News
Amplifon Discloses February 2026 Cyberattack Affecting Patients' Hearing and Medical Records, Including Social Security Numbers · Data BreachINC Ransom Claims Attack on Tanner Clinic, Utah Multispecialty Medical Group; Patient Data at Risk · Data BreachPremise Health Insider Breach Affects 417,000 Patients in Five States; Nationwide Toll May Reach Millions · Data BreachOCR Settles HIPAA Security Rule Investigation with Genetic Testing Firm for $700,000 Following 2020 Phishing Breach Affecting 225,370 Individuals · OCR EnforcementMultistate AG Coalition Reaches $10 Million Settlement with Perry Johnson & Associates Over 13.3 Million-Record Medical Transcription Breach · OCR EnforcementCognitive Health Technologies Discloses Network Intrusion Affecting 49,467 Patients; Added to HHS Breach Portal · Data BreachHCA Healthcare, Blossom Health, El Camino Health, and UMMC Disclose Patient Data Breaches; Medusa Ransomware Linked to UMMC Incident · Data BreachVida Y Salud-Health Systems and Hampton Regional Medical Center Reach Class-Action Data Breach Settlements · Data BreachMarathon Health Discloses August 2026 Social-Engineering Breach Affecting 5.7 Million Employer-Plan Members · Data BreachUniversity Hospitals (Cleveland) Still Offline Weeks After October 22 Cyberattack; EyeMed Vision Care and Facial Surgery Group Also Report Incidents · Data BreachFour Healthcare Entities Disclose New Breaches: Cognitive Health Technologies, City Ambulance Service, Baraga County Memorial Hospital, and Others · Data BreachOCR Settles HIPAA Ransomware Investigation with Lehigh Valley Health Network · OCR EnforcementHospital Ransomware Attacker Sentenced to 70 Months in Federal Prison for Extorting Healthcare Targets · OCR EnforcementConduent Agrees to $80 Million Class-Action Settlement Over 62.2 Million-Record Healthcare Data Breach · Data BreachDenver Health Medical Plan Notifies 238,000 Members After Vendor SquareML Access-Key Leak Exposes Personal and Health Data · Data BreachByod Ransomware Group Claims Attack on UNM Health Sciences Center, Disrupting Surgeries and Ambulance Diversions at New Mexico's Only Level I Trauma Center · Data BreachInsomnia Ransomware Group Claims Attack on NorthShore Health Centers; Indiana Nonprofit Warns Patients of PHI Exposure · Data BreachQuest Diagnostics Discloses Breach of Quanum Lab Services Manager; Unauthorized Party Accessed Patient Records · Data BreachManhattan Law Firm Tarter Krinsky & Drogin Reports PHI Breach Affecting 196,645 Patients; Park Dental and Heritage Pediatrics Also Disclose Incidents · Data BreachAmplifon Discloses February 2026 Cyberattack Affecting Patients' Hearing and Medical Records, Including Social Security Numbers · Data BreachINC Ransom Claims Attack on Tanner Clinic, Utah Multispecialty Medical Group; Patient Data at Risk · Data BreachPremise Health Insider Breach Affects 417,000 Patients in Five States; Nationwide Toll May Reach Millions · Data BreachOCR Settles HIPAA Security Rule Investigation with Genetic Testing Firm for $700,000 Following 2020 Phishing Breach Affecting 225,370 Individuals · OCR EnforcementMultistate AG Coalition Reaches $10 Million Settlement with Perry Johnson & Associates Over 13.3 Million-Record Medical Transcription Breach · OCR EnforcementCognitive Health Technologies Discloses Network Intrusion Affecting 49,467 Patients; Added to HHS Breach Portal · Data BreachHCA Healthcare, Blossom Health, El Camino Health, and UMMC Disclose Patient Data Breaches; Medusa Ransomware Linked to UMMC Incident · Data BreachVida Y Salud-Health Systems and Hampton Regional Medical Center Reach Class-Action Data Breach Settlements · Data BreachMarathon Health Discloses August 2026 Social-Engineering Breach Affecting 5.7 Million Employer-Plan Members · Data BreachUniversity Hospitals (Cleveland) Still Offline Weeks After October 22 Cyberattack; EyeMed Vision Care and Facial Surgery Group Also Report Incidents · Data BreachFour Healthcare Entities Disclose New Breaches: Cognitive Health Technologies, City Ambulance Service, Baraga County Memorial Hospital, and Others · Data BreachOCR Settles HIPAA Ransomware Investigation with Lehigh Valley Health Network · OCR EnforcementHospital Ransomware Attacker Sentenced to 70 Months in Federal Prison for Extorting Healthcare Targets · OCR EnforcementConduent Agrees to $80 Million Class-Action Settlement Over 62.2 Million-Record Healthcare Data Breach · Data BreachDenver Health Medical Plan Notifies 238,000 Members After Vendor SquareML Access-Key Leak Exposes Personal and Health Data · Data BreachByod Ransomware Group Claims Attack on UNM Health Sciences Center, Disrupting Surgeries and Ambulance Diversions at New Mexico's Only Level I Trauma Center · Data BreachInsomnia Ransomware Group Claims Attack on NorthShore Health Centers; Indiana Nonprofit Warns Patients of PHI Exposure · Data BreachQuest Diagnostics Discloses Breach of Quanum Lab Services Manager; Unauthorized Party Accessed Patient Records · Data BreachManhattan Law Firm Tarter Krinsky & Drogin Reports PHI Breach Affecting 196,645 Patients; Park Dental and Heritage Pediatrics Also Disclose Incidents · Data Breach

