The US Department of Health and Human Services announced on 18 May 2026 that it is restructuring its Office for Civil Rights (OCR) into a program-based organisation with three subject-matter divisions: the Conscience and Religious Freedom Division, the Civil Rights Division, and the Health Information Privacy, Data, and Cybersecurity Division. Complaint intake and breach review functions will be consolidated into a separate Enforcement Division supporting centralised intake and field-office execution. HHS has stated the reorganisation is not expected to reduce OCR's workforce.

For digital health, the relevant change is the creation of a dedicated Health Information Privacy, Data, and Cybersecurity Division. HIPAA enforcement, including the review of reported breaches of unsecured protected health information, has historically been handled within OCR alongside civil-rights and conscience-protection casework. Carving the privacy and cybersecurity remit into its own division is presented by HHS as an effort to sharpen subject-matter focus and improve effectiveness; whether it translates into observable changes in breach-notification handling, vendor-risk guidance, or enforcement penalties will be measurable once the new structure is operating.

The reorganisation also restores the Conscience and Religious Freedom Division (CRFD), originally created under HHS in January 2018 and dissolved during the Biden administration. The framing of the restructuring as advancing conscience-rights protection alongside the technical privacy reform has drawn comment from healthcare-policy commentators about whether the new structure prioritises one substantive area over the others.