Detailed Information on the
Health and Human Services - Office for Civil Rights Assessment

OCR will continue to work closely and coordinate activities with ONC leadership on privacy and confidentiality in health information technology. Key Follow-up Action: In addition, OCR will work with ONC in the design and development of consumer survey materials for determination of current level of understanding and information gaps in privacy protections for the health information exchange.

OCR will work to amend the HIPAA Privacy rule to effectuate GINA's new protections and work with offices within HHS and other Federal agencies to coordinate rulemaking.

Key Follow-up Action: Ensure that partnership agreements with other HHS offices along with Federal agencies outside of HHS include provisions that address the attainment of annual and long-term measures.

In order to improve on its performance, OCR is taking the following action: evaluate performance goals to ensure they are sufficiently ambitious and continue to develop more meaningful measures and targets to assess program effectiveness.

Measure: Rate of closure for civil rights cases, privacy cases, and new Medicare application reviews per cases and reviews received.

Explanation:OCR's long-term goal is to increase the rate of resolution for complaints of discrimination in HHS-funded programs, complaints of health information privacy breaches, and reviews of applications from health care providers wanting to serve Medicare beneficiaries per cases/reviews received, to 100% per year (indicating OCR will resolve the same number of cases it receives in a year). Currently, OCR receives more cases per year than it resolves, causing a growing backlog of cases. As cases are resolved in a more timely manner, the rate of growth in OCR's case backlog will slow. In 2005, OCR was able to resolve the same number of cases it received in a year, plus was able to resolve additional backlogged Medicare applications received in previous years, largely as a result of temporary summer interns. The decrease in 2007 was a result of operating under a continuing resolution, instead of at the higher funding level requested in that year's President's Budget.

Measure: Rate of closure for civil rights cases, privacy cases, and new Medicare application reviews per full-time equivalent employee.

Explanation:This measure tracks the number of cases resolved each year per Full-Time Equivalent (FTE) employee. Cases consist of complaints of discrimination in HHS-funded programs, complaints of health information privacy breaches, and reviews of applications from health care providers wanting to serve Medicare beneficiaries. An increase in the number of cases resolved per FTE will show improved efficiency of OCR processes and increased productivity of OCR equal opportunity specialists. Note: efficiency is expected to drop in FY 2009 as a result of integrating new staff into OCR operations. This expected increase in staff is detailed in OCR's FY 2009 Congressional Budget Justification.

Measure: Percentage of civil rights cases and new Medicare application reviews resolved per cases and reviews received.

Explanation:This measure is a subset of the program's first long-term measure, above. This measure counts the percentage of complaints of discrimination in HHS-funded programs and reviews of applications from health care providers wanting to serve Medicare beneficiaries that are closed, divided by the total number of cases and reviews received in a year. Currently, OCR receives more cases per year than it resolves, causing a growing backlog of cases. As cases are resolved in a more timely manner, the rate of growth of OCR's backlog will slow. In 2005 and 2006, OCR was able to resolve the same number of cases it received in a year, plus was able to resolve additional backlogged cases received in previous years, largely a result of temporary summer interns resolving the backlog of Medicare applications. The decrease in 2007 was a result of operating under a continuing resolution, instead of at the higher funding level requested in the President's Budget that year.

Measure: Percentage of privacy cases resolved per privacy cases received.

Explanation:This measure is a subset of the program's first long-term measure, above. This measure counts the percentage of complaints of health information privacy breaches resolved per cases received. Currently, OCR receives more cases per year than it resolves, causing a growing backlog of cases. As cases are resolved in a more timely manner, the rate of growth in OCR's backlog will slow. The decrease in 2007 was a result of operating under a continuing resolution, instead of at the higher funding level requested in the President's Budget that year.

Measure: The number of corrective actions that covered entities take as a result of OCR intervention per year.

Explanation:A corrective action is an action taken by a health care provider, a health insurance plan, or a health care clearinghouse to correct non-compliance with Federal privacy or discrimination laws after contact by OCR (such as a hospital changing policy on assisting people with limited-English-proficiency). OCR interventions and reviews increase compliance by providers and covered entities. Many providers and covered entities are unaware of their responsibilities regarding civil rights and privacy until OCR informs them through some intervention and/or review.

Measure: The number of substantive policy changes that covered entities make as a result of OCR intervention and/or review per year.

Explanation:A substantive policy change is a type of corrective action and occurs when a new written policy or a change to the existing written policy has been made. A written change in how a policy will be interpreted or enforced is also defined as a substantive policy change. OCR interventions and reviews increase compliance. Many covered entities are unaware of their responsibilities regarding civil rights until OCR informs them through some intervention and/or review.

