With Paula Stannard’s Appointment, Expect a More Aggressive and Ideologically Charged OCR

The appointment of Paula M. Stannard as Director of the HHS Office for Civil Rights (OCR) is an unmistakable signal of where federal health oversight is heading. Under the renewed direction of Secretary Robert F. Kennedy Jr., and amid the return of a Trump-aligned HHS, Stannard’s leadership is likely to usher in a sharper, more assertively ideological enforcement posture focused on privacy, religious conscience, and civil rights regulation. Health systems and covered entities should prepare now for a recalibration of risk, compliance, and litigation exposure.

Stannard brings institutional muscle and legal pedigree. Her previous roles at HHS, as Acting General Counsel under President George W. Bush and Senior Counselor under Secretary Tom Price, coincided with major shifts in how the department interpreted Section 1557, provider conscience protections, and HIPAA authority. This is not merely a continuation of past policy. It’s a resumption of unfinished business.

OCR under Stannard is expected to return to legal positions that narrowed gender identity protections, expanded religious exemptions for providers, and redefined nondiscrimination to emphasize free exercise over patient access. And in her own words, this new direction will prioritize “significant and highly visible priorities” which is a clear signal that confrontation is part of the strategy.

Expect three major enforcement vectors to define Stannard’s term:

First, provider conscience claims will likely receive expanded protections, even when they collide with evidence-based standards of care. Previous rules blocked during the Biden administration allowed clinicians to opt out of providing abortion or gender-affirming care. Those rules, or their successors, are likely to return.

Second, HIPAA enforcement will be repurposed for cultural leverage. While framed as a commitment to privacy, OCR under Stannard is likely to focus audits on politically contentious issues, such as  abortion data disclosures, gender identity markers, and AI-powered health data tools. Health systems and digital health vendors should reexamine how data from reproductive services, remote care, and mobile health is stored and shared, particularly across state lines.

Third, expect Section 1557 protections to narrow again. During her previous tenure, Stannard was instrumental in shaping rules that removed gender identity from HHS’s definition of sex discrimination. Those rules were partially blocked by courts and rolled back by the Biden administration. But the legal foundation is still there, and OCR may test its strength again in this term.

For providers and payers, the implications are clear:

• Policies on gender identity, religious accommodation, and civil rights must be reviewed now, not later.

• HIPAA programs must be stress-tested against politically charged audit triggers, not just breach notification.

• Staff training and patient engagement policies must be reframed to balance inclusive care with potential regulatory contradiction.

Digital health vendors, especially those with AI components or cross-border data access, should also anticipate enhanced scrutiny. Apps that track menstrual cycles, behavioral health symptoms, or biometric markers will draw enforcement attention under a politicized privacy framework. For example, OCR may question whether app-based data sharing about reproductive care in a post-Dobbs landscape constitutes an unauthorized disclosure under HIPAA, an interpretation some civil liberties groups have already raised in recent briefs.

OCR’s public complaint portal will likely become a more active vector for test-case enforcement. In parallel, the agency’s @HHSOCR feed on X (formerly Twitter) is already being used to amplify visibility around religious liberty and health data privacy in real time.

Bottom line: OCR under Stannard is preparing to weaponize them administratively. The agency’s agenda will likely test how far civil rights and privacy law can be reinterpreted under executive authority, and how fast providers can adapt to stay compliant without inviting litigation.

This is a regulatory environment defined by motion, not stability. Compliance officers who see HIPAA and Section 1557 as static rules will miss the shift. In this new era, civil rights enforcement is a moving target, one where the implications go far beyond the letter of the law.