The Office for Civil Rights (OCR) enforces HIPAA penalties through investigations prompted by complaints, breaches, or audit findings. Upon confirming a violation, OCR may issue monetary fines, require corrective action plans, or refer more severe cases to the Department of Justice for criminal prosecution.