Announced Reorganization Of OCR
The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced a significant reorganization on May 18, 2026. OCR is the HHS office responsible for enforcing federal civil rights laws, health information privacy protections, and patient access rights in health and human services settings. The restructuring divides OCR into three primary subject-matter divisions: (1) the Conscience and Religious Freedom Division, (2) the Civil Rights Division, and (3) the Health Information Privacy, Data, and Cybersecurity Division. The stated intention is to return OCR to a “program-based structure” and strengthen enforcement of religious liberty protections, conscience protections, civil rights laws, and health information privacy and cybersecurity requirements.
For healthcare providers, compliance officers, and privacy professionals, the restructuring signals several likely enforcement priorities, including continued aggressive enforcement of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, Security Rules, and Breach Notification Rule. It also suggests greater OCR emphasis on cybersecurity, data protection, antisemitism, and anti-Christian bias complaints. HHS stated that the restructuring is not expected to reduce OCR staffing levels. Compliance officers may expect updated OCR guidance, possible shifts in enforcement resources and timelines, changes in investigative procedures, increased scrutiny involving conscience and religious accommodation issues, continued cybersecurity investigations, and stronger integration between privacy and cyber enforcement functions. As a result of these changes, healthcare organizations may want to reassess HIPAA cybersecurity readiness, monitor OCR enforcement trends closely, and update board and executive compliance briefings regarding OCR priorities. The current head of OCR is Paula M. Stannard, who was appointed in June 2025 by HHS Secretary Robert F. Kennedy Jr. and has extensive state and HHS work experience.
For more information on this and other compliance topics, contact Richard Kusserow at [email protected].
