HHS Names New Director for HIPAA Enforcement Agency

The U.S. Department of Health and Human Services has named attorney Paula Stannard as new director to lead its HIPAA enforcement agency – the Office for Civil Rights. Stannard was a former legal adviser and counsel at HHS previously under the first Trump administration and also during the George W. Bush administration.

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

Besides HIPAA privacy, security, breach enforcement and rulemaking activities, HHS OCR also enforces federal healthcare civil rights, conscience and religious freedom laws in HHS’ jurisdiction.

Some former colleagues who worked directly or indirectly with Stannard during her earlier HHS stints say she is well-suited for her new leadership post, bringing deep knowledge to the job from her government and private-sector experience.

“I overlapped with Ms. Stannard when I worked at the HHS Office of General Counsel,” said regulatory attorney Adam Greene of the law firm Davis Wright Tremaine. “My impression is that she brings great familiarity with the laws that OCR enforces – more than most past directors when they started – and significant legal experience and expertise,” he said.

Most recently, Stannard served as chief legal counsel at the Montana Department of Public Health and Human Services where she led the office of legal affairs. Stannard in that role advised and “represented the state agency and its components on a wide range of significant legal issues pertaining to the laws the agency is responsible for implementing and the programs it operates,” HHS said.

In addition to Stannard’s public sector work, she has 16 years of legal experience in private practice. That includes six years as counsel in the healthcare practice group at law firm Alston and Bird, LLP in Washington, D.C., and 10 years as a litigation associate at law firm Skadden, Arps, Slate, Meagher and Flom in Chicago.

“I think that she will bring an interesting practical perspective to the role, as she has significant experience advising both HHS and private practice clients on HIPAA issues,” Greene said. Still, “because her past roles have been more in a counseling or advisory role, it is hard to say what her personal views are and what direction she will take on HIPAA,” he said.

Attorney Jodi Daniels, a partner at the law firm Wilson Sonsini Goodrich & Rosati said she worked closely with Stannard when HHS revised the original HIPAA Privacy Rule early in the Bush Administration.

“Paula knows the HIPAA Privacy Rule inside and out. She is a smart lawyer who knows administrative law and HHS policy from many years of experience,” said Daniels, who herself served for 15 years at HHS, including a decade at Office of the National Coordinator for Health IT, where she helped lead health information privacy and security policy development.

“While the HIPAA rules have stood the test of time and serve as a foundation for protecting and managing health data, in my view, it is time to review the HIPAA rules – and legislative authority – in light of changing technology and risks,” Daniels said.

The rules were drafted before the explosion of electronic health records and smart phones and only focused on traditional healthcare organizations, Daniels said. HHS OCR’s new leadership needs to keep this in mind, she said. “With the growing uses of health data for AI and explosion of consumer-facing technology, the rules should address data across a broader healthcare ecosystem as well as considering new uses of data and new ways to protect that data,” she said.

“I would expect Paula Stannard would support efforts to enforce the HIPAA policies that she had a strong hand in creating.”

HHS OCR did not immediately respond to Information Security Media Group’s request for additional information about Stannard’s appointment and her top priorities as new leader of the HIPAA enforcement and rulemaking agency.

Stannard in a statement said she is “excited and honored to lead the Office for Civil Rights at HHS under the leadership of President Trump and Secretary Kennedy.”

“I look forward to advancing the significant and highly visible priorities of OCR and protecting the civil rights of Americans who participate in the programs or organizations that HHS operates and funds.”

In a statement, HHS Secretary Robert F. Kennedy, Jr. called Stannard “a proven public servant who delivered results during her time at HHS under both President Trump and President George W. Bush.

“Under her leadership, the Office for Civil Rights will drive forward President Trump’s bold civil rights agenda with clarity, energy and purpose,” Kennedy said.

Skyrocketing Case Load

In her new role, Stannard will take charge of an HHS agency that has experienced a skyrocketing workload in recent years with the significant rise in major health data breaches – including those involving hacks, as well as HIPAA complaints particularly involving alleged violations of HIPAA’s right of access provision, as well as pressure from a government watchdog agency for HHS OCR to resume its long-dormant but time-consuming random HIPAA audit program (see: Watchdog Report: HHS OCR Should Beef Up HIPAA Audit Program).

The agency is also active in rulemaking work – including a proposed major revamp of the 20-year-old HIPAA security rule (see: What’s in HHS’ Proposed HIPAA Security Rule Overhaul?).

