What Is OCR (HHS Office for Civil Rights)?

OCR sits within the US Department of Health and Human Services and is the primary HIPAA enforcement authority. Its caseload comes from individual complaints, breach reports filed by covered entities and business associates, and compliance reviews it opens on its own initiative. Investigations typically begin with a data request that asks for the organization's risk analysis, policies, and training records, and they can end in technical assistance, a resolution agreement with a multi-year corrective action plan, or civil money penalties.

Every HIPAA covered entity and business associate is within OCR's reach, from solo practices to national health systems and their technology vendors. Breaches affecting 500 or more individuals draw particular scrutiny because they are publicly reported and routinely trigger an investigation.

The practical implication is that OCR enforcement is currently concentrated on one question: can you produce an accurate, current risk analysis? OCR's Risk Analysis Initiative is actively generating settlements on that issue, including four ransomware-related settlements announced in April 2026. Organizations that cannot answer that question should start with a documented security risk assessment and work through a HIPAA Security Rule compliance checklist before an investigator asks first.