Measure: Number of people made aware of Federal laws requiring nondiscriminatory access to HHS programs and protection of the privacy of protected health information through the provision of information and training to individuals per year.

Explanation:Each year OCR provides information and training to individuals who are, or represent, health services providers, other interest groups, and consumers. Information and training for the purpose of this goal are defined as presentation of speeches, literature handouts, training, and video and online meetings (but not radio and television broadcasts to the public). The decrease in 2007 was a result of operating under a continuing resolution, instead of at the higher funding level requested in the President's Budget that year.

Measure: The percentage of civil rights complaints that require a formal investigation that are resolved within 365 days of receipt.

Explanation:OCR's long-term goal is to resolve 90% of civil rights complaints that require a formal investigation within 365 days of receipt. It is anticipated that results will appear low in the initial years of this measure (starting in 2009), as OCR works to resolve a number of older cases in its backlog.

Measure: The percentage of civil rights complaints that do not require a formal investigation that are resolved within 180 days of receipt.

Explanation:OCR's long-term goal is to resolve 90% of civil rights complaints that do not require a formal investigation within 180 days of receipt. It is anticipated that results will appear low in the initial years of this measure (starting in 2009), as OCR works to resolve a number of older cases in its backlog.

Measure: The percentage of health information privacy complaints that require a formal investigation that are resolved within 365 days of receipt.

Explanation:OCR's long-term goal is to resolve 90% of health information privacy complaints that require a formal investigation within 365 days of receipt. It is anticipated that results will appear low in the initial years of this measure (starting in 2009), as OCR works to resolve a number of older cases in its backlog.

Measure: The percentage of health information privacy complaints that do not require a formal investigation that are resolved within 180 days of receipt.

Explanation:OCR's long-term goal is to resolve 90% of health information privacy complaints that do not require a formal investigation within 180 days of receipt. It is anticipated that results will appear low in the initial years of this measure (starting in 2009), as OCR works to resolve a number of older cases in its backlog.

Is the program purpose clear?

Explanation: The mission of the Office for Civil Rights (OCR) is to prevent and eliminate discriminatory barriers to health care, to ensure the privacy of protected health information, and to enhance access to Health and Human Services (HHS)-funded programs. Through complaint investigation and resolution, and other compliance activities, including public education and outreach, OCR helps HHS carry out its overall mission of improving the health and well being of all people affected by its many programs and ensuring the privacy of health information.

Evidence: OCR is responsible for promoting compliance with and enforcing 18 Federal statutes: 17 civil rights statutes that prohibit discrimination on the grounds of race, color, national origin, age, disability, and in some cases, sex and religion; and one statute protecting the privacy of health information. The Federal statutes are as follows:(1) P.L. 88-352; (2) 42 U.S.C. 300s; (3) P.L. 91-616; (4) P.L. 92-147; (5) P.L. 92-158; (6) P.L. 92-255; (7) P.L. 93-282; (8) P.L. 93-348; (9) P.L. 94-484; (10) P.L. 95-567; (11) P.L. 97-35; (12) P.L. 103-382; (13) P.L. 104-188; (14) P.L. 92-318; (15) P.L. 93-112; (16) P.L. 94-135; (17) P.L. 101-336; and (18) P.L. 104-191.

Does the program address a specific and existing problem, interest, or need?

Explanation: Unlawful discrimination in the health and human services arena on the basis of race, color, national origin, and disability remains a significant problem in our nation. Similarly, in passing Health Insurance Portability and Accountability Act (HIPAA), Congress recognized the need to protect the privacy of health information, which is a major concern of consumers that is particularly heightened by the growing use of electronic media and the increasing complexity of the healthcare system. The Privacy Rule provides a Federal floor of health information protections and rights to give all individuals the confidence of confidentiality that is essential to their full participation in their care, while permitting information to flow as necessary to ensure individuals have access to quality health care.

Evidence: Since April 2003, OCR had more than 3 million Privacy Rule answers viewed on the frequently asked questions site. During FY 2004, OCR's Privacy Rule home page was the second most frequently visited site on the HHS web site (second only to HHS's home page). This evidence demonstrates that there is significant public interest in information relating to HIPAA's Privacy Rule. In addition, OCR receives thousands of privacy and civil rights complaints each year due to the current, ongoing problem of unlawful discrimination in the health and human services arena. For example, in FY 2004 OCR received a total of 12,043 cases (5,549 civil rights cases and Medicare application review, and 6,494 privacy cases).

