5.2 ENFORCEMENT JURISDICTION

The Centers for Medicaid and Medicare Services, (CMS), and the Office of Civil Rights, (OCR), share enforcement responsibilities for HIPAA compliance. The Centers for Medicaid and Medicare Services, (CMS), has the authority to enforce the transactions and code set standards rule and the security rule. This authorization was granted in October of 2002 by the Director of the Department of Health and Human Services ^[3] At the same time, the Office of Civil Rights retained the responsibility to administer the privacy and security rules granted by the then Secretary of the Department of Human Services, Donna Schalala, in 2000. This authorization delegated to the Office of Civil Rights the following;

5.2.1

The authority under section 262 of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public Law 104-191, as amended, to the extent that these actions pertain to the Standards for the Privacy of Individually Identifiable Health Information, to:

impose civil monetary penalties, under section 1176 of the Social Security Act, for a covered entity's failure to comply with certain requirements and standards;
make exception determinations, under section 1178(a)(2)(A) of the Social Security Act, concerning when provisions of State laws that are contrary to the federal standards are not preempted by the federal provisions; and

5.2.2

The authority under section 264 of HIPAA, as amended, to administer the regulations, 'Standards for the Privacy of Individually Identifiable Health Information,' 45 CFR Part 164, and General Administrative Requirements, 45 CFR Part 160, as these requirements pertain to Part 164, and to make decisions regarding the interpretation, implementation and enforcement of these Standards and General Administrative Requirements. ^[4]

^[3] http://www.hhs.gov/news/press/2002pres/20021015a.html

^[4] http://www.hhs.gov/ocr/fedreg.html