Skip to main content
HIPAA Path
Category: OCR Enforcement and Penalties

Department of Justice (DOJ) Referral

Also known as: DOJ Referral, Criminal Referral, DOJ Criminal Referral
Simply put

A DOJ referral is when a matter is passed to the U.S. Department of Justice, which recommends that a prosecutorial body investigate or potentially prosecute one or more entities for possible criminal conduct. In the HIPAA context, this generally arises when a suspected violation may involve criminal wrongdoing rather than being handled solely through civil enforcement. Readers should note the specific procedures and thresholds vary and should be confirmed against current government guidance.

Formal definition

A DOJ referral, in a criminal enforcement sense, is a notice to a prosecutorial body recommending criminal investigation or prosecution of one or more entities. Within HIPAA enforcement, HHS OCR generally handles civil enforcement of the Privacy, Security, Breach Notification, and Enforcement Rules, while matters that may involve criminal violations of HIPAA are typically referred to the DOJ, whose Criminal Division develops, enforces, and supervises the application of federal criminal laws. The precise circumstances, procedural mechanics, and coordination between agencies for such referrals are not fully specified in the evidence provided and should be verified against current DOJ and HHS OCR guidance; this entry does not address civil penalty tiers or the distinction between civil and criminal thresholds, which fall outside the scope of the available evidence.

Why it matters

Most HIPAA enforcement activity is civil in nature and handled by HHS OCR, but a subset of matters may involve suspected criminal conduct. A DOJ referral marks the point at which a matter moves beyond civil enforcement toward possible criminal investigation or prosecution, which carries substantially different stakes for the individuals and organizations involved. Understanding that this pathway exists helps compliance professionals appreciate why some HIPAA incidents are handled very differently from routine civil enforcement.

The distinction matters because civil and criminal enforcement operate under different authorities. HHS OCR generally handles civil enforcement of the Privacy, Security, Breach Notification, and Enforcement Rules, while the DOJ Criminal Division develops, enforces, and supervises the application of federal criminal laws. A referral to DOJ signals that a matter may implicate criminal statutes rather than being resolved solely through civil channels. For organizations, this can change the nature of the exposure and the parties involved in a response.

Because the precise circumstances, thresholds, and procedural mechanics that trigger a referral are not fully specified in the available evidence, professionals should not assume they can predict when a matter will be referred. The specific procedures and coordination between agencies vary and should be confirmed against current DOJ and HHS OCR guidance rather than treated as settled or uniform.

Who it's relevant to

Privacy and Security Officers
Officers responsible for HIPAA compliance should understand that while most enforcement is civil and handled by HHS OCR, some matters may be referred to the DOJ where criminal conduct is suspected. This awareness informs how they escalate and document incidents that could carry more serious implications, though the specific triggers should be confirmed against current government guidance.
Legal and Compliance Counsel
Attorneys advising covered entities and business associates need to recognize the difference between civil enforcement pathways and matters that may be referred to the DOJ Criminal Division. Because the procedures and thresholds for referral vary and are not fully specified in public evidence, counsel should verify current DOJ and HHS OCR guidance when assessing potential criminal exposure.
Compliance and Risk Leadership
Executives and risk managers should factor the possibility of criminal referral into their understanding of the overall enforcement landscape. Recognizing that a matter can move beyond civil enforcement helps leadership scope response planning appropriately, while acknowledging that the coordination between HHS OCR and DOJ is not uniformly documented and should be confirmed against current authoritative sources.

Inside DOJ Referral

Criminal Referral Basis
A DOJ referral in the HIPAA context generally arises when conduct appears to fall under the criminal provisions of HIPAA (knowing wrongful disclosure or obtaining of individually identifiable health information), which are enforced by the DOJ rather than by HHS OCR. Civil enforcement of HIPAA remains with HHS OCR.
Referring Authority
HHS OCR investigates potential HIPAA violations and may refer matters that appear to involve criminal conduct to the DOJ for potential prosecution. The DOJ, not OCR, determines whether to pursue criminal charges.
Distinction from Civil Enforcement
A referral shifts a matter from the civil enforcement track (civil money penalties assessed by OCR) toward the potential criminal track handled by the DOJ. The two tracks address different types of conduct and are not mutually exclusive in all cases.
Covered Persons and Individuals
Criminal liability under HIPAA can attach to individuals whose conduct meets the statutory standard, not only to organizations. Practitioners should verify the current scope of who may be subject to criminal liability against the applicable statute and DOJ guidance.

