HHS’ Office for Civil Rights is asking Congress to nearly double its budget for fiscal 2024, and its director, Melanie Fontes Rainer, is making the pitch. Her case: OCR is responsible for investigating health care data breaches as well as enforcing civil rights and conscience laws, and its workload has exploded. Fontes Rainer recently announced that she’s restructuring her team to better address data breaches. The agency helps health care organizations defend themselves from hackers and can fine those negligent in mounting defenses. She’s asking Congress, which just saw some of its members’ data breached, for $78 million in fiscal 2024. Ben caught up with Fontes Rainer to discuss her office’s budget request, the reorganization and cybersecurity writ large. This interview has been edited for length and clarity. Why do you need a bigger budget? Our budget has been flat for two decades. The budget 20 years ago when OCR was receiving 10,000 complaints is the same budget I have today. I had over 50,000 complaints filed to my office last year. We anticipate that number to grow. What’s your advice to health care organizations about cybersecurity? We’re seeing hospitals where their systems have ransomware embedded in them for years. The numbers are not getting smaller — they’re getting bigger. It’s imperative that hospitals and other health care organizations be vigilant and proactive. Why did you restructure? We’re focusing on responding to the growth in our law enforcement work. Our office used to only receive paper complaints and phone calls. With the advent of the online portal, we’ve seen that number grow. Your budget proposal said that you can’t get by on the fines you levy against firms that violate HIPAA or are negligent in their cyberdefenses. Why not? In the previous administration, our settlement authority was capped. Gone are the days where OCR had bigger settlements. That impacts our ability to drive compliance. People think, ‘Oh, OCR has settlement money so they’re fine.’ We’re waving our hands in the air to tell Congress and others that the authority is capped.
| 