Is the program designed so that it is not redundant or duplicative of any other Federal, state, local or private effort?

Explanation: OCR's program is not redundant or duplicative of any other Federal, state, local or private effort. It is the unique role of OCR to ensure consistent and uniform implementation of laws and court decisions associated with the Federal civil rights statutes that prohibit discrimination of all recipients of Federal financial assistance from HHS. In addition, the Americans with Disabilities Act Title II regulation delegates to OCR, the authority to address complaints alleging discrimination on the basis of disability with respect to health and human service related state and local government entities. OCR also is the only agency that has jurisdiction to regulate covered entities subject to the HIPAA Privacy Rule, and to enforce compliance for HIPPA Privacy Rule violations subject to civil penalties. While most states have enacted one or more laws to safeguard the privacy of health information, those laws vary significantly from state to state and typically apply to only part of the health care system and they do not extend comprehensive protections.

Evidence: OCR was established by the (then) Department of Health, Education, and Welfare (HEW) in 1967 to investigate alleged violations of Title VI of the Civil Rights Act of 1964. Today, responsibility to enforce and ensure consistent and uniform implementation of laws and court decisions associated with major civil rights statutes rests with HHS through OCR as its designee. These laws include: (1) Title VI of the Civil Rights Act of 1964; (2) sections 504 and 508 of the Rehabilitation Act of 1973; (3) the Age Discrimination Act of 1975; (4) Title II of the Americans with Disabilities Act of 1990; (5) the community service requirements of Titles VI and XVI of the Public Health Service Act; (6) Title IX of the Education Amendments of 1972; (7) section 1808(c) of the Small Business Job Protection Act of 1996; and (8) provisions of the Omnibus Budget Reconciliation Act of 1981 relating to nondiscrimination in block grant programs. See 65 FR 82480-82487 and 65 FR 82762-82767 regarding the Privacy Rule and interaction with other laws/programs.

Is the program design free of major flaws that would limit the program's effectiveness or efficiency?

Explanation: OCR's program is free of major flaws that prevent OCR from meeting its defined objectives and performance goals and there is no evidence that another approach to enforcement would be more efficient or effective to achieve the purpose of ensuring compliance with these laws. OCR has a multi-faceted approach to obtaining voluntary compliance with laws ensuring nondiscriminatory access to health care. This approach includes complaint investigations, compliance reviews of HHS-funded health and human services programs, outreach, public education, and technical assistance. Further, OCR's program structure is suited to the challenge of adapting to changing social conditions. OCR's approach to enforcement permits flexibility - allowing civil rights and health privacy issues to be addressed via technical assistance and outreach as well as investigation. Given the changes in the nation's health industry and the social services landscape in the last 10-20 years, as well as significant changes anticipated in the future, this flexibility is a major asset.

Evidence: The 2003 report by the National Council on Disability (NCD) gives OCR high marks for its work in enforcing the nation's laws prohibiting discrimination on the basis of disability; with specific recognition of the significant role it has played to implement the President's New Freedom Initiative and Executive Order on community integration. According to the Government Accountability Office's (GAO) report on the first-year experiences under the Privacy Rule, covered entities indicated that implementation of the Rule went well. This is supported by the results of two annual surveys conducted by the American Health Information Management Association (AHIMA), a private national association of health information management professionals. Its April 2004 and April 2005 reports on each of these surveys revealed a very high level of compliance with the Privacy Rule as reported by survey respondents, which largely consisted of hospitals and health systems.

Is the program design effectively targeted so that resources will address the program's purpose directly and will reach intended beneficiaries?

Explanation: All of OCR's resources are expended directly in support of resolving civil rights and privacy complaints from the public and on technical assistance, education and outreach to consumers and providers of health and social services to prevent unlawful discrimination, inappropriate use or disclosure of protected health information, and violations of individuals' health information privacy rights.

Evidence: OCR's FY 2006 CJ Budget Submission.

Does the program have a limited number of specific long-term performance measures that focus on outcomes and meaningfully reflect the purpose of the program?

