Title VI of the Civil Rights Act of 1964 barred discrimination by race in programs receiving federal money, and when Medicare began in 1966 federal officials used that leverage to desegregate thousands of hospitals in a matter of months. The office that carried out that work became the Office for Civil Rights of what is now HHS. Its duties expanded when the Health Insurance Portability and Accountability Act, signed on August 21, 1996, led to national health privacy rules that took effect in 2003. It is led by a Director.
OCR enforces laws barring discrimination by race, color, national origin, disability, age, and sex by hospitals, clinics, insurers, and other recipients of HHS funds, including Section 1557 of the Affordable Care Act, along with federal conscience and religious freedom protections for health workers. Most of its caseload involves HIPAA, which sets rules for how doctors, hospitals, and health plans use and share medical records, and requires them to report data breaches. OCR investigates complaints and breaches and can impose fines.
Its priorities shift sharply between administrations, particularly on how sex discrimination applies to gender identity and on conscience rights. A 2024 rule protecting the privacy of reproductive health records was vacated by a federal court in June 2025, and in 2025 the office emphasized religious freedom, antisemitism, and enforcement against gender-related medical care for minors. Supporters described these as long-neglected priorities, while other civil rights and patient groups said the office was retreating from protecting vulnerable patients. Ransomware attacks on hospitals have made breach enforcement a growing bipartisan concern.
| Status | Active |
| Abbreviation | OCR |
| Part of | The Department of Health and Human Services |
| Led by | Director |
| Legal basis | Civil Rights Act of 1964 Title VI, Rehabilitation Act Section 504, Affordable Care Act Section 1557, HIPAA (1996), HITECH Act (2009) |
| Official site | hhs.gov |
| Civil rights basis | Title VI, Section 504, Section 1557 |
| HIPAA signed | August 21, 1996 |
| Privacy rule in effect | 2003 |
| Main caseload | HIPAA privacy complaints and data breaches |
| Also enforces | Conscience and religious freedom protections |
| Date | Title VI enforcement since 1965, HIPAA privacy since 2003 |
| Location | Hubert H. Humphrey Building, Washington, D.C. |