Search the News Archive

HHS Office for Civil Rights Issues Letter and Opens Investigation of Change Healthcare Cyberattack

"[HHS'] Office for Civil Rights (OCR) issued a 'Dear Colleague' letter addressing the cybersecurity incident impacting Change Healthcare ... The cyberattack is disrupting health care and billing information operations nationwide and poses a direct threat to critically needed patient care and essential operations of the health care industry." [Also available: Fact Sheet]

Text of HHS Notice: Rescission of 'HHS Notice and Guidance on Gender Affirming Care, Civil Rights, and Patient Privacy' (PDF)

[Feb. 20, 2025; unnumbered] "[E]ffective immediately, the 2022 OCR Notice and Guidance no longer represents the views or policies of HHS OCR. Covered entities should no longer rely on the rescinded 2022 OCR Notice and Guidance. Pursuant to EO 14187 HHS shall, in consultation with the Attorney General, expeditiously issue new guidance protecting whistleblowers who take action related to ensuring compliance with this order."

Text of Annual Report to Congress on Breaches of Unsecured Protected Health Information for Calendar Years 2011 and 2012 (PDF)

"This report describes the types and numbers of breaches reported to the Office for Civil Rights (OCR) (the office within the Department that is responsible for administering and enforcing the HIPAA Privacy, Security, and Breach Notification Rules) that occurred between January 1, 2011, and December 31, 2012, as well as provides some cumulative data on breaches reported since the September 23, 2009, effective date of the breach notification requirements. The report also describes actions that have been taken by covered entities and business associates in response to the reported breaches. In addition, this report generally describes the OCR investigations and enforcement actions with respect to the reported breaches."

Text of HHS RFI on Modifying HIPAA Rules to Improve Coordinated Care

"The Office for Civil Rights (OCR) is issuing this Request for Information (RFI) to assist OCR in identifying provisions of the [HIPAA] privacy and security regulations that may impede the transformation to value-based health care or that limit or discourage coordinated care among individuals and covered entities (including hospitals, physicians, and other providers, payors, and insurers), without meaningfully contributing to the protection of the privacy or security of individuals' protected health information. This RFI requests information on whether and how the rules could be revised to promote these goals, while preserving and protecting the privacy and security of such information and individuals' rights with respect to it."

HHS Final Regulations: Protecting Statutory Conscience Rights in Health Care (PDF)

440 pages. "The United States has a long history of providing protections in health care for individuals and entities on the basis of religious beliefs or moral convictions. Congress has passed many such laws applicable to [HHS] and the programs or activities it funds or administers, some of which are the subject of existing HHS regulations ... This final rule revises existing regulations to ensure vigorous enforcement of Federal conscience and anti-discrimination laws applicable to the Department, its programs, and recipients of HHS funds, and to delegate overall enforcement and compliance responsibility to the Department's Office for Civil Rights ('OCR'). In addition, this final rule clarifies OCR's authority to initiate compliance reviews, conduct investigations, supervise and coordinate compliance by the Department and its components, and use enforcement tools otherwise available in existing regulations to address violations and resolve complaints. In order to ensure that recipients of Federal financial assistance and other Department funds comply with their legal obligations, this final rule requires certain recipients to maintain records; cooperate with OCR's investigations, reviews, or other proceedings; and submit written assurances and certifications of compliance to the Department. The final rule also encourages the recipients of HHS funds to provide notice to individuals and entities about their right be free from coercion or discrimination on account of religious beliefs or moral convictions."

HIPAA Security Rule to Now Be Administered and Enforced by OCR, Not CMS

Excerpt: Department of Health and Human Services (HHS) Secretary Kathleen Sebelius has announced that authority for the administration and enforcement of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule has been delegated to the Office for Civil Rights (OCR).

Text of HHS OCR Notification of Enforcement Discretion for Business Associates and HIPAA

"Current regulations allow a HIPAA business associate to use and disclose protected health information for public health and health oversight purposes only if expressly permitted by its business associate agreement with a HIPAA covered entity.... [E]ffective immediately, the HHS Office for Civil Rights (OCR) will exercise its enforcement discretion and will not impose potential penalties for violations of certain provisions of the HIPAA Privacy Rule against covered health care providers or their business associates for uses and disclosures of protected health information by business associates for public health and health oversight activities during the COVID-19 nationwide public health emergency."

Text of OCR Notice of Proposed Rulemaking: HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information

"The proposals in this NPRM would increase the cybersecurity for ePHI by revising the Security Rule to address: [1] changes in the environment in which health care is provided; [2] significant increases in breaches and cyberattacks; [3] common deficiencies [OCR] has observed in investigations into Security Rule compliance by covered entities and their business associates; [4] other cybersecurity guidelines, best practices, methodologies, procedures, and processes; and [5] court decisions that affect enforcement of the Security Rule." [Also available: Fact Sheet and HHS Press Release]

OCR Training Materials for Health Insurers, Hospitals and Other Healthcare Providers: ACA Section 1557 Nondiscrimination Provisions

"HHS OCR strongly encourages covered entities to train their employees on compliance with Section 1557. To help covered entities, HHS OCR has prepared a Presenter's Guide and accompanying PowerPoint slides. These training materials were created to supplement covered entities' trainings on their internal policies and procedures that are now required under Section 1557."

Text of HHS Proposed Regs: Nondiscrimination in Health and Health Education Programs or Activities

200 pages. "The Department projects that the proposed rule would result in approximately $3.6 billion in cost savings (undiscounted) over the first five years after finalization.... Specifically, the proposed rule would repeal requirements on covered entities to mail beneficiaries, enrollees, and others, notices concerning non-discrimination and the availability of language assistance services (in 15 languages) with every 'significant' publication and communication larger than a postcard or brochure. The Department projects additional savings from eliminating the requirement for OCR to weigh the presence or absence of language access plans, and from repealing provisions that duplicate disability and sex discrimination regulatory requirements concerning covered entities establishing grievance procedures."