HIPAA Guidance API: HHS OCR FAQs, Guidance, and Enforcement Actions

Short answer: the HHS Office for Civil Rights publishes HIPAA material in three separate shapes, and Vaquill AI's US primary law API serves all three under corpusType=AGENCY_GUIDANCE, on the cadence the agency guidance board declares on GET /boards. More than 40 guidance materials (hhs_ocr_hipaa_guidance), more than 440 deduplicated FAQs (hhs_ocr_hipaa_faq), and more than 140 resolution agreements and civil money penalties (hhs_ocr_resolution_agreement). You want all three because they answer different questions. Guidance and FAQs tell you what OCR says the Privacy and Security Rules require. The enforcement record is the only place you learn what OCR actually penalizes.

Reviewed and corrected on 12 October 2026. This is general information, not legal advice.

TL;DR

• Three sources, three jobs. hhs_ocr_hipaa_guidance (more than 40 documents) is OCR's reading of the rules. hhs_ocr_hipaa_faq (more than 440) is the specific, most-searched layer. hhs_ocr_resolution_agreement (more than 140) is the enforcement record.
• Guidance tells you the rule. The enforcement record tells you the risk. A compliance program built on guidance alone is guessing about the second half.
• The FAQ corpus is deduplicated on purpose. HHS cross-lists the same FAQ under many topic pages, so a naive scrape returns the same answer several times under several URLs. The count we publish is the distinct-FAQ count.
• Chain it to the rule text. 45 C.F.R. Parts 160, 162, and 164 sit in the CFR corpus (222,311 sections, refreshed daily), so one workflow can go from the regulation to the FAQ to the settlement.
• A citation returns the text in force now, and asOf reconstructs earlier text. asOf=YYYY-MM-DD rebuilds it from observed changes and flags isBounded. You also get amendment history, a yearFrom / yearTo currency filter, and per-section diffs on watched boards.
• Keep PHI out of your query strings. This is a public-law lookup API. It doesn't need patient data and should never see any.

Filed under our federal agency guidance series.

For related coverage, see Federal Agency Guidance API: 53 Sub-Regulatory Sources in One Endpoint, Banking and AML Guidance API: OCC, FDIC, Federal Reserve, and FinCEN in One Query for the same guidance-versus-enforcement split in bank supervision, and DOJ Justice Manual API: Over 1,500 Sections of Federal Prosecution Policy.

The three sources, side by side

All three sit inside the federal agency guidance corpus, which spans 53 named sources. The source filter is what stops a HIPAA query from returning IRS revenue procedures, and the corpus types reference lists every token.

The layer stack you are actually querying

HIPAA compliance questions almost never resolve at one layer. The statute is short, the rules are long, and the answer to "can we do this" usually lives in a FAQ or a settlement.

Reading up the stack: HIPAA and HITECH are the statutes. The Privacy, Security, Breach Notification, and Enforcement Rules are codified at 45 C.F.R. Parts 160 and 164 (with the transactions rules at Part 162). OCR then interprets those rules in guidance and FAQs, and enforces them through resolution agreements and civil money penalties.

Rule changes arrive through notice-and-comment, which is why the FEDERAL_REGISTER corpus (more than 196,000 agency rules, final and proposed, 1994 to present) sits alongside the CFR. If a HIPAA rule is being amended, the proposed rule shows up there first.

A short history: from a 1996 insurance law to settlements

HIPAA is older than most of the software that has to follow it. The Health Insurance Portability and Accountability Act was approved on August 21, 1996 (Public Law 104-191). The privacy standards came from section 264 of that Act, which the Privacy Rule cites as its authority, and HHS published the final rule in the Federal Register on December 28, 2000 (65 Fed. Reg. 82462).

Rules on paper were one thing. Enforcement took years to show up. OCR's own site records that on July 16, 2008 HHS entered into its first resolution agreement under the Privacy and Security Rules, with Seattle-based Providence Health & Services. Providence agreed to pay $100,000 and follow a corrective action plan after backup tapes, disks and laptops holding unencrypted data were left unattended and then lost or stolen, compromising the information of over 386,000 patients. HHS defined the new tool in plain terms: "A Resolution Agreement is a contract signed by HHS and a covered entity in which the covered entity agrees to perform certain obligations (e.g., staff training) and make reports to HHS for a period of years, typically three years." (HHS page).

