The Office for Civil Rights (OCR) is the office within the U.S. Department of Health and Human Services (HHS) that enforces the HIPAA Privacy, Security and Breach Notification Rules and investigates complaints. OCR also enforces federal civil rights laws in health and human services, including nondiscrimination rules.
In practice at a clinic or small practice
Most staff first encounter OCR through a complaint. A patient may believe the front desk discussed their diagnosis within earshot of the waiting room, or that a records request went unanswered for weeks. That patient can file a complaint with OCR. If OCR opens a case, the office manager or privacy officer usually receives a data request letter. The practice then has to produce its privacy policies, risk analysis, training records and any documents related to the specific incident.
OCR is also involved in other situations:
- Breach reports. When unsecured PHI is breached, such as a stolen laptop or a misdirected batch of lab letters, the practice reports it to HHS through OCR's breach portal under the Breach Notification Rule. Timelines depend on how many people were affected.
- The public breach list. OCR publishes breaches affecting 500 or more individuals.
- Enforcement initiatives. OCR has run focused efforts on specific issues, such as patients' right to access their own records.
What this means for staff: OCR mostly asks to see documentation, such as written policies, training logs, the risk analysis and signed BAAs with vendors. You don't need to know the regulations in detail. You do need to know who your practice's privacy officer is, and you should bring concerns to them right away. That includes a patient complaining about privacy, a fax sent to the wrong number, or a records request you aren't sure how to handle.
Not to be confused with
| Term | What it is | Relation to HIPAA enforcement |
|---|---|---|
| OCR (optical character recognition) | Software that reads text from scanned documents, often built into intake and document tools | Unrelated; it only shares the acronym |
| ONC | The HHS office for health IT certification and information-blocking rules | Does not enforce HIPAA privacy |
| CMS | Enforces the HIPAA transaction and code set standards | Does not enforce privacy and security |
State attorneys general can also bring civil actions under HIPAA.
What the rules say
- Authority. HHS delegated enforcement of the HIPAA Privacy and Security Rules to OCR. OCR enforces these rules against covered entities and their business associates.
- Procedures. Enforcement rules are in 45 CFR Part 160:
- Subpart C covers compliance and investigations.
- Subpart D covers civil money penalties.
- Subpart E covers hearings.
- Outcomes. Many cases close with technical assistance. More serious ones end in a resolution agreement with a corrective action plan, or in civil money penalties. Penalty tiers depend on the level of culpability and are adjusted for inflation each year. Possible criminal violations are referred to the Department of Justice.
- HITECH Act (2009). This law strengthened enforcement and made business associates directly liable for certain HIPAA requirements.
This is a summary for staff, not legal advice. Check hhs.gov/ocr for current guidance, and ask your privacy officer or counsel about specific situations.
Related reading
- HIPAA: the overall law OCR enforces.
- Breach Notification Rule: what gets reported to OCR, and when.
- Security, HIPAA and BAA: how one staff chat tool handles BAAs and security controls.
More terms: Healthcare operations glossary
Where Chanty fits. chanty.health is published by Chanty, a team chat for clinic staff with a signed BAA from the Business plan. If your team still coordinates in personal group chats, see how HIPAA-compliant staff chat works or start free.