U.S. DEPARTMENT OF HEALTH AND HUMAN SERVICES Office for Civil Rights

_________________________________________________ 

OCR Presents

The HIPAA Rules: Sanctions

The HHS Office for Civil Rights (OCR) is producing a pre-recorded video for HIPAA covered entities and business associates (collectively, “regulated entities”) reviewing the HIPAA Privacy and Security Rules’ sanction policy requirements (45 C.F.R. §§ 164.308(a)(1)(ii)(C), 164.530(e)).  OCR welcomes questions that could be addressed during this video.  If you have questions about HIPAA sanction requirements, please send them to OCRPresents@hhs.gov no later than October 30, 2026.

Speaker:

Nicholas Heesters, Senior Advisor for Cybersecurity, HHS Office for Civil Rights

Topics include:

• HIPAA Privacy and Security Rules’ sanction requirements
• OCR investigation findings of potential sanction violations
• Sanction and related resources
• Responses to select submitted questions

OCR is committed to enforcing the HIPAA Rules that protect the privacy and security of people’s health information.  Guidance about the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule can be found on OCR’s website.  If you believe that your or another person’s health information privacy or civil rights have been violated, you can file a complaint with OCR.