HCP data · provider directories
HCP Data Providers: U.S. Market, Compliance & Best Practices
May 9, 2025
Updated July 22, 2026
20 min read
Overview of major HCP data providers, U.S. compliance rules, and best practices for pharma IT. Includes vendor comparison, legal requirements, and governance tips.
- 01IQVIA OneKey covers 25 million HCPs and 6 million HCOs across 117 countries, while Veeva OpenData US covers 12 million HCPs and 2 million HCOs, showing wide variance in vendor scale.
- 02Pure HCP contact data is generally not PHI under HIPAA, but any HCP data derived from healthcare transactions containing PHI must be de-identified or used only as the Privacy Rule permits.
- 03CMS Open Payments Program Year 2024 data alone includes 16.16 million records totaling $13.18 billion in payments to covered recipients, showing the scale of pharma-HCP financial reporting obligations.
- 04State privacy laws now cover 19 states as of January 2026, with California's CCPA/CPRA risk-assessment and ADMT rules taking effect January 1, 2026 and 2027 respectively.
- 05The global healthcare provider data management software market was about $3.2 billion in 2024 and is projected to reach roughly $6.5 billion by 2033.
[Revised February 26, 2026]
The U.S. life sciences market relies on numerous specialized vendors for Healthcare Professional (HCP) data. Major commercial providers include:
- IQVIA (OneKey) – A legacy of IMS Health, IQVIA's OneKey database covers 25 million HCPs and 6 million HCOs across 117 countries ([1]). The platform provides 250–1,000 attributes per profile and receives 17.5 million proactive real-time updates each month from an integrated network of more than 1 million contributors ([1]). OneKey is ISO 9001 certified and audited by the Alliance for Audited Media, reflecting its quality emphasis ([2]) ([3]). IQVIA also offers prescription/dispensing datasets (e.g. Xponent and LRx), covering ~90–93% of U.S. retail pharmacy claims for prescriber-level analysis ([4]). For FY2025, IQVIA reported revenue of $16.310 billion ([5]).
- Definitive Healthcare – A publicly traded analytics firm (Nasdaq: DH), with over 3 million U.S. HCP profiles and more than 310,000 healthcare organizations ([6]). Its data include clinician demographics (NPI, name, specialties, affiliations, practice address), business contact info (email, phone) and extensive claims/prescribing records (nearly 28 billion annual Rx claims) ([6]) ([7]). Definitive updates in real time and claims to be one of the few vendors linking 28B Rx and 12.5B medical claims to identifiable providers ([8]). For FY2025, Definitive Healthcare reported revenue of $241.5 million ([9]).
- Veeva Systems (OpenData) – A CRM and master-data-management vendor for life sciences. OpenData US is reference data on U.S. HCPs, HCOs, and their affiliations; Veeva says it covers 12 million HCPs and 2 million HCOs. The product includes more than 100 attributes, including Veeva ID, name, address, phone, NPI, specialty, license information, and sample eligibility, and can be provisioned to Vault CRM, Veeva CRM, Veeva Network, APIs, and data files ([10]). (Veeva reported $2.7466 billion in revenue for FY2025, which ended January 31, 2025 ([11]). Its FY2026 Q3 results reported $811.2 million in quarterly revenue; the company projected FY2026 revenue of about $3.17 billion ([12]).)
- LexisNexis Health Care (Enclarity) – Builds HCP profiles by linking professional licensure, legal and financial records. Its data set can include ~125 fields per provider, combining claims and licensing data with consumer credit/financial attributes ([13]). LexisNexis attaches a confidence score to each profile to indicate completeness ([13]). (Note: LexisNexis acquired Enclarity; IMS Health, now part of IQVIA, acquired Cegedim’s CRM and strategic-data businesses.)
- MedPro Systems – A provider of verified contact and license data for HCPs. MedPro aggregates from 800+ state regulatory sources ([14]) to deliver comprehensive profiles. Its records contain up to 300 data fields per provider ([15]) (address, email, phone, license status, sanctions, affiliations, etc.). MedPro specializes in license verification and sanctions screening under laws like DQSA ([15]).
- AMA Physician Masterfile – The American Medical Association maintains a registry of licensed U.S. physicians. It covers over 1.4 million current and historical MD/DO records (names, specialty, practice locations, education/training) ([16]). Pharma firms often license AMA Masterfile snapshots as a baseline contact list (though it may lack some direct emails or mobile numbers).
