The U. S. Department of Health and Human Services establishes standards for the use and disclosure of "Protected Health Information", or PHI, as defined by the Health Insurance Portability and Accountability Act of 1996, or “HIPAA". Within HHS, the Office for Civil Rights (“OCR”) has responsibility for the implementation and enforcement of these rules. Interpreters who provide VRI services, as per both the contractual agreements between parties and HIPAA guidelines, are considered Business Associates (opens in new window) and are bound by specific rules under both the HIPAA Security Rule and the HIPAA Privacy Rule which is outlined in the DHHS Direct Liability of Business Associates fact sheet (opens in new window).