Which agency enforces HIPAA compliance and can impose penalties?

• A. Federal Trade Commission (FTC)
• B. Department of Health and Human Services (HHS)
• C. Centers for Medicare & Medicaid Services (CMS)
• D. Office for Civil Rights (OCR)

Answer: (D)

HIPAA enforcement and penalties are handled by the Office for Civil Rights, which operates within the Department of Health and Human Services. OCR is responsible for enforcing the HIPAA Privacy, Security, and Breach Notification Rules. It investigates complaints, conducts compliance reviews, and can impose civil monetary penalties and require corrective actions when violations are found. While the Department of Health and Human Services is the parent agency, the enforcement authority specifically for HIPAA rests with OCR, making it the proper agency to enforce HIPAA compliance and penalties. The FTC focuses on broader consumer protection and is not the primary enforcer of HIPAA; CMS administers Medicare/Medicaid programs and does not enforce HIPAA in the same way OCR does.