- H1 (H1Insights) – A rapidly growing data platform aggregating global HCP information. H1 serves over 250 companies and claims profiles on 11+ million providers worldwide ([17]), including doctors' specialties, institutional affiliations, publication and clinical trial records, and peer network data. In June 2025, H1 acquired Veda Data Solutions to create the industry's first comprehensive end-to-end provider data platform integrating provider directories, networks, rosters, and credentialing ([18]). H1 is backed by investors including Altimeter, Goldman Sachs Asset Management, and is ranked among Y Combinator's Top Private Companies.
- AcuityMD – A surgical/medical device intelligence provider named to Forbes' 2025 "Next Billion-Dollar Startups" list. Its U.S. dataset focuses on clinicians (especially surgeons) and facilities, with procedure volumes, referral networks, payer mixes and affiliations. AcuityMD now serves 300+ MedTech customers—including six of the top 10—such as Becton Dickinson, Teleflex, and Olympus ([19]). The company has raised over $83 million in funding and expanded its AI platform in October 2025 to further automate data management and sales activity ([20]).
- MedTechIntel, MedScout, MedicoReach – Specialized healthcare data vendors. For example, MedTechIntel (musculoskeletal focus) lists ~90K+ surgeons, ASCs and distributors ([21]). MedScout offers HCP, patient and referral data (including prescription and payment trends) ([22]). MedicoReach aggregates 8+ million global HCP/HCO contacts (physicians, dentists, nurses, etc.) with 90%+ email accuracy ([23]). These niche vendors often target device and biotech marketing needs with tailored analytics.
In addition to private vendors, public sources exist. For example, the U.S. NPI Registry (CMS) is a free database of all covered providers’ identifiers, practice addresses and taxonomy codes (currently several million NPIs active ([24])). State medical licensing boards and hospital directories also supply partial data. Many vendors (MedPro, Definitive, etc.) incorporate these public records into their proprietary files.
| Provider | Data Types | Overall coverage or scale | Distinctive Features |
|---|---|---|---|
| IQVIA (OneKey) | Provider identity (NPI, name), business addresses, emails, phone numbers, 248+ specialties; plus prescribing/dispensing (Xponent/LRx) ([3]) ([25]) | 25M HCPs and 6M HCOs globally (117 countries) ([1]) | ISO 9001-certified, annually audited, deep analytics, integrated CRM. |
| Definitive Healthcare | Provider identity (NPI, name), practice locations, emails, phones, specialties, affiliations; clinical/quality metrics; claims and 28B+ pharmacy dispense records ([6]) ([7]) | 3M+ U.S. HCP profiles ([6]) | Real-time updates, linkage of prescribers to claims, HCO connections. |
| Veeva (OpenData US) | Veeva ID, name, address, phone, NPI, specialty, license information, sample eligibility, and HCP/HCO affiliations | 12M HCPs and 2M HCOs in the United States ([10]) | Provisioned to Veeva Network, Vault CRM, Veeva CRM, APIs, and data files. |
| LexisNexis (Enclarity) | Names, addresses, license/credentials, affiliations; enriched with claims and financial data; confidence scores ([13]) | Not publicly disclosed | Up to 125 data fields/provider; emphasis on data quality scoring ([13]). |
| MedPro Systems | Provider identity, mailing/email, phone, medical licenses, sanctions, affiliations | Not published | 300+ data fields per provider ([15]) from 800+ government sources ([14]). |
| AMA Masterfile | Physician/trainee roster: names, specialty, education, practice address, license info | ~1.4M U.S. MD/DO records ([16]) | Official AMA registry (current/historical); widely licensed baseline list. |
| H1 (H1Insights) | Biographical/research data (specialty, publications, trial roles), affiliations, contact info | ~11M HCP globally ([26]) | AI/ML-driven profiles, global scope, focus on expertise networks. |
| AcuityMD | Provider procedures, referral networks, hospital affiliations, payer mix, patient volumes | 300+ MedTech customers including 6 of top 10 ([21]) | Procedure and referral-network analytics for MedTech marketing ([21]). |
| MedicoReach | HCP contact lists (email, phone, address) across specialties; global email campaigns | 8M+ HCP/HCO records (131 countries) ([23]) | Customized email lists (90%+ accuracy) ([23]); broad global coverage. |
| NPI Registry (CMS) | NPI, provider name, practice address, taxonomy | ~7–8M active U.S. NPI records (periodic releases) ([24]) | Public federal data; free directory of all active provider identifiers ([24]). |
U.S. Laws and Regulations Governing HCP Data
Legal requirements in the U.S. cover various aspects of HCP data use. Key rules include:
- HIPAA Privacy Rule – Primarily protects patients’ health information, not providers’ business data. In general, pure HCP contact data (name, business address, specialty) is not PHI. However, HIPAA does affect any marketing that uses patient health data. For example, targeted outreach based on patient health records (or sharing PHI in testimonials) must follow HIPAA authorization rules ([27]). In practice, pharma marketing teams avoid using identifiable patient records without consent. Any HCP data derived from healthcare transactions that contain PHI (for example, prescribing patterns linked to identifiable patient claims) must be de-identified or used and disclosed only as the HIPAA Privacy Rule permits. A business-associate arrangement does not itself authorize a use of PHI; the use must be permitted by the Privacy Rule and the business-associate agreement, and marketing may require the individual's authorization. 2026 Update: HHS continues to describe the HIPAA Security Rule changes issued in December 2024 as a proposed rule. The proposal would strengthen cybersecurity protections for electronic protected health information, but no finalization date should be assumed ([28]).
- CAN-SPAM Act (2003) – Governs all commercial email in the U.S. Any marketing email to HCPs must identify the sender clearly, use accurate headers/subject lines, and include a conspicuous “unsubscribe” option ([29]). Misleading or deceptive content is prohibited, and opt-out requests must be honored promptly ([29]). For example, an email blast to physicians must allow recipients to easily decline further mail (and must not use false “reply” addresses).
- TCPA (Telephone Consumer Protection Act, 1991) – Limits telemarketing calls and texts. It prohibits using an automatic telephone dialing system or prerecorded voice to call or text cell phones without the recipient's prior consent ([30]). 2025–26 Update: The Eleventh Circuit vacated the FCC’s 2023 one-to-one consent restrictions in January 2025 ([31]). The FCC initially delayed the effective date of the cross-message revocation provision in 47 C.F.R. § 64.1200(a)(10) to April 11, 2026; on January 6, 2026, it further extended that limited waiver to January 31, 2027. The FCC specified that the extension applies only to the requirement to treat a revocation in response to one type of message as applying to future unrelated robocalls or robotexts; it does not alter other consent-revocation rules ([32]). For telemarketing or advertising robocalls and robotexts, the FCC’s rules require prior express written consent.
- Physician Payments Sunshine Act – Part of the ACA (implemented 2013), it requires applicable manufacturers and applicable group purchasing organizations to report certain payments or transfers of value. Covered recipients include physicians (excluding medical residents), teaching hospitals, and specified non-physician practitioners: physician assistants, nurse practitioners, clinical nurse specialists, certified registered nurse anesthetists and anesthesiologist assistants, and certified nurse-midwives ([33]). CMS publishes this data annually on the Open Payments website. The Program Year 2024 data (published July 2025) includes 16.16 million records totaling $13.18 billion in payments to covered recipients. Detailed data for program years 2019–2025 is available on the Open Payments Search Tool; CMS summarizes 93.87 million records totaling $82.24 billion in payments and ownership and investment interests across those seven years ([34]). Pharma companies must maintain auditable records of consulting fees, research grants, speaker honoraria, meals, travel and other transfers to HCPs, so that they can be reported accurately and reviewed by the HCPs.
- State Privacy Laws (e.g. CCPA/CPRA) – Broad consumer privacy laws now exist in 19 states as of January 2026, with Kentucky, Indiana, and Rhode Island joining the list on January 1, 2026 ([35]). California's CCPA/CPRA (effective 2020/2023) gives Californians the right to know, delete, and opt out of the sale or sharing of their personal information. Regulations covering risk assessments and automated decisionmaking technology (ADMT) took effect January 1, 2026; businesses subject to risk-assessment requirements must begin compliance then, while businesses using ADMT to make significant decisions must comply with the ADMT requirements beginning January 1, 2027 ([36]). Although these laws exempt medical PHI held by HIPAA-covered entities ([37]), they generally apply to non-HIPAA personal data. State enforcement is accelerating—in July 2025, California secured its largest CCPA settlement to date ($1.55 million). Separately, Texas announced a $1.375 billion settlement with Google in May 2025 resolving claims filed in 2022 concerning geolocation, incognito-search, and biometric data; the Attorney General’s announcement does not characterize it as an enforcement settlement under the Texas Data Privacy and Security Act ([38]). For example, a physician’s request concerning a personal email address requires a fact-specific assessment: the individual must be a California resident, the business must be subject to the CCPA, and the information must not fall within a statutory exception, such as publicly available government-record information.
