I'm Mary Ann Kolpasek, Executive Editor at Information Security Media Group. Today I'm speaking with Melanie Fontes-Reiner, who is Director of the Department of Health and Human Services Office for Civil Rights, which oversees HIPAA enforcement activities and rulemaking. Welcome, Director. Thank you for having me.
So Director, HHS OCR has a number of proposed rulemaking activities underway that includes proposed changes to the HIPAA privacy rule to support care coordination and confidentiality of patient information with substance abuse challenges, and most recently a proposed rule to bolster protections around reproductive health care information. First, when white we see a final rule for the substance abuse rulemaking, which aims to better align 42 CFR Part 2 with HIPAA, and why are those issues so important? Sure. So just on the first question, we are not able to give timelines.
It's a priority, so it continues to be something we prioritize and work on, and typically the uniformed reg agenda will give some sort of indicator when that gets updated, and so we hope that the public will look at that. These are important issues, right, because I think you have two programs that we're not intended to work together. And so you have the Part 2 program, which is a substance use disorder program that is run by SAMHSA, and in that program it's meant to help provide treatment and meant to make sure that there are providers that provide that treatment, but those rules were written a long time ago, and they're written in a way that makes it very hard to support care coordination, integration of health care, and making sure that the best systems are made for the patient. And so the CARES Act, which was bipartisan legislation that was passed in 2021, included provisions that required HHS to update those regulations to sync them up with HIPAA.
And so now we're making sure that in the same way you have both protected health information under HIPAA, that those protections extend under the Part 2 program and the NPRM, but also that this allows for the sharing of that information, which is, you know, the underlying intent of HIPAA. So that's an important regulation. We've heard a lot from providers and public health officials across the country that think it'll be immensely helpful in allowing them to provide better care, and overall improve health outcomes for their patient population. So how about when it comes to the proposed rule to make HIPAA modifications that would prohibit many disclosures and uses of patient's reproductive health information for law enforcement related activities?
HHS OCR is in the midst of accepting public comment. I know you can't say when a final rule would come out, but how soon do you hope to move on that final rulemaking once the comments are in? And I understand that any sort of modifications to the privacy rule or any HIPAA rule, you could only make modifications once every 12 months, so you'd have to either roll this together with the confidentiality 42 CFR Part 2, or how would we sort that out? So the 42 CFR Part 2 regulations are different, and they're not part of the privacy rule, so they're not affected by that 12-month time frame you flagged.
So yes, that's sort of point 1.2 is, yes, this is absolutely a priority for our office, you know, pursuant to the President's Executive Orders, I have done listening sessions across the country. I've talked to doctors, patients, patient advocacy organizations, you know, civil rights and reproductive health organizations, all the major medical associations, and we're hearing continually that, you know, the sharing of information for persons that are receiving care across the country is a big problem. In particular, you know, the rule seeks to prohibit the use and disclosure of that data for law enforcement purposes, in limited circumstances, when that care is presented in a lawful place, because we are seeing a lot of instances where someone is traveling to a place where reproductive health care is legal from a place where it's illegal, and then having those law enforcement region to that state and trying to take data from that provider or that patient to try to confirm that. So this rule would rectify that and allow for prohibition of that data, while also continuing to allow for, you know, everyday law enforcement uses, whether it's Medicaid, fraud, inspector, or other things.
That's a priority for us, and so the comment period is open, we encourage the public to comment. And we'll look forward to seeing what people have to say. We know we try to be very thoughtful in the approach, and I understand, and look forward to both, you know, regulator, community, advocate, community, provider, community, what we got right and what places maybe didn't get it totally right, and we hope to look at that and continue to move forward on that. When it comes to other rulemaking activities, what else is underway, for instance, since 2009, OCR has been saying that it's planning to issue a proposed rule for how HIPAA enforcement fines and settlements can be distributed to victims of HIPAA violations of breaches.
What's the status on that, and what other rulemaking should we look for? Sure. So with respect to the first part of the question, you know, we did a request for information In 2021, we've learned a lot from that. We continue to think about how do we implement the high-tech act changes within HIPAA?
Our office is pretty small, and so these things take time, and they're resource-intensive, and so to folks that are awaiting those changes, please be patient as we continue to work on them. We want to get things right. We want to make sure that we're doing it in a thoughtful way, and notwithstanding privacy in HIPAA, which our office does for the whole country, my office is also in charge of civil rights. And so we have a couple of priority rule makings there, Section 1557 of the Affordable Care Act, which is non-discrimination health programs and activities.
That regulation helps, you know, across insurance and across providers, making clear what is non-discrimination. Health care has a lot of important provisions of the draft rule, including language access. You know, with respect to, you know, integrated benefits for disability, it has a lot of really important things in there. We put that rule out in the comment period closed last fall, so we're working very fast to try to get that out, and it's as quickly as possible because it's such an important regulation.
We're working on disability regulations under Section 504, the Rehabilitation Act. These are regulations that are, there were the initial regulations that were done back, you know, in the 70s that haven't been updated since, and we've had a lot of developments in disability policy and law. Since then, we know we have a better understanding of what it means, and so things like waiting months so you can go to an appointment to have the appropriate medical diagnostic equipment because you have a disability, right? Having to drive hours, just to get a mammogram, making sure that the health care community is updating, recognizing the importance of these things, our service to provide a meaningful way, and that we're providing health equity.
