Today, the U.S. Department of Health and Human Services, through the Office for Civil Rights (OCR), announced the formation of a new Enforcement Division, Policy Division, and Strategic Planning Division. As HHS’ law enforcement agency, OCR enforces 55 civil rights, conscience and privacy statutes, including the Health Insurance Portability and Accountability Act of 1966 (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009–investigates complaints, conducts compliance reviews, develops policy, promulgates regulations, provides technical assistance, and educates the public about federal civil rights, privacy, and conscience laws. Through its work, OCR safeguards non-discriminatory access to health and human services, and provides tools for covered entities to comply with their obligations and individuals to understand their rights under the law.
“OCR’s caseload has multiplied in recent years, increasing to over 51,000 complaints in 2022– an increase of 69 percent between 2017 and 2022 – with 27 percent alleged violations of civil rights, 7 percent alleged violations of conscience/religious freedom, and 66 percent alleged violations of health information privacy and security laws,” said OCR Director Melanie Fontes Rainer. “Today’s reorganization improves OCR’s ability to effectively respond to complaints, puts OCR in line with its peers’ structure and moves OCR into the future.”
OCR will rename the Health Information Privacy Division (HIP) to the Health Information Privacy, Data, and Cybersecurity Division (HIPDC) to be more reflective of their work and role in cybersecurity. For example, breaches of unsecured protected health information (PHI), including electronic PHI, reported to OCR affecting 500 or more individuals (large breaches) increased from 663 large breaches in 2020 to 714 large breaches in 2021. This trend is continuing and to date, hacking accounts for 80 percent of the large breaches OCR has received. HIPDC will continue to meet the growing demands to address health information privacy and cyber security concerns.
OCR will reorganize the responsibilities of the current Health Information Privacy, Operations and Resources, Civil Rights and the Conscience and Religious Freedom divisions into new functional crosscutting areas: for Policy, Strategic Planning, and Enforcement where staff will work in their areas of expertise based on skill set to drive greater implementation and enforcement of the law. The Enforcement Division, Policy Division, and Strategic Planning Division have been established toprovide a more integrated operational structure for civil rights, conscience protections and privacy protections and cybersecurity protections. OCR’s structure will reflect that of other federal civil rights offices, namely the Department of Education’s Office for Civil Rights, which is aligned similarly. Structuring the overall work in implementing and enforcing the law, the new Enforcement and Policy divisions will be formed to better use OCR’s limited resources by moving to a skill set model, where teams are organized by skillset and focus on a full set of legal issues. This provides a more integrated approach to case management and allows for direct engagement between policy, enforcement, and investigations. This approach is also consistent with the U.S. Department of Education’s Office for Civil Rights.
The newly established Strategic Planning Division will coordinate public outreach on OCR’s authorities to protect civil rights, conscience, and health information privacy as well as expand data analytics and coordinate data collection across HHS leadership… Read the full release here.