Who Enforces HIPAA? OCR, State AGs and the DOJ

The HHS Office for Civil Rights (OCR) enforces HIPAA's Privacy, Security and Breach Notification Rules, state attorneys general can bring civil actions for their residents under the HITECH Act, and OCR refers possible criminal violations to the Department of Justice (DOJ) (HHS; HHS; HHS). In HHS's own words, "HHS' Office for Civil Rights is responsible for enforcing the Privacy and Security Rules" (HHS). The FTC enforces a separate health breach rule for companies HIPAA does not cover. Curve Compliance signs a BAA on every plan and strips PHI before data reaches an ad platform.

Book a call. Curve Compliance sends conversions to your ad platforms server-side, and Curve's team does the setup. Book a call with Curve.

Who enforces what

Enforcer	Authority	What it can do	Source
HHS Office for Civil Rights	HIPAA Privacy, Security and Breach Notification Rules	Investigate complaints and breach reports, run compliance reviews, settle through resolution agreements, impose civil money penalties	HHS; 45 CFR 160.312
State attorneys general	HITECH Act section 13410(e), 42 U.S.C. 1320d-5(d)	Sue in federal court for state residents to stop violations or obtain damages	HHS; statute
Department of Justice	42 U.S.C. 1320d-6	Prosecute knowing wrongful use or disclosure of health information	HHS; statute
Federal Trade Commission	Health Breach Notification Rule, 16 CFR 318	Enforce breach notice duties for personal health record vendors outside HIPAA	318.1; 318.7
Patients	No private right of action under HIPAA	File a complaint with OCR; sue under a state law that allows it	Acara v. Banks; HHS

OCR: complaints, compliance reviews and resolution agreements

OCR enforces the rules "by investigating complaints filed with it," "conducting compliance reviews to determine if covered entities are in compliance," and "performing education and outreach to foster compliance with the Rules' requirements" (HHS). HHS "will investigate any complaint" when a preliminary review "indicates a possible violation due to willful neglect," and "may investigate any other complaint" (45 CFR 160.306); the same test applies to compliance reviews (45 CFR 160.308). OCR also "investigates all breaches of protected health information (PHI) and Part 2 records that affect 500 or more individuals" (OCR breach portal).

When it finds noncompliance, HHS "may attempt to reach a resolution of the matter satisfactory to the Secretary by informal means," including "a completed corrective action plan or other agreement," and if that fails it can propose a civil money penalty (45 CFR 160.312). Penalty amounts are "updated annually and published at 45 CFR part 102" (45 CFR 160.404); see the HIPAA penalties reference table. HHS's enforcement highlights page, dated October 2024, says that from April 2003 through October 31, 2024, OCR had received "over 374,321 HIPAA complaints," "initiated over 1,193 compliance reviews," and "settled or imposed a civil money penalty in 152 cases" (HHS). Recent actions from HHS's list:

Date	Entity	What OCR found or alleged	Outcome
September 17, 2026	Ambry Genetics	HHS lists it as "Ambry Genetics to Pay $700,000 After Phishing Attack Exposed 225,000 Patients' Health Data" (HHS)	A payment, per the HHS listing title
August 27, 2026	Azul Vision	A complaint that a patient's January 9, 2023 records request was not fulfilled until January 6, 2025 (HHS)	Resolution agreement and corrective action plan
August 28, 2025	Regional Women's Health Group	A cyberattack that "potentially impacted the protected health information of over 37,000 patients," and no accurate and thorough risk analysis (HHS)	Paid $320,000 (HHS)
May 30, 2025	Comstar, a business associate	Ransomware that affected the PHI of 585,621 individuals (HHS)	Paid $75,000 (HHS)
February 20, 2025	Warby Parker	Credential stuffing attacks on customer accounts and three Security Rule violations (HHS)	Civil money penalty of $1,500,000 after Warby Parker "waived its right to a hearing" (HHS)

State attorneys general (HITECH section 13410(e))

HHS says the HITECH Act "gave State Attorneys General the authority to bring civil actions on behalf of state residents for violations of the HIPAA Privacy and Security Rules," to "obtain damages on behalf of state residents or to enjoin further violations" (HHS). The statute lets an attorney general, "as parens patriae," sue "in a district court of the United States of appropriate jurisdiction." Damages are "the number of violations by up to $100," and may not exceed $25,000 a calendar year for violations of an identical requirement (42 U.S.C. 1320d-5(d)).

An attorney general must serve HHS first unless that is not feasible; HHS says "Notification should be provided at least 48 hours prior to filing of action" (HHS; 42 U.S.C. 1320d-5(d)(4)). No state may sue over a violation while HHS's own action on it is pending (42 U.S.C. 1320d-5(d)(7)). Inmediata shows both levels at work: Connecticut's attorney general and 32 other attorneys general settled with the clearinghouse, alleging violations of "state consumer protection laws, breach notification laws, and HIPAA" (Connecticut AG), and HHS lists a December 10, 2024 OCR settlement with Inmediata over an impermissible disclosure (HHS). States also enforce their own laws; the Texas attorney general enforces Texas's health privacy chapter (Tex. Health and Safety Code 181.201). See also state attorneys general and federal pixel cases.

