| | |

HHS Restructures OCR to Handle Increased HIPAA Complaints

It should not come as a surprise that on February 27, 2023 HHS announced three new divisions within the Office of Civil Rights (OCR): An Enforcement Division, a Policy Division, and a Strategic Planning Division. In HHS’s report to Congress, HHS noted a 25% increase in HIPAA and HITECH complaints received in 2020.

The Director of the OCR, Melanie Fontes Rainer went on to say, “OCR’s caseload has multiplied in recent years, increasing to over 51,000 complaints in 2022– an increase of 69 percent between 2017 and 2022 – with 27 percent alleged violations of civil rights, 7 percent alleged violations of conscience/religious freedom, and 66 percent alleged violations of health information privacy and security laws.”

HHS believes the new OCR’s divisions will provide “a more integrated operational structure for civil rights, conscience protections and privacy protections and cybersecurity protection.”

The announcement stated, “the OCR will reorganize the responsibilities of the current Health Information Privacy, Operations and Resources, Civil Rights and the Conscience and Religious Freedom divisions into new functional crosscutting areas: for Policy, Strategic Planning, and Enforcement where staff will work in their areas of expertise based on skill set to drive greater implementation and enforcement of the law.”

The Health Information Privacy Division (HIP) of the OCR will be renamed the Health Information Privacy, Data, and Cybersecurity Division (HIPDC) to be more reflective of their work and role in cybersecurity. The focus of this division includes breaches of unsecured protected health information (PHI), including electronic PHI, reported to OCR affecting 500 or more individuals. Large breaches increased from 663 in 2020 to 714 in 2021. “This trend is continuing and to date, hacking accounts for 80 percent of the large breaches OCR has received.” 

Luis Perez will head up the newly established Strategic Planning Division, which will coordinate public outreach on OCR’s authorities to protect civil rights, conscience, and health information privacy as well as expand data analytics and coordinate data collection across HHS leadership.

You can read the announcement here.

Leave a Reply