HIPAA Enforcement by State Attorneys General
While the federal Office for Civil Rights at HHS leads HIPAA enforcement, state attorneys general also hold authority to pursue violations on behalf of residents. This dual enforcement structure means healthcare entities can face action from both federal and state levels for the same privacy failures.
Why this matters: Most people assume HIPAA is a federal matter and leave it there. But state AGs can sue over HIPAA violations too, and some are more aggressive than the federal government ever was. That means a healthcare company that quietly settles with one regulator may still face a state enforcement action. For patients, more enforcers is generally better. For covered entities, the compliance bar is not just what Washington expects — it is also what your state's AG decides to make an example of.
Who should care: Lawyers · Privacy officers · Compliance · Healthcare professionals
This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.