HIPAA Glossary · Entities & roles
OCR
Also: Office for Civil Rights
The HHS office that administers and enforces the HIPAA rules through investigations, audits, penalties, and resolution agreements.
Context
The practical face of HIPAA enforcement. OCR receives complaints, conducts compliance reviews, negotiates resolution agreements with corrective action plans, and imposes civil money penalties when settlements fail. OCR's active enforcement initiatives (Risk Analysis, Right of Access, ransomware) frame most of the 2026 settlement docket — see [the Risk Analysis Initiative post](/blog/ocr-risk-analysis-initiative/) and [Right of Access post](/blog/hipaa-right-of-access/).
Related terms
- HHS — The US Department of Health and Human Services — HIPAA's parent agency.
- Resolution agreement — The settlement instrument closing an OCR enforcement action, typically pairing a payment with a corrective action plan.
- Civil money penalty — The formal penalty OCR imposes when a case does not settle, calculated under the four culpability tiers.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.