The HIPAA Enforcement Rule contains provisions relating to HHS's investigation of compliance by covered entities, both through the investigation of complaints and the conduct of compliance reviews, and also establishes rules governing the process and grounds for establishing the amount of a civil money penalty for a HIPAA violation. The Secretary of HHS has delegated administration and enforcement of privacy and security standards to the department's Office of Civil Rights (OCR).