HIPAA Enforcement Rule Overview (45 CFR 160 Subpart C-E)
The framework for HHS investigation and enforcement of HIPAA violations: complaints, compliance reviews, informal resolution, civil money penalties, and the four-tier culpability structure.
Primary source
45 CFR 160 Subparts C-E — eCFR →https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
Additional sources
45 CFR Part 160 Subparts C-E — the Enforcement Rule — covers HHS investigation and enforcement of HIPAA.
Subpart C (Compliance and Investigations) sets the procedures: OCR may initiate a compliance review or investigate a complaint. The entity must cooperate, provide records, and permit OCR access. OCR seeks voluntary resolution first; if voluntary resolution is not possible, it proceeds to formal enforcement.
Subpart D (Imposition of Civil Money Penalties) sets the four-tier culpability structure (added by HITECH and implemented in the 2013 Omnibus): no knowledge; reasonable cause; willful neglect (corrected); willful neglect (not corrected). Penalty ranges per violation per year are adjusted for inflation annually — the current ranges are published in the Federal Register and tracked on the OCR enforcement page.
Subpart E (Procedures for Hearings) sets the administrative law judge process for contested penalties.
Most enforcement ends in a Resolution Agreement with a corrective action plan rather than a litigated penalty. The OCR enforcement highlights page lists historic settlements; the patterns (risk analysis failures, BAA failures, access-right delays, lost laptops) are the substantive guide to where OCR finds violations.
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- RegulationHIPAA Civil Money Penalty Tiers (45 CFR 160.404)The four-tier culpability and penalty structure for HIPAA civil money penalties, with statutory caps adjusted annually for inflation.
- RegulationHIPAA Resolution Agreements and Corrective Action Plans (45 CFR 160.312)OCR's preferred enforcement disposition: a Resolution Agreement that includes a corrective action plan, payment, and reporting obligations spanning two to three years.
- RegulationHIPAA Criminal Enforcement (42 USC 1320d-6)Criminal sanctions for knowingly obtaining or disclosing PHI in violation of HIPAA, enforced by the Department of Justice rather than HHS, with three tiers escalating to ten years' imprisonment.
- RegulationOCR HIPAA Audit Program (45 CFR 160.310)OCR's authority to conduct compliance audits of covered entities and business associates, and the recurring posture under the Audit Program established by HITECH.
- GlossaryAccounting of DisclosuresThe HIPAA right of an individual to receive a list of disclosures of their PHI made by a covered entity over the prior six years.
- BillingBusiness Associate Agreement Checklist for Small PracticesA working checklist for small practices to identify which vendors need a Business Associate Agreement, what clauses the BAA must contain, and how to track them.
- SRAChange Healthcare Ransomware: What Small Practices Took AwayThe February 2024 Change Healthcare cyberattack, what HHS and UnitedHealth Group disclosed, and the small-practice lessons about clearinghouse concentration risk, contingency planning, and the Security Rule's information system activity review.
- GlossaryAmendment of PHIThe HIPAA right of an individual to request that a covered entity amend PHI in a designated record set.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.