Explanation: OCR has organized its long-term performance measures around four overarching GPRA goals that directly support the HHS Strategic Plan. OCR's first goal is to ensure compliance with Federal laws requiring nondiscriminatory access to HHS programs and protection of the privacy of protected health information. This goal is tied to the target of OCR's first long-term measure, to increase the rate of resolution for civil rights and privacy cases, and new Medicare application reviews, to 100 percent of cases/reviews received per year by end of FY 2012. An output measure is appropriate for OCR since its functions are primarily investigating and resolving complaints and ensuring compliance with privacy and civil rights laws. OCR's second goal is to increase awareness of Federal laws requiring nondiscriminatory access to HHS programs and protection of the privacy of protected health information. This goal is in alignment with one of OCR's annual measures (see 2.3). OCR's third goal is to increase compliance and understanding of Federal laws requiring nondiscriminatory access to HHS programs and protection of the privacy of protected health information. OCR has adopted a second long-term outcome measure tied to its third goal, to increase the number of covered entities that make substantive policy changes as a result of OCR intervention. The target of OCR's management goal is to enhance operational efficiency and is directly tied to OCR's efficiency measure, to resolve 50 cases each year per FTE assigned by the end of FY 2012.

Evidence: OCR's long-term measures are: (1) the rate of resolution for civil rights and privacy cases, and new Medicare application reviews per cases/reviews received; (2) the number of covered entities that make a substantive policy change as a result of OCR intervention and/or review; and (3) the resolution rate for civil rights and privacy cases, and new Medicare application reviews per FTE assigned (efficiency goal).

Does the program have ambitious targets and timeframes for its long-term measures?

Explanation: OCR has developed targets and timeframes for its long-term measures. Once the FY 2005 data was reported it was realized that the targets for two of its three long-term measures were not sufficiently ambitious. In FY 2005, OCR made strategic use of interns and specially-hired temporary staff to reduce the inventory of pre-grant reviews, which do not require the same level of expertise as civil rights and Privacy Rule complaints. This allowed professional staff to resolve more complaints, particularly civil rights complaints, than previously anticipated. OCR will revise its measures and/or targets to ensure they are ambitious, taking into account the new workload baseline achieved in FY 2005. OCR's first long-term goal is to increase the rate of resolution for civil rights and privacy cases, and new Medicare application reviews per cases/review received, to 100% per year by the end of FY 2012. OCR's second long-term goal is to increase the number of covered entities that make substantive policy changes as a result of OCR intervention and/or review from 1,019 in FY 2005 to 1,125 in FY 2007. OCR's efficiency goal is to close 50 cases each year per FTE by the end of FY 2012.

Evidence: OCR's first long-term goal was not sufficiently ambitious considering its target was to close 100% of its civil rights and privacy cases, and new Medicare application reviews by 2012; and the actual performance for 2005 was 100%. OCR's efficiency goal was to close 50 cases each year per FTE by the end of 2012 and the actual performance for 2005 was almost 50 cases per FTE.

Does the program have a limited number of specific annual performance measures that can demonstrate progress toward achieving the program's long-term goals?

Explanation: OCR's annual goals are also in alignment with its GPRA goals. OCR has two annual output measures that support the first goal (to ensure compliance with Federal laws requiring nondiscriminatory access to HHS programs and protection of the privacy of protected health information), and are directly linked to OCR's first long term measure (the rate of resolution for civil rights and privacy cases, and new Medicare application reviews per cases/reviews received). The target of OCR's third annual measure is to provide information and training to an additional 31,250 individuals per year, which is linked to the second goal (to increase awareness of Federal laws requiring nondiscriminatory access to HHS programs and protection of the privacy of protected health information). Output measures are appropriate for OCR since its functions are primarily investigating and resolving complaints and ensuring compliance with privacy and civil rights laws.

Evidence: OCR's annual measures are as follows: (1) percent of civil rights cases and new Medicare application reviews resolved per cases received; (2) percent of privacy cases resolved per cases/reviews received; and (3) increased awareness of Federal laws requiring nondiscriminatory access to HHS programs and protecton of the privacy of protected health information.

Does the program have baselines and ambitious targets for its annual measures?

Explanation: OCR has baselines and ambitious targets for two of its three annual measures. Once the FY 2005 data was reported it was realized the targets for OCR's first annual measure were not sufficiently ambitious. OCR analyzed the data as reported in 2.2 and will revise its measures and/or targets to ensure they are ambitious, taking into account the new workload baseline achieved in FY 2005. OCR's targets for its second and third annual measure are ambitious considering that OCR projects steady increases in the percent of privacy cases resolved per cases received and the number of individuals provided information or training; given that OCR's caseload continues to increase whereas the number of FTEs has remained constant.

Evidence: The targets for OCR's first annual measure, percent of civil rights cases and new Medicare application reviews resolved per cases/reviews received, is not ambitious considering OCR's FY 2005 target was 89.9% and actual performance was 125.7%. For OCR's second annual measure, percent of privacy cases resolved per cases received, OCR expects to increase their performance by 5-7 percentage points per year. The targets for OCR's third annual goal are increased by 31,250 people per year.