Rule Update

OCR Restructured: Three New Divisions and What It Means for HIPAA Enforcement

TL;DR

HHS restructured its Office for Civil Rights by creating three new divisions: an Enforcement Division dedicated to investigating complaints, a Policy Division focused on regulatory guidance, and a Strategic Planning Division for data analytics and coordination. The restructuring was prompted by a 69% increase in complaints between 2017 and 2022 and has contributed to the increase in settlements and civil money penalties seen in 2025 and 2026.

HHS restructured its Office for Civil Rights by creating three new divisions: an Enforcement Division dedicated to investigating complaints, a Policy Division focused on regulatory guidance, and a Strategic Planning Division for data analytics and coordination. The restructuring was prompted by a 69% increase in complaints between 2017 and 2022 and has contributed to the increase in settlements and civil money penalties seen in 2025 and 2026.

OCR reorganized into three new divisions. What the restructuring means for HIPAA enforcement priorities and what healthcare organizations should expect.

medcomply.ai editorial teamPublished May 15, 2026Updated May 15, 20264 min read

Understanding how OCR is organized helps covered entities and business associates understand how HIPAA investigations are conducted, why investigation timelines vary, and what has driven the increase in enforcement activity in 2025 and 2026.

Why OCR restructured

The driving force behind OCR's internal restructuring was simple: complaints were rising faster than resources.

OCR's caseload increased to over 51,000 complaints in 2022 — a 69% increase between 2017 and 2022. Reported data breaches increased 58% between 2017 and 2021. With a flat budget and a rapidly growing caseload, OCR needed to do more with the same resources. The restructuring was designed to improve efficiency through specialization.

The three new divisions

HHS created three new divisions within OCR: an Enforcement Division, a Policy Division, and a Strategic Planning Division.

The Enforcement Division

The Enforcement Division is a standalone division providing dedicated integration between OCR's regional offices and headquarters to ensure complaints are swiftly investigated. It has a particular focus on cybersecurity breaches, which represent approximately 80% of large breach reports.

45 CFR §160.306

This is the division that handles HIPAA enforcement investigations — the team that reviews your documentation when OCR opens an investigation. The integration between regional offices and headquarters creates a more coordinated national enforcement posture, reducing the variability that previously existed between regional offices.

The Policy Division

The Policy Division focuses on regulatory guidance — developing the FAQs, guidance documents, and official interpretations that help covered entities understand their HIPAA obligations. When OCR publishes guidance on HIPAA and AI, clarifies right of access requirements, or releases updated model Notices of Privacy Practices, that work flows through this division.

For compliance professionals, Policy Division output often matters as much as formal rulemaking. OCR guidance documents, while not legally binding, carry significant practical weight in determining what OCR expects during investigations.

The Strategic Planning Division

The Strategic Planning Division coordinates public outreach, expands data analytics capabilities, and coordinates data collection across HHS leadership. The data analytics function has direct enforcement implications — by analyzing complaint and breach data systematically, OCR can identify which sectors have the highest complaint rates, which violation types are most common, and target enforcement resources accordingly. This data-driven approach underlies targeted initiatives like the Risk Analysis Initiative and Right of Access Initiative.

