HHS’ Office for Civil Rights implements and enforces the Privacy and Security Rules. For most HIPAA-covered companies, the Privacy Rule’s enforcement commenced on April 14, 2003.
Since 2003, OCR’s enforcement efforts have produced notable achievements that have improved the covered companies’ privacy practices. The OCR-obtained corrective actions from the covered entities have led to a systematic improvement in the privacy protection of health information for all the people they serve.