The U.S. Department of Health and Human Services (HHS) announced the formation of a new Enforcement Division, Policy Division, and Strategic Planning Division to better address growing enforcement trends, including a crackdown on data breaches and other privacy violations.
In recent years, the caseload of the Office for Civil Rights (OCR), the law enforcement agency of HHS, increased 69 percent between 2017 and 2022—to over 51,000 complaints in 2022, said OCR Director Melanie Fontes Rainer. Among those complaints, 27 percent alleged violations of civil rights, seven percent alleged violations of conscience/religious freedom, and 66 percent alleged violations of health information privacy and security laws, according to OCR data.
This reorganization “improves OCR’s ability to effectively respond to complaints, puts OCR in line with its peers’ structure, and moves OCR into the future,” Fontes Rainer said.
OCR will rename the Health Information Privacy Division (HIP) to the Health Information Privacy, Data, and Cybersecurity Division (HIPDC) to reflect its work and role in cybersecurity, OCR said. For example, large breaches of unsecured protected health information (PHI) reported to OCR (affecting 500 or more individuals) increased from 663 in 2020 to 714 in 2021, 80 percent of which resulted from hackers, OCR said.
OCR said it will reorganize the responsibilities of the current Health Information Privacy, Operations and Resources, Civil Rights and the Conscience and Religious Freedom divisions into new functional cross-cutting areas: for Policy, Strategic Planning, and Enforcement, “where staff will work in their areas of expertise based on skill set to drive greater implementation and enforcement of the law.”
“The Enforcement Division, Policy Division, and Strategic Planning Division have been established to provide a more integrated operational structure for civil rights, conscience protections and privacy protections and cybersecurity protections,” OCR said. “OCR’s structure will reflect that of other federal civil rights offices, namely the Department of Education’s Office for Civil Rights, which is aligned similarly.”
Emphasis on Enforcement
Through this new structure, the new Enforcement and Policy divisions will “better use OCR’s limited resources by moving to a skill set model, where teams are organized by skillset and focus on a full set of legal issues,” OCR added. “This provides a more integrated approach to case management and allows for direct engagement between policy, enforcement, and investigations.
“As a trusted advisor and leader of the newly established division, Luis Perez will direct the standalone Enforcement Division that will provide vital integration between our regional offices and headquarters staff to swiftly investigate and determine appropriate steps for all complaints we receive,” Fontes Rainer said. “This structure will enable OCR staff to leverage its deep expertise and skills to ensure that we are protecting individuals under the range of federal laws that we are tasked with enforcing.”
The newly established Strategic Planning Division will coordinate public outreach on OCR’s authorities to protect civil rights, conscience, and health information privacy, as well as expand data analytics and coordinate data collection across HHS leadership. 
Jaclyn Jaeger is a contributing editor at Compliance Chief 360° and a freelance business writer based in Manchester, New Hampshire.