That proposed rulemaking, which was published in the final days of the Biden administration – has faced heavy criticism in public comments from many healthcare sector organizations and lobbying groups as being way too expensive and onerous for regulated entities to implement (see: HSCC Urges White House to Shift Gears on Health Cyber Regs).

Industry experts say it is too soon to predict where HHS OCR will take that proposed rule under the Trump administration’s deregulatory push and the agency’s brand new leadership.

Retired regulatory attorney David Holtzman, founder of consulting firm HITprivacy LLC, said he did not work directly with Stannard during his time at HHS OCR as a senior adviser. But he said he is concerned about the perpetually under-resourced OCR taking on extra duties as part of HHS’ recent reorganization and downsizing (see: RFK Jr. Cuts at HHS Affect HIPAA, Cyber Response Units).

The cuts are expected to leave HHS with about 62,000 full-time employees workers, down from 82,000. The restructuring also includes consolidating HHS’ 28 divisions into 15 new units and closing five of HHS’s 10 regional offices.

“OCR is taking on additional responsibilities in administration and enforcement of the confidentiality of substance use disorder treatment information,” or 42 CFR Part 2 regulations. Although modifications to 42 CFR Part 2 over the last several years has aligned the regulations closer to HIPAA, those substance disorder privacy regulations had previously been under the Substance Abuse and Mental Health Services Administration. SAMHSA was gutted under the recent HHS downsizing and restructuring.

“How does OCR intend to carry out their new authority while absorbing the extreme cuts to personnel and other resources? Only time will tell,” Holtzman said.

If HHS OCR does indeed take on the former SAMHSA duties of 42 CFR Part 2 regulatory enforcement, “I think that this would lead to a higher enforcement risk under 42 CFR Part 2, with OCR potentially investigating potential Part 2 violations in conjunction with HIPAA violations,” Greene said.

“That being said, OCR has experienced significant staff cuts this year, so I expect that HIPAA investigations – and 42 CFR Part 2 investigations if OCR receives enforcement authority for that regulation – will take significantly longer to conclude in the years to come,” Greene said.

Over recent years, HHS OCR has faced flat budgets even as its load of HIPAA breach investigations – including the surge in hacking incidents – has soared.

HHS’ recent fiscal year 2026 budget-in-brief document said “OCR requests non-trust fund budget authority levels that will maintain its current programmatic activities and continue defending the public’s right to nondiscriminatory access to HHS funded health and human services and enforcing health information privacy and security laws.”

In fiscal 2025, HHS sought an OCR budget of $57 million. “OCR is experiencing an increase in its case backlog due to the recent sharp decrease in the number of investigators on staff,” the fiscal 2026 budget request documents said. “At the close of FY 2024, the backlog stood at 6,532, whereas in May 2025 it stands at 13,274” (see: What’s Inside HHS’ Budget Proposals for FY 2026?).

The HHS budget justification documents estimated that HHS OCR will collect about $10 million in fiscal 2026 through its HIPAA fines and settlements. Under the HITECH Act of 2009, HHS OCR can use those collections to help supplement its enforcement work.

Besides HIPAA privacy, security and breach-related activities, HHS OCR also enforces federal laws related to healthcare civil rights and conscience and religious freedom laws. “Funding proposed for FY 2026 will further enable the agency to support investigations and other operations to address new and pending claims,” the budget document said.

As new director of HHS OCR, Stannard succeeds Melanie Fontes Rainer who held the position for the majority of President Biden’s term in office. Before Stannard was named HHS OCR director on Wednesday, the agency had been led on an interim basis by Anthony Archeval, HHS OCR acting director.

As part of HHS’ restructuring, HHS OCR is now part of a new Assistant Secretary for Enforcement Office, which consolidates under one umbrella several HHS units. Besides OCR, those other new ASE units include the offices of Medicare Hearings and Appeals, Human Research Protections and the Departmental Appeals Board.

New HHS ONC Leader

Besides naming Stannard the new HHS OCR director, HHS also more quietly this week named a new leader for the Office of the National Coordinator for Health IT, now also called the Assistant Secretary for Technology Policy.

Dr. Thomas Keane, and engineer and physician, previously served in ASTP and also as a senior advisor to the deputy secretary of HHS. “Among other duties, he was an administrator of the COVID-19 Provider Relief Fund and led the development of the AHRQ National Nursing Home COVID Action Network,” HHS said. Keane worked as a finite element software developer and enterprise software engineer prior to training as an interventional radiologist, HHS said.