The U.S. Department of Health and Human Services recently published the first in a series of interim enforcement rules under the Health Insurance Portability and Accountability Act. The interim rule took effect May 19, 2003, and expires Sept. 16, 2003. It sets out procedures for conducting investigations and hearings and imposing civil penalties for violations of various HIPAA administrative simplification provisions, including the medical privacy rules. The rule states that HIPAA violations carry penalties of up to $100 a day, capped at $25,000.