DOJ and criminal penalties

OCR "works in conjunction with the Department of Justice (DOJ) to refer possible criminal violations of HIPAA" (HHS), and "The Department of Justice is responsible for criminal prosecutions" (HHS). As of October 31, 2024, OCR had made "2,419 such referrals to DOJ" (HHS). OCR settlements leave that path open: Comstar's agreement says its release "does not extend to actions that may be brought under section 1177 of the Social Security Act" (HHS), the criminal provision at 42 U.S.C. 1320d-6. It reaches a person who "knowingly and in violation of this part" obtains or discloses individually identifiable health information, among other acts (42 U.S.C. 1320d-6):

Conduct	Maximum under 42 U.S.C. 1320d-6(b)	Class under 18 U.S.C. 3559(a)
Knowing violation	"fined not more than $50,000, imprisoned not more than 1 year, or both" (statute)	Class A misdemeanor (3559)
Under false pretenses	"fined not more than $100,000, imprisoned not more than 5 years, or both" (statute)	Class D felony (3559)
Intent to sell, transfer or use it for commercial advantage, personal gain or malicious harm	"fined not more than $250,000, imprisoned not more than 10 years, or both" (statute)	Class C felony (3559)

The FTC: not HIPAA, but health data cases

The FTC's health privacy work sits outside HIPAA. Its Health Breach Notification Rule "does not apply to HIPAA-covered entities, or to any other entity to the extent that it engages in activities as a business associate of a HIPAA-covered entity" (16 CFR 318.1), and violations are "subject to civil penalties" (16 CFR 318.7). HHS's tracking bulletin notes the FTC Act and that rule "may apply in instances where a mobile health app impermissibly discloses a user's health information" (HHS). See what the FTC means by events in pixel cases and the FTC health privacy actions list.

Can patients sue?

Not under HIPAA itself. In Acara v. Banks, decided November 13, 2006, the Fifth Circuit held "there is no private cause of action under HIPAA" (opinion). Patients can complain instead: "Anyone can file a complaint if they believe there has been a violation of the HIPAA Rules or Part 2" (HHS). A complaint must be in writing, name the entity, "describe the acts or omissions believed to be in violation," and be filed "within 180 days of when the complainant knew or should have known" of it, unless HHS waives the limit for good cause (45 CFR 160.306).

State law can give people their own claims for health data outside HIPAA. Washington's My Health My Data Act, which does not apply to PHI, makes a violation "an unfair or deceptive act in trade or commerce" under the state Consumer Protection Act (RCW 19.373.090), which lets "Any person who is injured in his or her business or property" by such an act bring a civil action (RCW 19.86.090). For lawsuits patients have filed over tracking pixels, see the pixel lawsuit tracker. This page is not legal advice; talk to your counsel about any specific claim.

How Curve Compliance helps

HHS's tracking bulletin says OCR enforces the HIPAA Rules "including by investigating breach reports and complaints," and it applies those rules to tracking technologies on websites and apps (HHS). Curve Compliance signs a BAA on every plan and replaces browser ad pixels with one script that sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform. Each platform receives only a fixed list of fields, and contact identifiers are off by default on Meta, Google Ads and TikTok.

Event Logs show what Curve sent to each platform and what the platform accepted. Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week. For what draws OCR's attention to marketing, see what triggers an OCR marketing investigation, and run the free website scan to see which trackers a page loads.

Sources, checked October 26, 2026: HHS enforcement; HHS enforcement process; HHS state attorneys general; HHS enforcement highlights; HHS resolution agreements; Azul Vision; Regional Women's Health Group; Comstar; Warby Parker; HHS complaints; HHS Privacy Rule summary; HHS tracking bulletin; OCR breach portal; 45 CFR 160.203; 160.306; 160.308; 160.312; 160.404; 164.512; 16 CFR 318.1; 318.7; 42 U.S.C. 1320d-5; 42 U.S.C. 1320d-6; 18 U.S.C. 3559; Acara v. Banks; Connecticut AG; Texas ch. 181; RCW 19.373; RCW 19.86.090.

Frequently Asked Questions

Who enforces HIPAA?

The HHS Office for Civil Rights enforces the HIPAA Privacy, Security and Breach Notification Rules (HHS). State attorneys general can also sue under the HITECH Act, and DOJ prosecutes criminal cases that OCR refers (HHS; HHS).

What overrides HIPAA?

A contrary state law that relates to health privacy and is more stringent than the Privacy Rule, or that fits another exception in 45 CFR 160.203, such as public health reporting (eCFR). The Privacy Rule also permits disclosures "required by law" (45 CFR 164.512); see does HIPAA preempt state law.

Can I sue if HIPAA is violated?

Not under HIPAA: the Fifth Circuit held that "there is no private cause of action under HIPAA" (Acara v. Banks). You can file a complaint with OCR (HHS), and some state laws, such as Washington's for consumer health data outside HIPAA, give their own right to sue (RCW 19.373.090).

Is it a felony to violate HIPAA?

It can be. A knowing violation carries up to 1 year in prison, a misdemeanor class, while false pretenses (up to 5 years) and intent to sell or use the information for gain or harm (up to 10 years) are felony classes (42 U.S.C. 1320d-6; 18 U.S.C. 3559).

What proof do you need for a HIPAA violation?

A complaint must be in writing, name the entity, "describe the acts or omissions believed to be in violation," and be filed within 180 days; OCR then investigates, which "may include a review of the pertinent policies, procedures, or practices" of the entity (45 CFR 160.306).

What's the most common HIPAA violation?

In complaints to OCR, "Impermissible uses and disclosures of protected health information" tops the list, followed by lack of safeguards, lack of patient access, lack of administrative safeguards for electronic PHI, and using or disclosing more than the minimum necessary (HHS, as of October 31, 2024). See HIPAA violation examples.

Who enforces HIPAA privacy security breach notification rules?

OCR. HHS says "OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules" (HHS); see the HIPAA Breach Notification Rule.

Talk to Curve Compliance

Book a call. See what your site sends to ad platforms today and how Curve Compliance removes PHI before anything is sent to an ad platform, under the BAA it signs on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.