The first civil money penalty was announced on February 22, 2011: $4.3 million against Cignet Health of Prince George's County, Maryland (the final determination letter is dated February 4). Look at what it was for. HHS found that Cignet denied 41 patients access to their medical records between September 2008 and October 2009 ($1.3 million), and then refused to respond to OCR's demands for the records and failed to cooperate with the investigation ($3 million). The first big HIPAA penalty was about a records request and a stonewalled regulator (HHS page). That is why the worked example below runs on right of access.

One more date matters for anyone selling to hospitals. The Omnibus Rule, published January 25, 2013, finalized changes under the HITECH Act and made business associates directly liable for compliance with certain Privacy and Security Rule requirements. It took effect March 26, 2013, with a compliance date of September 23, 2013 (78 Fed. Reg. 5566).

What developers say

HIPAA is one of the most over-applied acronyms in software, and people on Hacker News say so. In February 2023 one commenter put it this way: "people like to bring up HIPAA rules in lots of situations where they simply don't apply" (hn_throwaway_99, Hacker News, February 2023). They added that you mainly need to worry about the specifics if you are a covered entity, such as a hospital or insurer, or if you have signed a business associate agreement with one. That's a fair rule of thumb, with one update from the history above: since the 2013 Omnibus Rule, a business associate carries direct liability for parts of the rules and does not rely only on its contract.

The FAQs get used in the wild, too. In a May 2025 comment, one user settled a point by pasting an OCR FAQ and introducing it with "Straight from the horse's mouth." The FAQ they pasted answers yes to whether providers can share information for treatment without the patient's authorization (FireBeyond, Hacker News, May 2025). When people want the agency's own words on a narrow situation, the FAQ layer is where they go.

Guidance tells you the rule. Enforcement tells you the risk.

This is the point most HIPAA tooling misses, so it is worth being blunt about.

Guidance is complete and non-prioritized. It describes every requirement with roughly even weight, because that is what a guidance document is for. Read only guidance and you end up with a compliance program where a documentation gap in a training log looks like the same size problem as an unencrypted laptop.

The enforcement record is prioritized by definition. OCR opened those matters, investigated them, and settled or penalized them. The 140-plus resolution agreements and civil money penalties are a list of the things that were worth an agency's time.

Practically: run the same subject through all three sources and compare. If a topic is heavily covered in guidance but returns nothing in the enforcement record, that is a real signal, and so is the reverse. Do not report either one as a conclusion without a human reading the underlying documents, but as a triage input it is strong. The compliance mapping recipe walks that three-source pattern.

Why we deduplicated the FAQ corpus

HHS publishes each HIPAA FAQ once, then cross-lists it under many topic pages. The same answer about a business associate's obligations can be reachable from a business-associates topic page, a security topic page, and a covered-entity topic page, at three different URLs.

A naive scrape treats every URL as a separate document. You end up with a corpus where one FAQ occupies five slots.

That breaks three things at once:

• Retrieval quality. Hybrid search ranks passages. Five near-identical passages take five of your top ten slots and crowd out the second-best answer.
• Cost. You pay 4 credits for a search and get back one answer wearing five hats.
• Counting. A raw count of every FAQ URL would be several times higher and would mean less. The distinct-FAQ count is the number we publish.

This is the kind of decision that never shows up in a coverage table and shows up immediately in answer quality. It is also why we publish the ingestion pipeline as open source at github.com/Vaquill-AI/open-us-law, so you can read how a record is produced rather than trust a count. See open-us-law.

Worked example: right of access, from the rule to the settlement

Base URL is https://api.vaquill.ai/api/v1, auth is a bearer key with a vq_key_ prefix, statutes routes are mounted at /us/statutes/*. A search is 4 credits. GET /us/statutes/coverage is free. A request that fails validation (a 422) isn't charged.

The whole chain below is three searches, so 12 credits.

