On February 27, 2023 the U.S. Department of Health and Human Services (HHS), through the Office for Civil Rights (OCR), announced the formation of three new divisions within the office: Enforcement Division, Policy Division, and Strategic Planning Division. OCR is an agency of HHS and is responsible for enforcing over 50 civil rights, conscience, and privacy statutes, including the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Heath Act of 2009 (HITECH). OCR also investigates complaints, conducts compliance reviews, develops policy, and much more to help covered entities comply with their obligations and individuals understand their rights.
The creation of these new divisions is being driven by an increase in cases that get referred or reported to the agency. According to OCR Director Melanie Fontes Rainer, OCR’s caseload from 2017 to 2022 has gone up by about 69%. In 2022, there were 51,000 complaints and over 66% of those stemmed from alleged violations of health information privacy and security laws. In response to this increased case volume, HHS is renaming the Health Information Privacy Division (HIP) and reorganizing the responsibility of the current divisions into new functional cross-cutting areas.
HIP will now be known as the Health Information Privacy, Data, and Cybersecurity Division (HIPDC). This title is meant to capture the division’s work and role in cybersecurity. HHS believes the increase in reporting HIPAA concerns will continue to grow.
OCR is also reorganizing the responsibilities of the current Health Information Privacy, Operations and Resources, Civil Rights and the Conscience and Religious Freedom divisions. The divisions were created to provide a more integrated operational structure for civil rights, conscience protections, privacy protections, and cybersecurity protections. This restructure reflects the way other federal civil rights offices, such as the Department of Education’s Office for Civil Rights, are organized.
The Enforcement and Policy divisions were created to ensure better effectiveness and efficiency of resources, where teams are organized by their expertise and can focus on a full set of legal issues. OCR believes this will help create a more collaborative approach to case management and will allow for direct engagement between policy, enforcement, and investigations. Meanwhile, the newly formed Strategic Planning Division will focus its efforts on coordinating public outreach on OCR’s authorities to protect civil rights, conscience, and health information privacy. It will also be charged with expanding data analytics and coordinating data collection across HHS leadership.
Covered entities and business associates will need to be diligent and prepared for the potential increased communication, investigations and overall scrutiny from the OCR, as well as an increase to the speed at which issues are addressed by the agency.
A link to the announcement from OCR can be found at https://www.hhs.gov/about/news/2023/02/27/hhs-announces-new-divisions-within-office-civil-rights-better-address-growing-need-enforcement-recent-years.html.
