OCR HIPAA Enforcement Trends: What Gets Penalized Now

Four intake paths: breach reports (every 500+ breach filed through the portal is reviewed, and large ones routinely open compliance reviews); complaints (OCR receives tens of thousands annually, most resolved through technical assistance, but patterns and serious allegations escalate); media reports and referrals; and compliance reviews OCR opens on its own initiative. The investigation is documentary: a data request letter seeking the risk analysis, policies, training records, BAAs, audit logs, and breach files, usually covering several years. The entity's response quality shapes everything after, complete, organized productions with credible remediation often end in technical assistance; gaps in foundational documents convert the incident into findings.

OCR's longest-running enforcement program, announced in 2019, targeting violations of 45 CFR 164.524: individuals' right to their records within 30 days (one 30-day extension allowed), in the form requested, at a reasonable cost-based fee. It has produced fifty-plus settlements, mostly against small and mid-size providers, with amounts from a few thousand dollars to several hundred thousand, each with a corrective action plan. The fact patterns are mundane: unanswered requests, months of delay, refusal to send records to a third party the patient designated, or improper fees. It is the easiest HIPAA violation to commit through simple inattention and the easiest to prevent: a tracked request queue with a 30-day clock and an escalation owner.

Announced October 2024 as a companion enforcement focus, it grew from OCR's observation that most investigated breaches, especially ransomware and hacking, trace to entities that never performed an accurate, thorough, enterprise-wide risk analysis. The settlements announced under it involve providers, plans, and business associates whose breach investigations revealed the analysis was absent, partial (one system, not the enterprise), or years old. Resolution amounts have ranged from tens of thousands to seven figures depending on size and egregiousness, always paired with corrective action plans requiring a compliant analysis, a risk management plan, and periodic OCR reporting. The initiative's message is procedural: the risk analysis is the first document requested, and its absence is now a headline finding, not background.

Four tiers keyed to culpability: (1) did not know and could not have known with reasonable diligence; (2) reasonable cause, not willful neglect; (3) willful neglect, corrected within 30 days; (4) willful neglect, uncorrected. Per-violation minimums rise by tier, and HITECH set annual caps that OCR's 2019 Notice of Enforcement Discretion re-read to scale with culpability, roughly $25,000 to $1.5 million-plus per violation category per year in original terms, adjusted annually for inflation (the top tier now sits around $2.1 million). Identical violations continuing over time multiply, each day can count, which is how uncorrected known gaps compound. Willful neglect (conscious, intentional failure or reckless indifference) mandates penalties; the lower tiers give OCR settlement discretion, which is where nearly all matters land.

State attorneys general have HITECH authority to sue for HIPAA violations affecting their residents (up to $25,000 per violation category per year, plus fees), and several have used it, often in multistate actions following large breaches. State laws add their own claims: consumer protection statutes, state breach laws with faster clocks, and health-specific statutes like Washington's My Health My Data with a private right of action. The FTC polices health data outside HIPAA's perimeter, its Health Breach Notification Rule reaches health apps, and Section 5 actions (GoodRx, BetterHelp, Premom) targeted health-data sharing with advertisers. Class actions follow every large breach as a fixed cost. Planning for 'the regulator' means planning for at least four of them.