Privacy & Cybersecurity Law Blog

On May 18, 2026, the U.S. Department of Health and Human Services (“HHS”) announced a reorganization of its Office for Civil Rights (“OCR”), the agency responsible for enforcing health information privacy and security requirements and federal civil rights laws.

Under the new structure, OCR will organize its work through three subject-matter divisions:

• Health Information Privacy, Data, and Cybersecurity Division
• Conscience and Religious Freedom Division
• Civil Rights Division

According to HHS, the restructuring is intended to align OCR’s responsibilities with dedicated subject-matter expertise and leadership. The agency stated that complaint intake and enforcement activities will continue to be coordinated through a centralized Enforcement Division, including the review of reported breaches involving unsecured protected health information.