This works both ways. If a Covered Entity has a previous good record of HIPAA compliance and can demonstrate at least twelve months compliance with a recognized security framework, HHS´ Office for Civil Rights can use enforcement discretion when investigating a HIPAA violation. However, if a Covered Entity has a previous poor record of compliance, this may reflect in any subsequent penalty.