The 2025 broader HHS restructuring

The internal OCR reorganization is distinct from the broader HHS restructuring announced in March 2025 under the Trump administration, which:

  • Created a new Assistant Secretary for Enforcement to oversee OCR, the Departmental Appeals Board, and Medicare hearing appeals
  • Consolidated HHS from 28 divisions to 15
  • Reduced OCR regional offices from ten to five

The reduction in regional offices from ten to five has practical implications for how complaints are routed and investigated geographically. Whether OCR's policymaking and regulatory roles remain distinct under the new Assistant Secretary for Enforcement structure remains an open question that compliance professionals should monitor.

What this means for HIPAA investigations

Faster cybersecurity breach investigations. The Enforcement Division's dedicated focus means large breach reports are more likely to trigger investigations and move through the process more efficiently.

More consistent outcomes. Improved headquarters-regional integration reduces the variability in investigation quality and outcomes that previously existed between regional offices.

More analytical enforcement targeting. OCR's improved data analytics capacity means enforcement initiatives are increasingly data-driven — targeting sectors and violation types where the data shows the greatest compliance gaps.

More regulatory guidance. A dedicated Policy Division is likely to produce more interpretive guidance, which benefits compliance officers navigating ambiguous HIPAA questions.

The funding constraint remains

Despite efficiency gains from restructuring, OCR's fundamental resource constraint is unresolved. OCR has been pushing Congress to increase HIPAA penalty maximums — not primarily to impose larger fines, but to generate enforcement revenue that funds additional capacity.

The broader HHS restructuring adds further uncertainty. How OCR's enforcement priorities interact with the Trump administration's deregulatory agenda — and whether the new Assistant Secretary for Enforcement structure affects HIPAA-specific enforcement — remains one of the more consequential open questions in the current HIPAA landscape.

Note

The most practical implication of OCR's restructuring: investigation timelines may be shorter and outcomes more consistent. If your organization receives an OCR document request, respond promptly, completely, and accurately. The Enforcement Division's dedicated focus means investigations are likely to proceed with more efficiency than the pre-restructuring backlog suggested.

OCR restructured to handle a 69% increase in complaints with the same budget, creating a more specialized and coordinated enforcement operation. The increase in settlements and penalties in 2025 and 2026 is partly a product of this restructuring. Covered entities should assume that breach reports and complaints will be investigated more quickly and consistently going forward.

Sources & citations

  • HHS OCR Restructuring AnnouncementOpen
  • HIPAA Journal — HHS Restructuring EffortOpen
  • 45 CFR §160.306 — Complaints to the SecretaryOpen

All content verified against official HHS guidance and the Code of Federal Regulations.

Frequently asked questions

What are OCR's three new divisions?▾
OCR created three new divisions: (1) the Enforcement Division, dedicated to investigating HIPAA complaints with a focus on cybersecurity breaches; (2) the Policy Division, focused on developing regulatory guidance; and (3) the Strategic Planning Division, which coordinates public outreach, data analytics, and cross-division coordination.
Why did OCR need to restructure?▾
OCR's caseload increased dramatically while its budget remained flat. Complaints increased 69% between 2017 and 2022, reaching over 51,000 in 2022. Reported data breaches increased 58% between 2017 and 2021. The restructuring allows OCR to make better use of existing staff through specialization.
How does the Enforcement Division change HIPAA investigations?▾
The Enforcement Division provides dedicated integration between OCR's regional offices and headquarters, enabling faster and more consistent investigation of complaints. It has a particular focus on cybersecurity breaches, which represent approximately 80% of reported large breaches.
Does OCR have enough funding to enforce HIPAA effectively?▾
OCR has consistently reported it is underfunded relative to its caseload. The restructuring improves efficiency with existing resources but does not resolve the underlying funding gap. OCR has been pushing Congress to increase HIPAA penalty amounts to generate more enforcement revenue.
How does the 2025 HHS dramatic restructuring affect OCR?▾
In March 2025, HHS announced a broader restructuring creating a new Assistant Secretary for Enforcement to oversee OCR, the Departmental Appeals Board, and Medicare hearing appeals. This is separate from the earlier internal OCR reorganization. It also reduces OCR's regional offices from ten to five, which may affect complaint routing and investigation timelines.

Related intelligence

Rule Update

OCR Creates Religious Discrimination Units: What the Restructuring Means for HIPAA Enforcement

6 min read

Rule Update

OCR Director: The Cost of Doing Nothing Is Very High

4 min read

Rule Update

HIPAA Victims May Soon Receive a Share of OCR Fines: What the Proposed Compensation Program Means

7 min read

Not legal advice. medcomply.ai provides compliance intelligence for educational and operational planning. Consult qualified counsel for legal interpretation.