HIPAA Glossary · Laws & rules
Enforcement Rule
The HIPAA regulation setting out investigation procedures and the civil money penalty structure, including culpability tiers.
Context
Lives at 45 CFR Part 160 Subparts C–E. It is the rule OCR operates under during investigations: how complaints are received, how compliance reviews proceed, and how civil money penalties are calculated. The four culpability tiers (did-not-know through willful-neglect-uncorrected) live here.
Related terms
- Civil money penalty — The formal penalty OCR imposes when a case does not settle, calculated under the four culpability tiers.
- Willful neglect — Conscious, intentional failure or reckless indifference to HIPAA obligations.
- OCR — The HHS office that administers and enforces the HIPAA rules through investigations, audits, penalties, and resolution agreements.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.