Ultimately, filing criminal charges for HIPAA violations falls within the remit of the Department of Justice. The OCR can refer a case to the DoJ if they think a violation was in fact a criminal violation.