HIPAA Guidance API: HHS OCR FAQs, Guidance, and Enforcement Actions

Short answer: the HHS Office for Civil Rights publishes HIPAA material in three separate shapes, and Vaquill AI's US primary law API serves all three under corpusType=AGENCY_GUIDANCE with a weekly refresh. 44 guidance materials (hhs_ocr_hipaa_guidance), 444 deduplicated FAQs (hhs_ocr_hipaa_faq), and 144 resolution agreements and civil money penalties (hhs_ocr_resolution_agreement). You want all three because they answer different questions. Guidance and FAQs tell you what OCR says the Privacy and Security Rules require. The enforcement record is the only place you learn what OCR actually penalizes.

TL;DR

• Three sources, three jobs. hhs_ocr_hipaa_guidance (44 documents) is OCR's reading of the rules. hhs_ocr_hipaa_faq (444) is the specific, most-searched layer. hhs_ocr_resolution_agreement (144) is the enforcement record.
• Guidance tells you the rule. The enforcement record tells you the risk. A compliance program built on guidance alone is guessing about the second half.
• The FAQ corpus is deduplicated on purpose. HHS cross-lists the same FAQ under many topic pages, so a naive scrape returns the same answer five times under five URLs. 444 is the distinct-FAQ count.
• Chain it to the rule text. 45 C.F.R. Parts 160, 162, and 164 sit in the CFR corpus (219,114 sections, refreshed daily), so one workflow can go from the regulation to the FAQ to the settlement.
• Versioning is the amendment record, not a date parameter. A citation returns the text in force now, one version, never an earlier one. You get amendment history, a yearFrom / yearTo currency filter, and per-section diffs on watched boards, not point-in-time retrieval.
• Keep PHI out of your query strings. This is a public-law lookup API. It does not need patient data and should never see any.

Filed under our federal agency guidance series.

For related coverage, see Federal Agency Guidance API: 34 Sub-Regulatory Sources in One Endpoint, Banking and AML Guidance API: OCC, FDIC, Federal Reserve, and FinCEN in One Query for the same guidance-versus-enforcement split in bank supervision, and DOJ Justice Manual API: 1,548 Sections of Federal Prosecution Policy.

The three sources, side by side

All three sit inside the 21,906-section federal agency guidance corpus, which spans 34 named sources. The source filter is what stops a HIPAA query from returning IRS revenue procedures, and the corpus types reference lists every token.

The layer stack you are actually querying

HIPAA compliance questions almost never resolve at one layer. The statute is short, the rules are long, and the answer to "can we do this" usually lives in a FAQ or a settlement.

Reading up the stack: HIPAA and HITECH are the statutes. The Privacy, Security, Breach Notification, and Enforcement Rules are codified at 45 C.F.R. Parts 160 and 164 (with the transactions rules at Part 162). OCR then interprets those rules in guidance and FAQs, and enforces them through resolution agreements and civil money penalties.

Rule changes arrive through notice-and-comment, which is why the FEDERAL_REGISTER corpus (202,526 agency rules, final and proposed, 1994 to present) sits alongside the CFR. If a HIPAA rule is being amended, the proposed rule shows up there first.

Guidance tells you the rule. Enforcement tells you the risk.

This is the point most HIPAA tooling misses, so it is worth being blunt about.

Guidance is complete and non-prioritized. It describes every requirement with roughly even weight, because that is what a guidance document is for. Read only guidance and you end up with a compliance program where a documentation gap in a training log looks like the same size problem as an unencrypted laptop.

The enforcement record is prioritized by definition. OCR opened those matters, investigated them, and settled or penalized them. The 144 resolution agreements and civil money penalties are a list of the things that were worth an agency's time.

Practically: run the same subject through all three sources and compare. If a topic is heavily covered in guidance but returns nothing in the enforcement record, that is a real signal, and so is the reverse. Do not report either one as a conclusion without a human reading the underlying documents, but as a triage input it is strong. The compliance mapping recipe walks that three-source pattern.

Why we deduplicated the FAQ corpus

HHS publishes each HIPAA FAQ once, then cross-lists it under many topic pages. The same answer about a business associate's obligations can be reachable from a business-associates topic page, a security topic page, and a covered-entity topic page, at three different URLs.