Common questions

Answers to the questions practitioners most commonly ask about DOJ Referral.

Does HHS OCR handle all HIPAA violations, including criminal ones?
No. HHS OCR is generally responsible for civil enforcement of the HIPAA Rules. Criminal HIPAA violations are typically referred to the Department of Justice (DOJ), which has authority over criminal prosecution. OCR does not prosecute criminal cases itself; when facts suggest a potential criminal violation, the matter may be referred to DOJ for its independent review and decision.
Does a DOJ referral automatically mean criminal charges will be filed?
No. A referral is not a determination of guilt or a guarantee that charges will follow. DOJ exercises its own prosecutorial discretion and independently evaluates whether the facts and applicable law support pursuing a criminal case. A referral means the matter has been forwarded for that consideration, not that a prosecution has been initiated or its outcome decided.
What kinds of conduct typically lead to a DOJ referral rather than civil enforcement?
Referrals generally involve conduct that appears to go beyond civil regulatory noncompliance and suggests potential criminal wrongdoing, such as knowing wrongful acquisition or disclosure of protected health information. Because the line between civil and criminal handling depends on the specific facts and applicable statutory provisions, organizations should treat any indication of potential criminal exposure seriously and consult legal counsel. Confirm the current criteria and statutory framework against the applicable regulatory text and DOJ guidance.
How should a covered entity or business associate respond if it learns a matter may be referred to DOJ?
Organizations generally should involve legal counsel promptly, preserve relevant records and evidence, and avoid actions that could be viewed as obstructive. Because criminal exposure raises considerations distinct from civil compliance, coordination between compliance, privacy, security, and legal functions is typically advisable. Specific response steps depend on the facts and should be guided by qualified counsel.
Can an individual employee, not just the organization, be the subject of a DOJ referral?
Yes, in general. Criminal HIPAA provisions can reach individuals whose conduct meets the applicable statutory elements, not only organizations. This is one reason workforce training and access controls matter. The precise scope of individual liability depends on the governing statutory text and how DOJ applies it, which readers should confirm against current guidance.
Does resolving a civil matter with OCR prevent a separate DOJ referral or criminal action?
Not necessarily. Civil enforcement by OCR and criminal handling by DOJ are generally distinct tracks under different authorities. Resolving or settling a civil matter does not by itself foreclose the possibility of a criminal referral or action where the facts warrant. Organizations should not assume a civil resolution addresses potential criminal exposure and should seek legal advice on the specific circumstances.

Common misconceptions

HHS OCR prosecutes HIPAA criminal cases.
OCR handles civil enforcement of HIPAA and may refer apparent criminal matters, but criminal prosecution is the responsibility of the DOJ. The decision to prosecute rests with the DOJ, not OCR.
A DOJ referral automatically means criminal charges will be filed.
A referral is a step that allows the DOJ to evaluate a matter; it does not guarantee prosecution. The DOJ exercises prosecutorial discretion in deciding whether to bring charges.
Only covered entities and business associates can face HIPAA criminal exposure.
Criminal liability under HIPAA can, in some circumstances, extend to individuals whose conduct meets the statutory standard. Readers should confirm the current scope against the applicable statute and DOJ guidance rather than assume it mirrors civil obligation structures.

Best practices

Treat any indication of a potential DOJ referral as a serious escalation and promptly involve qualified legal counsel experienced in HIPAA criminal matters.
Maintain clear internal documentation distinguishing civil compliance issues from conduct that could constitute knowing wrongful disclosure or acquisition of protected health information.
Understand that civil enforcement by HHS OCR and criminal referral to the DOJ are separate tracks, and avoid assuming resolution of one resolves the other.
Preserve relevant records and avoid altering or destroying information once a matter is under investigation, as this can create additional exposure.
Verify the current statutory standards, applicable authorities, and any penalty figures against the current regulation and DOJ guidance rather than relying on general recollection.
Reinforce workforce training that emphasizes the potential for individual as well as organizational accountability where conduct may meet a criminal standard.