ERISA Benefits Law Desk ReferenceERISA Benefits Tech, LLC

Part 22 · Chapter 4

HHS OCR HIPAA Investigations and Enforcement

Law stated as of October 3, 2026 · Government Audits and Investigations

Scope and status

This chapter covers HHS Office for Civil Rights investigation and enforcement procedure as it applies to a health plan sponsor or fiduciary acting as a HIPAA covered entity or business associate: investigation triggers, the cooperation duty, informal resolution and corrective action plans, civil monetary penalties, criminal referral, the audit program, and parallel state attorney general enforcement. Scope discipline: this chapter covers investigation and enforcement process — the underlying HIPAA Privacy/Security Rule substantive compliance obligations are covered in Part 13 (COBRA, HIPAA, and Welfare Benefits) and are cross-referenced, not restated, here.

Citations are to primary authority (45 C.F.R. Part 160, Subparts C-E; HITECH Act provisions). For Privacy Rule/Security Rule substantive compliance, breach-notification risk-assessment mechanics, and BAA drafting, see Part 13 (COBRA, HIPAA, and Welfare Benefits).

Sections

Part A is shown in full. The other sections are listed by title; their text is available to subscribers.

Part A — Investigation Triggers

A1.Complaints — investigation is not automatic

Part 22, ch. 4, § A1

Any person may file a written complaint against a covered entity or business associate within 180 days of when the alleged violation was known or should have been known, subject to a good-cause waiver. Final reg: 45 C.F.R. §160.306. The regulation's investigation duty is narrower than commonly assumed: OCR must investigate a complaint where a preliminary review indicates a possible violation due to willful neglect; for other complaints, investigation is discretionary. Final reg: 45 C.F.R. §160.306(c).

A2.Compliance reviews

Part 22, ch. 4, § A2

OCR must conduct a compliance review when a preliminary review of the facts indicates a possible violation due to willful neglect, and may open one in any other circumstance, on its own initiative and independent of any complaint — based on a breach report, media coverage, audit findings, or other information suggesting noncompliance. Final reg: 45 C.F.R. §160.308(a)–(b).

A3.Breach reports and the 500-plus threshold

Part 22, ch. 4, § A3

A covered entity must notify HHS of every breach of unsecured PHI; a breach affecting 500 or more individuals requires contemporaneous notice to HHS (within 60 days of discovery, the same timeline as individual notice) and is posted on OCR's public breach portal. A breach involving more than 500 residents of a State or jurisdiction also requires notice to prominent media outlets serving that State or jurisdiction. Final reg: 45 C.F.R. §§164.406 (media), 164.408 (HHS). There is no regulatory command that every large breach report opens a full investigation, but as a matter of current enforcement practice OCR conducts at least a preliminary review of every large-breach report and, particularly for ransomware/hacking incidents, increasingly opens full investigations under its current Risk Analysis Initiative (Part F).

Part B — Cooperation and Investigation Authority

  1. B1The duty to cooperate and permit accessSubscribers

Part C — Informal Resolution

  1. C1Corrective action plans and resolution agreementsSubscribers

Part D — Civil Monetary Penalties

  1. D1The HITECH four-tier structureSubscribers
  2. D2Applied caps under the 2019 enforcement-discretion policySubscribers
  3. D3The administrative hearing and judicial reviewSubscribers

Part E — Criminal Referral

  1. E1DOJ prosecution and the tiered penaltiesSubscribers

Part F — The HIPAA Audit Program and Current Enforcement Priorities

  1. F1Audit program status — no longer dormantSubscribers
  2. F2Current enforcement prioritiesSubscribers

Part G — Parallel State Attorney General Enforcement

  1. G1HITECH §13410(e)Subscribers

The first Part of each chapter is open to everyone. The remaining sections, with their authority and practice points, are available to subscribers and to clients of ERISA Benefits Law Group, PLLC whose engagement includes access.

Sign inSubscribe