The Office for Civil Rights enforces the Privacy, Security, and Breach Notification Rules through investigations, corrective action plans, and civil monetary penalties. HIPAA provides no private right of action.
State claims may proceed alongside.
Alternative Names:
HIPAA Action|OCR Enforcement
Why it Matters?
The absence of a private right of action does not eliminate civil exposure, since plaintiffs use HIPAA as the standard of care in state negligence claims and several states recognize negligence per se from HIPAA violations. That indirect route makes an OCR finding useful evidence for a plaintiff even without a federal claim. Corrective action plan terms also become discoverable and document acknowledged deficiencies.
Frequently Confused with
Related terms
Frequently asked questions
Does HIPAA create civil liability?
What discovery exposure follows enforcement?
