In May, 2023, the Office for Civil Rights (OCR) in the Department of Health and Human Services updated its website to add new data on its HIPAA enforcement efforts over the years. Since April, 2003, when HIPAA covered entities were first required to comply with the HIPAA Privacy Rule, the OCR has investigated and “resolved” more than 30,000 cases in which it required corrective action or provided “technical assistance” (or both) to covered entities and business associates, entered into settlements or imposed civil money penalties in 133 cases leading to recoveries of more than $135 million. Overall, the OCR has received more than 331,100 HIPAA complaints in the last 20 years. Although the vast bulk of cases (approximately 223,000) were determined to be ineligible for enforcement. Over this time, the OCR determining that there no violation occurred in only 14,519 investigations. In approximately 55,000 other cases, the OCR intervened early and provided technical assistance, without the need for an in-depth investigation. While most cases do not result in the imposition of civil money penalties or settlements that require paying fines, our own clients have been investigated by the OCR, and the process can be lengthy, time-consuming and difficult, even when the OCR does not impose penalties or require corrective actions. Dan examines HIPAA enforcement overall, and explores enforcement trends in “HIPAA Enforcement On the Books and In Reality: When It All Goes Wrong,”  Given the prevalence of HIPAA complaints and the hardship of navigating an investigation, our advice is to work to develop and maintain a HIPAA compliance plan.