A naive scrape treats every URL as a separate document. You end up with a corpus where one FAQ occupies five slots.

That breaks three things at once:

• Retrieval quality. Hybrid search ranks passages. Five near-identical passages take five of your top ten slots and crowd out the second-best answer.
• Cost. You pay 4 credits for a search and get back one answer wearing five hats.
• Counting. A "1,900 HIPAA FAQs" headline sounds better and means less. 444 is the distinct-FAQ count, and it is the number we publish.

This is the kind of decision that never shows up in a coverage table and shows up immediately in answer quality. It is also why we publish the ingestion pipeline as open source at github.com/Vaquill-AI/open-us-law, so you can read how a record is produced rather than trust a count. See open-us-law.

Worked example: right of access, from the rule to the settlement

Base URL is https://api.vaquill.ai/api/v1, auth is a bearer key with a vq_key_ prefix, statutes routes are mounted at /us/statutes/*. A search is 4 credits. GET /us/statutes/coverage is free. Failed calls are not charged.

The whole chain below is three searches, so 12 credits.

Step 1: get the rule text

The individual right of access lives at 45 C.F.R. 164.524.

curl -s https://api.vaquill.ai/api/v1/us/statutes/search \
  -H "Authorization: Bearer vq_key_..." \
  -H "Content-Type: application/json" \
  -d '{
    "query": "individual right of access to protected health information",
    "corpusType": "CFR",
    "titleNumber": "45",
    "part": "164",
    "limit": 5
  }'

Each hit carries a stable actId and the official eCFR URL. Fetch the full text with GET /us/statutes/section/{actId}/body.

Step 2: find what OCR says about the hard part

The rule states a right. The fights are about timing and fees, which is FAQ territory.

curl -s https://api.vaquill.ai/api/v1/us/statutes/search \
  -H "Authorization: Bearer vq_key_..." \
  -H "Content-Type: application/json" \
  -d '{
    "query": "fee a covered entity may charge an individual for a copy of records",
    "corpusType": "AGENCY_GUIDANCE",
    "source": "hhs_ocr_hipaa_faq",
    "limit": 10,
    "excerptChars": 600
  }'

Step 3: check the enforcement record for the same subject

curl -s https://api.vaquill.ai/api/v1/us/statutes/search \
  -H "Authorization: Bearer vq_key_..." \
  -H "Content-Type: application/json" \
  -d '{
    "query": "failure to provide timely access to requested medical records",
    "corpusType": "AGENCY_GUIDANCE",
    "source": "hhs_ocr_resolution_agreement",
    "limit": 20
  }'

Now you have the rule, OCR's reading of the hard edge of the rule, and the matters OCR resolved on it. That is a defensible answer instead of a paraphrase of a regulation.

The same pattern for BAA review

Swap the anchors and the shape holds. 45 C.F.R. 164.504(e) for required business associate contract terms, 164.308 for the administrative safeguards a vendor questionnaire should probe, 164.402 and 164.404 for what counts as a breach and who has to be told.

curl -s https://api.vaquill.ai/api/v1/us/statutes/search \
  -H "Authorization: Bearer vq_key_..." \
  -H "Content-Type: application/json" \
  -d '{
    "query": "business associate agreement required contract provisions subcontractor",
    "corpusType": "AGENCY_GUIDANCE",
    "source": ["hhs_ocr_hipaa_guidance", "hhs_ocr_hipaa_faq"],
    "matchType": "any",
    "limit": 20
  }'

Filters worth knowing

Unknown filter values return 422 rather than silently matching nothing. A typo in a source code fails loudly, and the error message lists every valid code, so one bad request teaches you the whole vocabulary. The error reference documents the rest.

What this does not do

Every one of these is a real limit, and you should decide about them before you build.

