A new HHS policy outlines how and when regulatory violations may be referred for criminal prosecution, in line with a federal push to reduce overcriminalization.
What happened
The Department of Health and Human Services (HHS) has published a new general policy explaining when it will consider referring regulatory violations for criminal prosecution by the Department of Justice (DoJ). The update aligns with Executive Order 14294, issued under the Trump administration, which aims to limit criminal penalties to violations involving clear knowledge and significant harm.
The policy focuses on ensuring individuals are not criminally charged for regulatory breaches they could not reasonably have known were offenses. HHS clarified that criminal referrals will prioritize cases where violations were intentional, involved substantial harm, or offered personal gain to the violator.
Going deeper
Executive Order 14294, titled Fighting Overcriminalization in Federal Regulations, directs federal agencies to distinguish between civil and criminal enforcement and to avoid criminal referrals for technical or obscure regulatory violations. The order calls for agencies to clearly identify the types of conduct that may lead to criminal charges, along with the applicable statutes and standards of intent.
In response, the HHS announced that by May 9, 2026, it will submit a detailed inventory to the Office of Management and Budget (OMB). This list will include all regulations that carry criminal liability, the potential penalties, and the level of intent required for prosecution.
The policy specifies four core factors that HHS will consider before making a criminal referral:
- The actual or potential harm caused by the violation
- The personal benefit the violator may have received
- Whether the violator had specialized knowledge or professional licensing
- The violator’s awareness or understanding of the unlawful nature of their conduct
What was said
The published policy does not introduce new rules but clarifies the process the HHS will follow to comply with the Executive Order. The agency stated its intent to avoid criminalizing inadvertent mistakes or minor infractions. Instead, enforcement efforts will concentrate on intentional or reckless conduct that causes or risks public harm.
The big picture
The new HHS policy clarifies how the agency will handle criminal referrals for regulatory violations, in line with Executive Order 14294. Rather than penalizing technical or unintentional breaches, HHS will focus on cases involving clear intent, personal gain, or significant harm. For healthcare providers and professionals, the update offers greater clarity around enforcement standards and may reduce the risk of criminal exposure for administrative errors that lack malicious intent.
FAQs
What is mens rea and why does it matter in regulatory enforcement?
Mens rea refers to the level of intent or knowledge required to establish criminal liability. The HHS must now clarify the mens rea standard for each regulation it enforces, ensuring that only violations involving clear intent or recklessness are subject to criminal prosecution.
Will this change how HIPAA violations are handled?
HIPAA violations that involve deliberate misuse of patient data or clear malicious intent may still be referred for criminal enforcement. However, inadvertent or minor breaches may now be more likely to result in civil penalties instead.
How does this affect licensed healthcare professionals?
Professionals with specialized training or licensure are more likely to be held to a higher standard under the new policy. Their knowledge of applicable regulations may influence whether HHS sees a violation as intentional or negligent.
What must HHS submit to the OMB by May 2026?
HHS is required to compile and submit a list of all criminal regulatory offenses under its authority, including the applicable statutes, potential penalties, and the required level of intent.
Does this policy apply only to healthcare-related regulations?
While issued by HHS, the framework follows a government-wide directive. Other federal agencies are also expected to review their enforcement approaches and reduce criminal penalties for unintentional regulatory violations.
Farah Amod