These laws operate alongside industry codes of conduct (e.g. the AdvaMed or PhRMA Codes) and FDA/FTC advertising rules. All promotional and data practices must comply with anti-kickback statutes and truthful marketing requirements as well.
IQVIA OneKey HCP coverage globally
Definitive Healthcare U.S. provider profiles
Veeva OpenData US HCP coverage
CMS Open Payments total for Program Year 2024
- 2025Eleventh CircuitJan 2025
Eleventh Circuit vacated the FCC's 2023 one-to-one consent rule, reshaping TCPA consent requirements.
- Jan 2026FCCJan 31, 2027
FCC extended the limited waiver on the cross-message revocation provision to January 31, 2027.
- Jan 2026State Privacy Laws
Kentucky, Indiana, and Rhode Island became the newest of 19 states with comprehensive privacy laws.
- Jan 2026California Privacy Protection Agency
California's risk-assessment rules took effect January 1, 2026; ADMT compliance follows January 1, 2027.
- Jul 2025California AG (CCPA)$1.55 million
California secured its largest CCPA settlement to date.
- May 2025Texas AG / Google$1.375 billion
Texas resolved 2022 data-privacy claims against Google with a major settlement.
“A business-associate arrangement does not itself authorize a use of PHI; the use must be permitted by the Privacy Rule and the business-associate agreement, and marketing may require the individual's authorization.
Compliance Requirements (Pharma/IT) with Examples
Pharmaceutical companies and their IT teams must translate these laws into concrete practices. Key compliance steps include:
- Email Marketing Compliance: Always honor CAN-SPAM opt-outs. For example, every promotional email to HCPs should contain a clear unsubscribe link and truthful sender information ([29]). Marketers must never use misleading subject lines. E-mail tracking should flag any bounce or opt-out to remove that physician from future lists.
- Telephone/Texting Rules: For telemarketing or advertising robocalls and robotexts, obtain and retain prior express written consent. Maintain suppression processes for revocations and other applicable opt-outs, and ensure automated outreach workflows reflect the current FCC rules and any applicable exemptions ([31]).
- HIPAA/Privacy Safeguards: Ensure no protected patient data is used in HCP campaigns. For instance, if a sales CRM holds de-identified prescribing data, it must remain unlinked to patient identities. For electronic PHI, implement safeguards that are reasonable and appropriate to the organization’s risk analysis; encryption and role-based access controls are common measures, but encryption is an addressable Security Rule implementation specification rather than a universal mandate ([39]). Apply the minimum-necessary standard to the uses, disclosures, and requests to which it applies; it has exceptions, including treatment disclosures ([40]). Any health data used for targeting must be de-identified or otherwise used and disclosed as HIPAA permits, including under an applicable business-associate arrangement.
- Sunshine Act Recordkeeping: Track all transfers of value to HCPs with precision. Systems must capture the covered recipient’s legal name, applicable identifying information (including an NPI when the recipient has one), affiliated institution when relevant, and payment details. For a non-physician practitioner without an NPI, CMS allows reporting entities to report up to five state licenses on the payment record ([41]). Covered recipients who register in the Open Payments system may review and dispute submitted records during CMS’s 45-day pre-publication review and dispute period; this is not a manufacturer obligation before reporting. For example, if a rep provides a physician with an iPad for presentations, IT should ensure that expense is captured and coded correctly so it shows up in the physician’s Open Payments record.
- CCPA/State-Law Compliance: If handling HCPs’ personal data (especially of residents in regulated states), update privacy policies accordingly. Provide mechanisms for physicians to exercise rights – e.g. a public “Do Not Sell My Info” notice, and procedures to locate and delete a provider’s personal info on request ([42]). Log data processing activities and obtain consents where needed for analytics or data enrichment.
