New HHS OCR Director Appointed – A Change in Course for HIPAA Enforcement?

In late March, Roger Severino was appointed to be the new Director of the Department of Health and Human Services Office of Civil Rights (HHS OCR), the office responsible for enforcing the Health Insurance Portability and Accountability Act (HIPAA) privacy, security, and breach notification rules as well as civil rights laws pertaining to HHS. Mr. Severino replaces Jocelyn Samuels who led HHS OCR from 2014 until her departure from the office earlier this year.

Prior to being named as the new Director of HHS OCR, Mr. Severino was the Director of the DeVos Center for Religion and Civil Society in the Institute for Family, Community and Opportunity at the Heritage Foundation. Prior to joining the Heritage Foundation, Mr. Severino spent seven years as a trial attorney in the Civil Rights Division at the Department of Justice. Mr. Severino previously also served as chief operations officer and legal counsel for the Becket Fund for Religious Liberty.

Shortly after his appointment as HHS OCR Director, he spoke at the National HIPAA Summit in Washington. Reports of his remarks said he emphasized the importance of patients having confidence in how the health system handles information about them and also that HHS OCR would seek to eliminate regulatory burdens. OCR Deputy Director Deven McGraw, also speaking at the HIPAA Summit, said that the HHS OCR Staff planned to work with Director Severino over the next few weeks to identify priorities for 2017.

Director Severino’s approach to HIPAA and its enforcement is not yet clear. No enforcement actions have been announced in the short time since Director Severino’s appointment. Some change in course seems likely, but the extent of that change remains to be seen. It is possible that his prior work on civil rights and social issues at the Heritage Foundation may result in HHS OCR focusing more on civil rights issues than the HIPAA part of HHS OCR’s enforcement mission, at least in the short term while Obama Administration initiatives in those areas are reviewed, modified, or reversed. Given it appears Mr. Severino does not come to HHS OCR with particular HIPAA experience, it also is possible that he will rely on the HHS OCR staff more on HIPAA issues more than in areas where he has greater personal expertise, which could result in greater continuity than otherwise might be expected. HHS OCR also may place a renewed emphasis on working with companies to improve safeguards and only rely on enforcement actions in egregious cases.