OCR Creates Religious Discrimination Units: What the Restructuring Means for HIPAA Enforcement

The most significant development in HIPAA enforcement this week did not involve a settlement, a penalty, or a new guidance document. It involved a reorganization that raises fundamental questions about whether the agency charged with enforcing healthcare privacy law will have the resources and focus to do so effectively.

What OCR announced

On May 19, 2026, the HHS Office for Civil Rights announced that it will create new organizational units focused on religious discrimination in healthcare. OCR announced it will stand up a new office dedicated to pursuing cases of religious discrimination alleged by healthcare workers and patients, as well as a new unit focused on matters such as anti-Christian bias and anti-Semitism.

The announcement was notable not just for what it added but for the context surrounding it. The latest shuffling of resources comes during a period of persistent cyberattacks and other breaches in the healthcare sector, as well as during a time when critical regulatory updates are in the works for both the HIPAA security and privacy rules. The number of civil servants available to enforce HIPAA shrank considerably during restructuring of the administration's first year in which HHS cut 20,000 jobs and closed many regional offices.

The enforcement capacity question

OCR's formal position is that the department will continue to enforce HIPAA privacy and security regulations. That commitment should be taken at face value — OCR has not announced any change to its enforcement initiatives, and the Risk Analysis Initiative and Right of Access Initiative remain formally active.

But enforcement is a resource-dependent activity. Every investigation requires investigators. Every complaint requires intake staff. Every settlement requires attorneys and compliance monitors. When an agency loses significant staff and closes regional offices — while simultaneously being asked to stand up new organizational units with different priorities — the practical capacity to enforce existing programs is affected regardless of formal commitments.

Close observers are worried that OCR will focus less on an epidemic of breaches and more on ideologically-charged Trump administration priorities, with data breach-related work already diminished.

This concern is not unreasonable. In 2024, OCR handled over 51,000 complaints with a staff that has since been significantly reduced. The math of fewer investigators processing more complaints — while also building new units for religious discrimination cases — creates pressure on HIPAA enforcement capacity that is structural, not cosmetic.

What has already changed

The regional office closures are the most concrete development with measurable enforcement implications. OCR's ten regional offices have historically been the primary points of contact for:

• Complaint intake from individuals who believe their HIPAA rights were violated
• Initial investigation of complaints before escalation to headquarters
• Geographic coverage for on-site investigations when needed
• Local relationships with covered entities in their regions

Closing regional offices does not eliminate OCR's enforcement authority. But it does concentrate enforcement capacity in fewer locations, extend the geographic reach each remaining office must cover, and lengthen the investigation timelines that have already been a source of frustration for complainants.

What this means for covered entities

The practical implications cut in two directions — and organizations should be careful not to draw the wrong conclusion from either.

What it does not mean: Reduced enforcement capacity is not an invitation to reduce compliance investment. Organizations that assume a smaller, distracted OCR means reduced enforcement risk are making a strategic miscalculation. A more constrained OCR is likely to be more selective — focusing its limited investigative resources on the largest breaches, the most egregious violations, and the cases most likely to produce significant financial penalties and corrective action plans. Being on the wrong end of that selection is potentially worse than being investigated by a well-staffed agency with broader enforcement bandwidth.

What it may mean: Investigation timelines for complaints and smaller breaches may lengthen. The Right of Access Initiative, which has historically pursued even modest violations following individual complaints, may see reduced activity if complaint volume exceeds investigative capacity. Organizations that have been counting on OCR to pursue right of access violations on their behalf may find the agency less responsive.

The broader political context

This restructuring reflects a deliberate set of priorities by the Trump administration. Civil rights enforcement focused on religious discrimination and anti-Christian bias represents a clear ideological direction for OCR that is distinct from its historical focus on healthcare privacy and non-discrimination in healthcare access.

Privacy attorney Adam Greene of law firm Davis Wright Tremaine described the May 2026 date listed in the HHS regulatory agenda for the Security Rule final rule as "more aspirational than a deadline." That assessment, made before the latest restructuring announcement, looks even more accurate in light of the new organizational priorities OCR has now formalized.

The Federal Trade Commission's trajectory is also relevant context. The FTC, which during the Biden administration stepped up enforcement of consumer health data privacy and security issues, is expected to pull back on privacy efforts from the last administration in 2026. If both OCR and the FTC reduce their health privacy enforcement activity simultaneously, the regulatory environment for healthcare data security shifts materially.

What covered entities should do

The appropriate response to this uncertainty is not to reduce compliance investment — it is to strengthen the documentation that makes an organization defensible if and when OCR does investigate.

OCR investigations are triggered by two primary sources: individual complaints and mandatory breach reports. Neither of those triggers is affected by OCR's internal restructuring. When a patient files a complaint or a breach is reported to HHS, an investigation opens. Whether that investigation proceeds quickly or slowly, and whether it results in a settlement or technical assistance, depends heavily on what the organization can produce.

Organizations with current risk analyses, documented risk management plans, complete training records, executed BAAs, and evidence of prompt response to compliance issues consistently receive better outcomes than those that cannot produce documentation — regardless of the enforcement environment.