provides technical assistance to or requires the covered entity or business associate to make changes regarding HIPAA-related privacy and security policies, procedures, training, or safeguards. In some cases, technical assistance is provided after investigation without requiring specific corrective action, for example, when the covered entity or business associate has already taken corrective action during the investigation or within the 60-day window prior to notifying OCR of the breach incident.

	Corrective action closures include those cases in which OCR enters into a settlement agreement with a covered entity or business associate: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html. To promote systemic reform that benefits the greatest number of individuals, in such cases, OCR settles for a percentage of any applicable civil money penalties OCR could impose and requires entities to reinvest in their enterprises to correct the underlying root causes for the noncompliance through a corrective action plan, which includes monitoring.
	Other:
	OCR may decide not to investigate a case further if:
	A. It is referred to the Department of Justice for prosecution.
	B. It involved a natural disaster.
	C. It was pursued, prosecuted, and resolved by state authorities.
	D. The covered entity or business associate has taken steps to comply with the HIPAA Rules and OCR determines enforcement resources are better/more effectively deployed in other cases.*Due to the complexity of some cases, and the evidence needed to understand and/or prove indications of noncompliance, most investigations can take multiple years to investigate and resolve. In addition, multi-year monitoring of privacy and security practices may be required by OCR.

Enforcement Results by Year - Compliance Reviews

Annual numbers of breach and non-breach compliance reviews resolved

OCR initiates compliance reviews due to a variety of instigating events other than a complaint, including: media reports, referrals from other state and federal agencies, trends in complaints and/or breach reports received, or other ongoing indications of noncompliance identified by Headquarters or Regional staff.

Enforcement Results by State by Calendar Year - Complaints

Cumulative proportions of complaint cases resolved in each state:

This data represents the quantitative outcome of complaints resolved by state since the implementation of the HIPAA Privacy Rule on April 14, 2003 (see items 1, 2, 3, 4, and 5 above).

Number of Complaints Received by Calendar Year

Number of Complaints Received by Calendar Year

This data represents the number of complaints received since the implementation of the HIPAA Privacy Rule on April 14, 2003.

Top 5 Issues in Investigated Cases

This data represents the top five issues that were identified in cases that were investigated and closed with corrective action since the inception of the Privacy Rule on April 14, 2003 (see item 4 above). Multiple issues may be identified in any one case closed with corrective action. Other cases do not generally implicate issues of noncompliance with the HIPAA Rules (see items 1, 2, 3, and 5 above) and, as such, are not included in this data.

                    
  


Content created by Office for Civil Rights (OCR) Content last reviewed March 22, 2019Back to top
    Contact HHS
    
                        
                                            
      
      
      Careers
    
                        
                                            
      
      
      HHS FAQs
    
                        
                                            
      
      
      Nondiscrimination NoticeHHS Archive
    
                        
                                            
      
      
      Accessibility
    
                        
                                            
      
      
      Privacy Policy
    
                        
                                            
      
      
      Viewers & PlayersBudget/Performance
    
                        
                                            
      
      
      Inspector General
    
                        
                                            
      
      
      Web Site Disclaimers
    
                        
                                            
      
      
      EEO/No Fear ActFOIA
    
                        
                                            
      
      
      The White House
    
                        
                                            
      
      
      USA.gov
    
                        
                                            
      
      
      Vulnerability Disclosure Policy
        Sign Up for Email Updates

Receive the latest updates from the Secretary, Blogs, and News Releases.

Sign Up
  HHS Headquarters
          200 Independence Avenue, S.W.
                  Washington, D.C. 20201
                  Toll Free Call Center: 1-877-696-6775​