- Consent & Preference Management: Implement explicit consent tracking for outreach. For example, use MDM tools (like Veeva Network) to flag each HCP’s communication preferences. The Align Biopharma consortium (led by Veeva) is developing a standard so HCPs can specify which communications they accept ([43]). Even today, pharma IT should store opt-in/opt-out flags (e.g. physician registered/not registered for email campaigns) and respect them across systems.
Taken together, these requirements mean that IT systems must combine data governance with compliance logic. For example, customer master data applications should enforce validation rules (no adult patient PHI fields in provider profiles) and filter out any non-business addresses. In marketing automation, transactional data flows should include consent checks and suppression lists. Audit trails are critical: every use of HCP data should be logged so that compliance officers can demonstrate adherence (e.g. which email blasts went to which physicians and when they opted out).
Every promotional email to HCPs should contain a clear unsubscribe link and truthful sender information.
For telemarketing or advertising robocalls and robotexts, obtain and retain prior express written consent.
Ensure no protected patient data is used in HCP campaigns.
Track all transfers of value to HCPs with precision.
If handling HCPs' personal data, especially residents of regulated states, update privacy policies accordingly.
Implement explicit consent tracking for outreach and honor communication preferences across systems.
Audit trails let compliance officers demonstrate adherence across every HCP data touchpoint.
Market Size and Industry Statistics
The market for HCP data and analytics is significant and growing. Industry reports estimate the global healthcare provider data management software market was about $3.2 billion in 2024, projected to reach ~$6.5 billion by 2033 ([44]). This includes MDM, CRM and analytics solutions that underpin HCP data. In the U.S., major companies’ financials illustrate the scale: IQVIA reported $16.310 billion in FY2025 revenue ([5]), and Veeva Systems reported $2.7466 billion in FY2025 revenue; its Q3 FY2026 revenue was $811.2 million, up 16% year over year ([11]; Veeva FY2026 Q3 results). By comparison, Definitive Healthcare’s 2024 revenue was $252 million ([45]), reflecting its niche focus.
As context for data volumes: a CDC analysis notes the AMA Masterfile contains 1.4 million active physicians and residents in the U.S. ([16]). Definitive Healthcare alone profiles over 3 million U.S. providers and 310,000+ healthcare organizations ([6]). Veeva states that OpenData US covers 12 million HCPs and 2 million HCOs, while H1 aggregates ~11 million worldwide ([10]; Creating a Healthier Future-H1). Meanwhile, the CMS Open Payments database published 16.16 million payment records totaling $13.18 billion for Program Year 2024 alone. The Open Payments Search Tool provides detailed data for program years 2019–2025; CMS summarizes 93.87 million records totaling $82.24 billion in payments and ownership and investment interests across those seven years ([34]). These figures underscore the volume of pharma–HCP financial interactions.
In summary, the HCP data solutions sector (provider directories, prescribing databases, CRM/MDM platforms) represents a multibillion-dollar industry. The U.S. life sciences field continually invests in these tools – for example, IQVIA’s R&D/analytics business grew 6% in 2023 ([46]) – reflecting the strategic value of accurate provider information.
“Any marketing email to HCPs must identify the sender clearly, use accurate headers/subject lines, and include a conspicuous “unsubscribe” option
Best Practices and Data Governance in Pharma IT
To ensure compliance and ethical use of HCP data, IT departments in pharma companies should adopt robust data governance and security practices:
- Data Classification & Minimization: Define data categories (e.g. “business contact,” “licensure data,” “sensitive personal”) and only collect fields needed for a purpose. Avoid storing non-work personal identifiers (like home addresses) when possible. This limits exposure under privacy laws. Keep an inventory (data map) of all HCP information sources and flows.
- Strong Access Controls: Implement role-based access and multi-factor authentication for all HCP databases ([47]). For example, marketing teams might see only business contact info, while legal/compliance roles can access payment records. Regularly review permissions (e.g. employee/partner offboarding).
- Encryption and Security: Encrypt HCP data at rest and in transit ([47]) ([48]). Use VPNs or secure APIs for data sharing. If a breach occurs, encryption ensures intercepted records remain unintelligible. Patch and harden servers storing sensitive data.
