HIPAA Glossary · Entities & roles
HHS
Also: US Department of Health and Human Services
The US Department of Health and Human Services — HIPAA's parent agency.
Context
HHS owns HIPAA at the federal level. Within HHS, OCR enforces the Privacy, Security, and Breach Notification Rules; CMS handles the transactions and code set rules. HHS runs no certification programme — no organisation can be "HIPAA certified", only compliant and able to prove it.
Related terms
- OCR — The HHS office that administers and enforces the HIPAA rules through investigations, audits, penalties, and resolution agreements.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.