HHS OCR comments on its 2026 priorities

According to HHS OCR, the agency continues to enforce its civil rights, conscience, and health information privacy and security authorities, while investigations into complaints, compliance reviews, and breaches of unsecured protected health information proceed.

In a recent exchange with Rachel Klugman Seeger of North Country Communications, the agency outlined four priority areas for 2026, in no particular order: continuing the HIPAA Privacy Rule Right of Access Enforcement Initiative with new reviews on parental access to minor records; expanding the HIPAA Security Rule Risk Analysis Initiative to include risk management; emphasising

hacking and ransomware enforcement actions as the main type of large breach OCR sees; and preparing to begin receiving breach reports and complaints in February 2026 for a new enforcement programme concerning the confidentiality of substance use disorder treatment records under 42 C.F.R. Part 2. The agency also directs readers to a website listing all breaches of unsecured protected health information affecting 500 or more individuals reported within the last 24 months that are currently under investigation.

They did not directly answer the first and third questions, but signalled a focus on risk analysis and risk management and on enforcement for hacking and ransomware incidents, particularly when disclosure to HHS or patients has been delayed.