HHS Investigators Get New Mission Under Trump: Root Out DEI

U.S. Department of Health and Human Services investigators charged with protecting the civil rights and privacy of patients are now assigned to finding and stamping out diversity, equity and inclusion programs at universities and hospitals, with DEI efforts now deemed discriminatory under the Trump administration.

HHS’ Office for Civil Rights typically focuses on issues such as HIPAA enforcement, rulemaking updates and breach investigations, but on Friday HHS OCR issued a statement saying the agency is investigating four unnamed medical institutions under Title VI of the Civil Rights Act of 1964 and Section 1557 of the Affordable Care Act, which together prohibit discrimination on the grounds of race, color, national origin, sex, age or disability.

See Also: Enterprise Browser Supporting Healthcare, Cyber Resilience

“The investigations are in response to allegations and information OCR received that certain medical schools and hospitals that receive HHS funding may operate medical education, training or scholarship programs for current or prospective workforce members that discriminate on the basis of race, color, national origin or sex,” the agency said.

Further, under President Donald Trump’s executive order 14173 signed on Jan. 21, federal agencies are directed to enforce “long-standing civil rights laws and ‘to combat illegal private sector DEI preferences, mandates, policies, programs and activities,'” to restore “merit-based” opportunities, HHS OCR said.

Under Trump’s executive order, each federal agency is required “to identify nine potential civil compliance investigations of corporations, associations, foundations and institutions of higher education with endowments over $1 billion as part of a strategic enforcement plan,” HHS OCR said.

HHS OCR did not immediately respond to Information Security Media Group’s request for additional details and comment on the DEI investigations, including the identities of the four organizations under scrutiny, or how this might affect the agency’s other work, including many high-profile HIPAA breach investigations.

HHS OCR’s DEI investigations not only come as the federal government is downsizing, but also as the agency has long struggled with thinly stretched resources. That includes an essentially flat budget for many years as the agency faced an ever-growing stack of reported major health data breaches – mostly tied to hacking incidents – to investigate.

Last year alone, HIPAA covered entities and business associates reported 731 major breaches affecting a record-breaking 276 million individuals – including the blockbuster Change Healthcare hack, which affected 190 million people.

Also, in response to a federal watch dog report last fall, Melanie Fontes Rainer, former HHS OCR director under the Biden administration, explained that her agency had put off resuming its dormant HIPAA compliance audit program – which was mandated under the HITECH Act of 2009 – due to OCR’s funding and staffing resources woes (see: Watchdog Report: HHS OCR Should Beef Up HIPAA Audit Program).

“OCR has had nearly flat appropriations for 20 years, even with OCR’s continued requests for additional appropriations and resources, which has resulted in unsustainable workloads,” HHS OCR wrote in response to the HHS Office of Inspector General report.

Nonetheless, as HHS OCR’s name implies, investigations into civil rights related matters is not new – in fact, the law enforcement agency mission is “to ensures compliance with our nation’s civil rights, conscience and religious freedom, and health information privacy and security laws.”

Many public and private sector organizations have introduced DEI programs over the past decade to address discriminatory practices in the workplace, and since Trump’s return to office in January, some of those organizations have voluntarily ended DEI programs, while federal and some state agencies have dismantled programs, removed content from websites and files, and laid off staff.

Many universities are sticking by their DEI programs, such as the University of Michigan, which says on its website that diversity “enables the types of culturally and intellectually rich learning and working environments necessary for a world-class education, catalyzing new knowledge production and innovations, and developing solutions that positively impact society.”

The university also indicates that it complies with Title VI. “We committed to a policy of equal opportunity for all persons and do not discriminate on the basis of race, color, national origin, age, marital status, sex, sexual orientation, gender identity, gender expression, disability, religion, height, weight or veteran status.”

Over the years, HHS OCR has spent part of its time on enforcement actions related to Section 1557 of the Affordable Care Act, and other civil rights laws. That includes sending a “Dear Colleagues” letter to healthcare care entities last December reminding them of their obligations to provide “language access” – such as translation services or documents – to patients and their family with limited English proficiency when going to the emergency room, picking up a prescription, and during an assortment of other activities.

Competition for Resources?

Some industry insiders said that “in theory,” the civil rights side of HHS OCR’s work is supposed to be staffed with a different set of experts than its HIPAA activities.

Plus, HHS OCR’s new DEI scrutiny could potentially compete for resources with the agency’s other more “traditional” civil rights investigations, rather than its HIPAA-related work, said one regulatory attorney who asked not to be named.

Other experts also predicted that HHS OCR’s work on civil rights matters – including its new DEI investigations – should not dramatically hamper its HIPAA-related work.

“I believe that because of the larger focus on cybersecurity, as well as aspects of HIPAA dovetailing with civil rights and non-discrimination, that we will not see a reduced focus on HIPAA,” said regulatory attorney Rachel Rose.

Fewer people working at HHS means longer lag times, “but HIPAA is not going away,” she said. “No one wants a breach and their health information and sensitive personally identifiable information posted all over the internet – or dark web – and used in nefarious ways,” she said.

In fact, so far since the Trump administration took office on Jan. 20, HHS OCR has announced two HIPAA enforcement cases, she noted.

That includes a $200,000 HIPAA right of access civil monetary penalty levied last week against Oregon Health and Science University, a public academic health center and research university, for violating an individual’s right to timely access her medical records through a personal representative.

Also, in February, HHS OCR disclosed an $1.5 million civil monetary penalty against eyeglass maker and retailer Warby Parker in the aftermath of the agency’s investigation into a hacking incident affecting 200,000 people (see: Feds Fine Eyeglass Retailer $1.5M for HIPAA Lapses in Hacks).

But both of those enforcement actions resolve investigatory work that HHS OCR had wrapped up in September 2024, under the Biden administration.

In any case, there are many unanswered questions right now surrounding the operational state of HHS OCR, and how it will select and carry out its priorities – especially in the backdrop of federal workface turmoil, some experts said.

“For example, how has the administration’s several initiatives to eliminate civil service positions through voluntary separation, culling staff involved in DEI-related activities, or the firings of probationary employees affected OCR?,” asked regulatory attorney David Holtzman of consulting firm HITprivacy LLC.

“Are the investigations into the practices of healthcare entities to be performed by central office personnel or through the resources of the several regional offices?” he asked.

So far, HHS OCR has not publicly elaborated on its plans.