- Data Quality & Master Data Management: Use MDM systems (e.g. Veeva Network, Reltio) to deduplicate and unify HCP identities. Regularly cleanse lists against up-to-date sources (e.g. NPI updates, state board feeds). High-quality data helps compliance (e.g. sending emails to valid addresses avoids spam issues) and analytics accuracy.
- Audit Logging & Monitoring: Maintain detailed logs of data access and transactions. Real-time monitoring or anomaly detection platforms can alert on unusual activity (e.g. bulk downloads) ([49]). Conduct periodic audits of data usage, permissions, and third-party vendor compliance. For example, verify that a mailing list vendor is not including opted-out HCPs.
- Consent and Preference Tracking: As noted above, record each HCP’s communication preferences ([43]). For instance, if a doctor declines email marketing, flag their record so all systems honor that choice. Embed consent options in digital signup forms (e.g. allow HCPs to select topics of interest). This not only aids TCPA/CAN-SPAM compliance, but also aligns with ethical marketing.
- Governance Policies and Training: Develop written policies covering HCP data handling (e.g. “No PHI in Marketing Collateral”). Train sales, marketing and IT staff on these policies and relevant laws. For example, ensure reps know not to capture patient stories without HIPAA-compliant approvals. Review and update policies when regulations change.
- Vendor Due Diligence: When licensing HCP lists or analytics from third parties, require contractual assurances of legal sourcing and data accuracy. Evaluate vendors’ privacy/security certifications. For instance, if a vendor claims to use “publicly scraped” email addresses, confirm that this complies with data protection rules.
By combining these practices, pharma IT can build a compliant, secure infrastructure for HCP data. For example, a best-in-class approach might use a data governance platform that automates data quality checks and lineage tracking, while business rules enforce that any outbound marketing contact list is pre-screened against opt-out flags ([50]) ([49]). Ongoing review and cross-functional oversight (including legal, medical affairs, IT and marketing) ensure that HCP data drives business value safely and in accordance with U.S. law.
Sources: Authoritative industry and government publications (e.g. IQVIA and Definitive earnings reports ([46]) ([45]), CMS/CDC statistics ([16]) ([51]), verified market research ([44]), and compliance guides ([29]) ([52])) were used to compile this report. Each provider and legal requirement is cited to credible sources as noted.
Sources / 52
Need Expert Guidance on This Topic?
Let's discuss how IntuitionLabs can help you navigate the challenges covered in this article.
I'm Adrien Laurent, Founder & CEO of IntuitionLabs. With 25+ years of experience in enterprise software development, I specialize in creating custom AI solutions for the pharmaceutical and life science industries.
The information contained in this document is provided for educational and informational purposes only. We make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability, or availability of the information contained herein. Any reliance you place on such information is strictly at your own risk. In no event will IntuitionLabs.ai or its representatives be liable for any loss or damage including without limitation, indirect or consequential loss or damage, or any loss or damage whatsoever arising from the use of information presented in this document. This document may contain content generated with the assistance of artificial intelligence technologies. AI-generated content may contain errors, omissions, or inaccuracies. Readers are advised to independently verify any critical information before acting upon it. All product names, logos, brands, trademarks, and registered trademarks mentioned in this document are the property of their respective owners. All company, product, and service names used in this document are for identification purposes only. Use of these names, logos, trademarks, and brands does not imply endorsement by the respective trademark holders. IntuitionLabs.ai is an AI software development company specializing in helping life-science companies implement and leverage artificial intelligence solutions. Founded in 2023 by Adrien Laurent and based in San Jose, California. This document does not constitute professional or legal advice. For specific guidance related to your business needs, please consult with appropriate qualified professionals.
Related Articles
Marketing Technology (MarTech) API Integrations in Life Sciences
Guide to MarTech API integrations for pharma: CRM, marketing automation, analytics, consent, compliance, and best practices for unified digital engagement.
UX Best Practices for HCP Engagement Platforms
Evidence-based UX strategies for digital HCP engagement platforms in pharma: trends, challenges, best practices, and compliance for IT teams.
HIPAA Compliance for APIs: A Technical Implementation Guide
Learn to design, secure, and manage a HIPAA-compliant API. Updated for 2026 with the proposed Security Rule overhaul, mandatory encryption and MFA requirements, and current enforcement trends.