It wouldn’t be surprising if compliance officials are puzzled by aspects of the privacy, security or breach notification requirements under HIPAA rules enforced by the HHS Office for Civil Rights (OCR). In recent weeks, OCR added a reproductive health privacy rule to its enforcement wheelhouse that no doubt also raises implementation questions among members of the health care community.[1]
So, who are they going to call for help?
Contact OCR directly—that’s what Barbara Stampul, one of OCR’s eight regional managers, suggested at a recent HCCA conference during a session that also included OCR Director Melanie Fontes Rainer.[2]
In her remarks, Fontes Rainer explained that although HHS itself has 10 regions, OCR no longer does, following “some consolidation efforts where we combined some regions due to budget cuts.” OCR has eight regions, with offices in 11 cities, meaning “we have offices, most likely, in a city near you,” she said.