And so now, OCR, back in December, issued guidance advising HIPAA-regulated entities to review their use of tracking tools and websites and patient portals that might be transmitting individuals PHR to third parties such as social media companies without a person's knowledge or consent. Because in months, we've seen sort of a surge in large breaches reported to OCR by entities that have previously used these tools. How serious of a privacy problem do you think website tracking tools are and why, and how soon might we see HHS OCR take some sort of enforcement action against an entity that uses these tools? Yeah, so this is a big priority area for us, again, as your listeners, no, this is a practice we're seeing across the industry, it's not wrong to say you want to better understand your patients, your consumers, that's obviously a good goal, but when you're taking that goal and taking those steps, you need to also be making sure that you're protecting the protected health information.
You know, we put out a guidance in the fall, that guidance makes very clear both in non-authenticated uses and authenticated uses that that information is protected by HIPAA and that those covered entities need to be taking steps like putting in place a business associate agreement. It's public, we're investigating across the country on this, it's a priority area for that, so that's now public, people know that we're looking into organizations across the country hopefully soon, but I would say we don't typically put timelines on those things, we want to get it right, but it certainly is a priority, it's something we're seeing across the healthcare specter, you know, in behavioral health we're seeing in reproductive health. It's something that is, I think, both harmful for the patient, but also something that allows for an end round around HIPAA, and so we're just trying to make sure as technology advances and we continue to do more to improve the consumer experience, HIPAA can't be an avatar. Was the guidance sort of a wake-up quality thing for some entities?
I mean, I think that's right, I mean, yes and no, right, I have also, I'm sure as you have, there have been lots of stories and papers written on this, right, and some states are focusing on this, so it's not as if it's just poof appear, right, it's been there for a minute. But yes, does the guidance put covered entities on notice and sort of saying, hey, we're looking at this, you're under the obligation to follow the law, and seeing if you don't do that and you don't take the appropriate steps, you might land yourself and working with us on a compliance activity. So now, what about other OCR enforcement priorities? For instance, how about when it comes to settlements and civil monetary penalties related to patient right-of-access cases?
We've seen a lot of those, but then also there's been a surge in large breaches and hacking incidents reported over the last several years, and we've seen fewer of those sorts of settlements and civil monetary penalties, what are some of the priorities and what sort of cases should we be looking at? So absolutely, cybersecurity is a big issue for us, it's something I think we're seeing just be a problem in the healthcare space in particular, just some numbers, so my office receives last year received 51,000 complaints, 66% of those complaints were HIPAA. And so in that bucket, we're seeing a lot of use and disclosure, we're seeing a lot of privacy rule violations and right-of-access, right-of-access is the top thing we get a lot of complaints on. It's a cornerstone of the HIPAA right, it's right that you can get your own information.
I think a lot of covered entities don't take it seriously, and we know a lot of covered entities sort of don't efficiently use time when the person's trying to get their information. So we see a lot of those actions, OCRs, I think we're at 41 or 42 to date, so it continues to be a cornerstone of HIPAA in place we do work, cyber security. What we're seeing in our numbers, and I'll just read this off of my notes here, so we know complaints are up across the board, but specifically in HIPAA, hacking IT incidents remain the largest category of breaches following occurring in 2021, affecting 500 or more individuals, affecting most individuals, comprising 70% of reported breaches of those reported breaches, we know ransomware continues to be a big bucket of it, we've seen almost a doubling of those data points. So this continues to be an area we're focused on, we just have an organization that's going to help with our enforcement area here to be more strategic and to really think about how we go after these high-impact cases.
And you know, it's an area where I think if you look at the press releases of the enforcement actions we have, we're seeing repeated actions there. We're seeing repeatedly that a covered entity doesn't have a risk analysis. If you don't have a risk analysis, you don't know what your potential exposure is. And if you're, it's not a one and done, you do it, you never look at it again.
It's something that you need to look at on a regular basis and evolve as your system continues to evolve. And it's beyond just what's on your electronic perspective, health information and your data, right? It's beyond your network and trying to think through about how to secure that. So I would say we put a lot of tools on our website, we have a security risk assessment we work on with the Office of Coordinator and FTC, you can go on, you can see what kinds of laws you're subjected to.
We have tools to help your risk analysis, like these are things we're trying to target medium and small size providers to make sure that they don't find themselves on the end of a breach. Because we understand that all providers are different. All providers have different resources and different sizes. We want to make sure that it's not just that health care systems that can afford, you know, a privacy officer or an outside law firm, but we want to help everybody.
So that's a really big area that we're really focused on and we continue to try to work and drive compliance on. And finally, what's next for OCR? What should we be keeping our eyes on? Sure.
So I would say one big area for OCR is increasing education and that is sort of twofold. One, it's two covered entities to make sure covered entities understand what is required of them under the law and that's across our entire book of business. So in HIPAA, with the security rule and the privacy rule and database notification rules, but also in civil rights. And I know it's 2023, we still have a lot of providers that aren't translating documents or service or making service accessible culturally.
Those are things where, I mean, it sounds like it's 30 years ago, but it's 2023 and we still have complaints coming to our office saying it was denied a sign language interpreter. I was denied, you know, the communication in my primary language spoken. I was denied my partner coming with me to the ER to interpret things for me. So I think that continues to be a big area because if you can't communicate with the health care system, how are you going to get the care that you need and be able to have the appropriate quality experience?
You know, when I think across the country, we're seeing a shifting landscape with respect to health care. We're seeing bans on health care across the country that are just flat out banning particular types of health care. And federal civil rights and privacy laws certainly play a role there in helping those individuals and helping those providers as these landscapes shift. And so I think the work will continue to change and we'll continue to try to be responsive to it.
Well, thank you very much, Director. I've been speaking to HHS OCR Director Melanie Fantaz-Rainer. I'm Mary Ann Kolbusak-McGee of Information Security Media Group. Thanks for joining us.