• Versioning here is the amendment record, not a date parameter. Each citation carries a single live text, and the API takes no as_of=DATE. What exists: amendment history and lastAmendedYear per section, a yearFrom / yearTo currency filter, change events captured at each refresh, and per-section diffs on watched boards at the law change alerts page. The point-in-time explainer is the longer answer.
• A resolution agreement is a snapshot, not current law. It records what OCR and one entity agreed at one moment, usually with a corrective action plan on a fixed term. It is a risk signal, never authority to cite as a holding.
• 44 guidance materials is OCR's HIPAA set, not all of HHS. FDA, CMS, and ONC material is out of scope for these three sources.
• Adjacent regimes live elsewhere or nowhere. 42 C.F.R. Part 2 (substance use disorder records) and the FTC Health Breach Notification Rule at 16 C.F.R. Part 318 are in the CFR corpus, not in the OCR sources. State health privacy statutes are in the state corpora under corpusType=STATE and REGULATION, across 52 jurisdictions.
• No commercial aggregators anywhere in the chain. The sourcing rule is the government publisher's own copy. Where a publisher's robots.txt prohibits automated access, the corpus is paused and declares it in the freshness array on GET /us/statutes/coverage rather than filling the gap from a vendor.

Who this fits

Good fit: a health-tech compliance product that needs the rule, OCR's reading, and the enforcement record behind one schema. A BAA review workflow that wants 164.504(e) and the matching FAQs in one call. An in-house healthcare team that wants a weekly signal when HIPAA rule text or OCR material moves.

Bad fit: anyone who needs the historical text of a rule as it read on a past date, because that does not exist here. Anyone whose real question is state medical privacy law, which is a different corpus and a different query. Anyone expecting a vendor that will sign a BAA, since this API is designed so you never need one.

FAQ

What is in the HHS OCR HIPAA guidance corpus?

44 guidance materials published by the HHS Office for Civil Rights explaining what the Privacy and Security Rules require. They are served under corpusType=AGENCY_GUIDANCE with source=hhs_ocr_hipaa_guidance and refresh weekly. Each result carries the OCR page it came from.

How many HIPAA FAQs does the API return?

444 distinct FAQs, under source=hhs_ocr_hipaa_faq. That number is deliberately lower than a raw crawl would produce, because HHS cross-lists the same FAQ across multiple topic pages and we deduplicate before indexing.

Why does deduplication matter for a HIPAA FAQ corpus?

Duplicates degrade ranking. If one FAQ exists at five URLs, five near-identical passages can occupy five of your top ten results and push out the second-best answer. Dedup also keeps the published count honest and stops you paying for the same answer repeatedly.

What is an OCR resolution agreement?

It is a settlement between HHS OCR and a covered entity or business associate resolving an investigation, usually with a payment and a corrective action plan. Civil money penalties are the contested route to a similar outcome. The corpus holds 144 of them under source=hhs_ocr_resolution_agreement.

Can I cite a resolution agreement as authority?

No. It is an agreed resolution in one matter, not a court holding or a rule. Use it as evidence of what OCR investigates and acts on, and cite the regulation itself for the requirement.

Where does the actual HIPAA rule text live in the API?

In the CFR corpus, which holds 219,114 sections and refreshes daily. The Privacy, Security, Breach Notification, and Enforcement Rules are at 45 C.F.R. Parts 160 and 164, with transactions at Part 162. Filter with corpusType=CFR, titleNumber=45, and a part value.

How do I track changes to HIPAA rules or OCR guidance?

Start at GET /boards, which costs nothing and returns every watchable source together with its cadence, its lastRetrievedAt, and its retrievalStatus. Create a watch on the source you care about and poll its changes, or pull a per-section diff when one fires. The agency guidance corpus refreshes weekly and the CFR daily.

Can I ask for HIPAA text as it read in 2019?

Versioning here runs off the amendment record rather than a date parameter. A HIPAA citation resolves to today's text and only today's, because no as_of parameter is offered. You get amendment history per section, a yearFrom and yearTo currency filter that tracks the publisher's own last-amended credit, and diffs going forward on watched boards.

Does using this API make my product HIPAA compliant?

No, and be suspicious of any vendor who says otherwise. It gives you the primary and interpretive material to build against. Compliance is a function of your own safeguards, contracts, and controls, and this API is designed to sit outside your PHI boundary entirely.

How much does a HIPAA search cost?

POST /us/statutes/search is 4 credits per call regardless of corpus, so the three-step chain in this post costs 12. GET /us/statutes/coverage and GET /boards are free. Failed calls are not charged. Pricing detail is in the API credits and pricing explainer.

Priyansh Khodiyar

Co-Founder & CTO

Priyansh leads engineering and AI at Vaquill, from the matter workbench to drafting, document comparison, document matrix, and citation-verified research.