Step 1: get the rule text

The individual right of access lives at 45 C.F.R. 164.524.

curl -s https://api.vaquill.ai/api/v1/us/statutes/search \
  -H "Authorization: Bearer vq_key_..." \
  -H "Content-Type: application/json" \
  -d '{
    "query": "individual right of access to protected health information",
    "corpusType": "CFR",
    "titleNumber": 45,
    "part": "164",
    "limit": 5
  }'

Each hit carries a stable actId and the official eCFR URL. On 12 October 2026 the top hit was 45 C.F.R. § 164.524 (CFR_T45_P164_S164_524). Fetch the full text with GET /us/statutes/section/{actId}/body.

Step 2: find what OCR says about the hard part

The rule states a right. The fights are about timing and fees, which is FAQ territory. On 12 October 2026 the top hits were OCR FAQ 2030 ("Is $6.50 the maximum amount that can be charged to provide individuals with a copy of their PHI?"), FAQ 2029 and FAQ 2024.

curl -s https://api.vaquill.ai/api/v1/us/statutes/search \
  -H "Authorization: Bearer vq_key_..." \
  -H "Content-Type: application/json" \
  -d '{
    "query": "fee a covered entity may charge an individual for a copy of records",
    "corpusType": "AGENCY_GUIDANCE",
    "source": "hhs_ocr_hipaa_faq",
    "limit": 10,
    "excerptChars": 600
  }'

Step 3: check the enforcement record for the same subject

On 12 October 2026 the first hit was OCR's March 2025 civil money penalty against Oregon Health & Science University for failing to provide timely access to patient records.

curl -s https://api.vaquill.ai/api/v1/us/statutes/search \
  -H "Authorization: Bearer vq_key_..." \
  -H "Content-Type: application/json" \
  -d '{
    "query": "failure to provide timely access to requested medical records",
    "corpusType": "AGENCY_GUIDANCE",
    "source": "hhs_ocr_resolution_agreement",
    "limit": 20
  }'

Now you have the rule, OCR's reading of the hard edge of the rule, and the matters OCR resolved on it. That is a defensible answer instead of a paraphrase of a regulation.

The same pattern for BAA review

Swap the anchors and the shape holds. 45 C.F.R. 164.504(e) for required business associate contract terms, 164.308 for the administrative safeguards a vendor questionnaire should probe, 164.402 and 164.404 for what counts as a breach and who has to be told.

curl -s https://api.vaquill.ai/api/v1/us/statutes/search \
  -H "Authorization: Bearer vq_key_..." \
  -H "Content-Type: application/json" \
  -d '{
    "query": "business associate agreement required contract provisions subcontractor",
    "corpusType": "AGENCY_GUIDANCE",
    "source": ["hhs_ocr_hipaa_guidance", "hhs_ocr_hipaa_faq"],
    "matchType": "any",
    "limit": 20
  }'

Filters worth knowing

Unknown filter values return 422 rather than silently matching nothing. A typo in a source code fails loudly, because source is a fixed list in the API's OpenAPI document. The error reference documents the rest.

What this does not do

Every one of these is a real limit, and you should decide about them before you build.

• Past text is a reconstruction. Each citation carries a single live text, and asOf=YYYY-MM-DD on the section body call rebuilds an earlier one from observed changes, with isBounded marking answers that rest on when capture began. Alongside it: amendment history and lastAmendedYear per section, a yearFrom / yearTo currency filter, change events captured at each refresh, and per-section diffs on watched boards at the law change alerts page. The point-in-time explainer is the longer answer.
• A resolution agreement is a snapshot, not current law. It records what OCR and one entity agreed at one moment, usually with a corrective action plan on a fixed term. It is a risk signal, never authority to cite as a holding.
• The guidance set is OCR's HIPAA material, not all of HHS. FDA, CMS, and ONC material is out of scope for these three sources.
• Adjacent regimes live elsewhere or nowhere. 42 C.F.R. Part 2 (substance use disorder records) and the FTC Health Breach Notification Rule at 16 C.F.R. Part 318 are in the CFR corpus, not in the OCR sources. State health privacy statutes are in the state corpora under corpusType=STATE and REGULATION, which cover 56 jurisdictions.
• No commercial aggregators anywhere in the chain. The sourcing rule is the government publisher's own copy. For the sources we do track, GET /boards shows lastRetrievedAt and cadence.

