In case of violation of Health and Human Services (HHS) regulations by individuals or entities (this includes HIPAA-covered entities), HHS could decide to create a criminal referral to the Department of Justice (DoJ). For example, if a healthcare worker views patient records without authorization for profit or to cause harm to a person, they may be criminally charged for the breach.
The HHS has just shared its plans to implement rules that enforce criminal liability, following President Trump’s Executive Order about Combating Overcriminalization in Federal Laws (Executive Order 14294). The Executive Order is meant to decrease the regulatory burden on Americans and ensure that they are not criminally charged for breaking a law that they’ve no reason to know exists.
According to the Executive Order, there is disfavor with the policy of the United States in enforcing criminal regulatory offenses. Prosecuting criminal regulatory offenses is best suited for individuals who know or can be assumed to understand what is not allowed or demanded by the law and still decide not to abide, therefore creating or risking considerable public injury. Strict liability criminal acts are normally disfavored, and whenever enforcement is right, agencies should look into civil instead of criminal penalties.
All agencies proclaiming rules that can possibly end in criminal charges must clearly explain the conduct governed by criminal enforcement, the law that allows it, and the mens rea standard relevant to those resources. The Office of the Secretary of the HHS issued a notice in the Federal Register on June 24, 2025. The public notice states that on May 9, 2026, the HHS will give the Director of the Office of Management and Budget (OMB) a checklist of all criminal regulatory offences, the amount of likely penalties, and the appropriate mens rea for every criminal regulatory offense, in accordance with the Executive Order.
HHS has likewise provided the following general guideline regarding the factors to be taken into account whenever deciding to create a criminal referral to the DoJ, complementing those in the Executive Order.
- The harm or risk of harm, monetary or not, brought on by the alleged offense;
- The likely gain to the putative defendant arising from the offense;
- Whether or not the putative defendant had specialized knowledge, competence, or was certified in an industry relevant to the rule or law in question; and
- Evidence, if there is any, of the putative defendant’s general understanding of the illegality of his conduct and his expertise, or lack thereof, of the law in question.