Sebelius Delegates HIPAA Security Authority to the OCR

In a notice published in the Federal Register on August 4, 2009, Kathleen Sebelius, Secretary of the Department of Health and Human Services delegated authority to the Director of the Office of Civil Rights over the HIPAA Security rules.  With this delegation, the OCR is responsible for interpreting and enforcing both the HIPAA Privacy and Security rules.  The OCR can now impose civil money penalties, issue subpoenas, and make exception determinations.  The delegation is effective immediately. See 74 FR 38630.