Who this fits

Good fit: a health-tech compliance product that needs the rule, OCR's reading, and the enforcement record behind one schema. A BAA review workflow that wants 164.504(e) and the matching FAQs in one call. An in-house healthcare team that wants a signal when HIPAA rule text or OCR material moves.

Bad fit: anyone who needs OCR guidance exactly as it read on a past date, because for guidance an earlier text is a reconstruction (the rule text itself can come from GPO's printed annual editions of the CFR). Anyone whose real question is state medical privacy law, which is a different corpus and a different query.

FAQ

What is in the HHS OCR HIPAA guidance corpus?

More than 40 guidance materials published by the HHS Office for Civil Rights explaining what the Privacy and Security Rules require. They are served under corpusType=AGENCY_GUIDANCE with source=hhs_ocr_hipaa_guidance, on the cadence the agency guidance board declares on GET /boards. Each result carries the OCR page it came from.

How many HIPAA FAQs does the API return?

More than 440 distinct FAQs, under source=hhs_ocr_hipaa_faq. That number is deliberately lower than a raw crawl would produce, because HHS cross-lists the same FAQ across multiple topic pages and we deduplicate before indexing.

Why does deduplication matter for a HIPAA FAQ corpus?

Duplicates degrade ranking. If one FAQ exists at five URLs, five near-identical passages can occupy five of your top ten results and push out the second-best answer. Dedup also keeps the published count honest and stops you paying for the same answer repeatedly.

What is an OCR resolution agreement?

It is a settlement between HHS OCR and a covered entity or business associate resolving an investigation, usually with a payment and a corrective action plan. Civil money penalties are the contested route to a similar outcome. The corpus holds more than 140 of them under source=hhs_ocr_resolution_agreement.

Can I cite a resolution agreement as authority?

No. It is an agreed resolution in one matter, not a court holding or a rule. Use it as evidence of what OCR investigates and acts on, and cite the regulation itself for the requirement.

Where does the actual HIPAA rule text live in the API?

In the CFR corpus, which holds 222,311 sections and refreshes daily. The Privacy, Security, Breach Notification, and Enforcement Rules are at 45 C.F.R. Parts 160 and 164, with transactions at Part 162. Filter with corpusType=CFR, titleNumber=45, and a part value.

How do I track changes to HIPAA rules or OCR guidance?

Start at GET /boards, which costs nothing and returns every watchable source together with its cadence and its lastRetrievedAt. Create a watch on the source you care about and poll its changes, or pull a per-section diff when one fires (4 credits per diff). Each board declares its own cadence, so read it from GET /boards rather than assuming one.

Can I ask for HIPAA text as it read in 2019?

Yes for the regulation, partly for the guidance. Pass asOf=2019-01-01 on the section body call. For 45 C.F.R. the answer comes from GPO's printed annual edition when your date falls in an edition we hold. For OCR guidance and FAQs it is rebuilt from the before-side of the first change we observed after that date, with isBounded set when it rests on when change capture began rather than on the law, so treat that result as a reconstruction. Beside it sit amendment history per section, a yearFrom and yearTo currency filter that tracks the publisher's own last-amended credit, and diffs going forward on watched boards.

Does using this API make my product HIPAA compliant?

No, and be suspicious of any vendor who says otherwise. It gives you the primary and interpretive material to build against. Compliance is a function of your own safeguards, contracts, and controls, and this API is designed to sit outside your PHI boundary entirely.

How much does a HIPAA search cost?

POST /us/statutes/search is 4 credits per call regardless of corpus, so the three-step chain in this post costs 12. GET /us/statutes/coverage and GET /boards are free. A request that fails validation isn't charged. Pricing detail is in the API credits and pricing explainer.

Priyansh Khodiyar

Co-Founder & CTO

Priyansh leads engineering and AI at Vaquill AI: the pipelines that pull statutes, regulations and court rules from every US jurisdiction's official publisher, and the REST API, MCP server and open dataset that serve them.