Do all partners (including grantees, sub-grantees, contractors, cost-sharing partners, and other government partners) commit to and work toward the annual and/or long-term goals of the program?

Explanation: OCR routinely partners with many components of HHS as well as other Federal agencies in direct support of OCR's goals. The goals are to ensure compliance, to increase awareness, and to increase compliance and understanding of Federal laws requiring nondiscriminatory access to HHS programs and the protection of the privacy of protected health information. These goals are directly tied to OCR's performance measures (as demonstrated in 2.1 and 2.3). OCR partners with the Substance Abuse and Mental Health Services Administration (SAMHSA) on the New Freedom Commission on Mental Health; participates in the Title VI Limited English Proficiency (LEP) inter-agency working group; works collaboratively with the Department of Justice (DOJ) in identifying and referring privacy complaints that may involve a criminal violation of health information privacy, and with the HHS Office of General Council regarding enforcement of the Privacy Rule; and collaboratives with the Centers for Medicare and Medicaid Services (CMS) to implement a joint enforcement process for the coordination and processing of dual provision complaints (i.e., complaints implicating both the Privacy and Security Rules).

Evidence: OCR has partnered with SAMHSA on the New Freedom Commission on Mental Health to continue Olmstead voluntary compliance initiatives, including providing technical assistance to States, disseminating information about Olmstead compliance, and promoting Americans with Disability Act (ADA) compliance and community care. In addition, OCR continues to participate in the HHS Interagency LEP working group that is also coordinating and developing resources for recipients across Federal agencies, including use of a centralized website ( www.lep.gov/). For example, OCR has been using and distributing a 35 minute educational video on Title VI and the rights of LEP individuals, and multilingual brochures, produced by OCR in collaboration with the DOJ and the Department of Agriculture at conferences and meetings with providers and community-based organizations serving LEP populations. These examples demonstrate how OCR's partnerships commit to and work toward the goals of the office.

Are independent evaluations of sufficient scope and quality conducted on a regular basis or as needed to support program improvements and evaluate effectiveness and relevance to the problem, interest, or need?

Explanation: OCR's programs are reviewed and evaluated regularly by the U.S. Commission on Civil Rights (USCCR), the DOJ, the NCD, and the GAO. The NCD report is "one of a series of independent analyses by the National Council on Disability (NCD) of federal enforcement of civil rights." The DOJ, Civil Rights Division Coordination and Review Section, also reviews OCR's enforcement activities. DOJ is responsible for coordinating regulatory, policy, and program activities among the Federal agencies to assure that agencies consistently and effectively enforce various landmark civil rights statutes and related Executive Orders. DOJ requires OCR to submit data annually that describes OCR's civil rights enforcement priorities, activities, and achievements. DOJ then reviews and comments on OCR's report, and submits to the President reports evaluating OCR's effectiveness in enforcing these various statutes for entities receiving Federal financial assistance from HHS. In September 2004, the GAO evaluated and reported on the Privacy Rule's effectiveness after the first year of enforcement culminating in a report to the Chairman, Committee on Health, Education, Labor and Pensions of the U.S. Senate entitled, "Health Information; First-Year Experience under the Federal Privacy Rule."

Evidence: For example, in the USCCR report entitled, "Ten-Year Check-Up: Have Federal Agencies Responded to Civil Rights Recommendations? Volume IV: An Evaluation of the Departments of Education, Health and Human Services, and Housing and Urban Development, and the Equal Employment Opportunity Commission," dated September 2004, the study analyzes the following elements relevant to civil rights enforcement at each department: priority of civil rights, resources (funding and staffing) provided to carry out the work, effective planning, policy guidance prepared and issued, technical assistance, education and outreach, effective complaint processing process, quality compliance reviews, staff training, and initiatives that maximize effectiveness in accomplishing civil rights enforcement. In the GAO Report entitled, "Health Information; First-Year Experience under the Federal Privacy Rule," OCR's success at implementing the privacy rule was evaluated by focusing on the (1) experience of providers and health plans in implementing the Privacy Rule; (2) the experience of public health entities, researchers, and representatives of patients in obtaining access to health information under the rule; and (3) the extent to which patients appear to be aware of their rights.

Are Budget requests explicitly tied to accomplishment of the annual and long-term performance goals, and are the resource needs presented in a complete and transparent manner in the program's budget?

Explanation: Additional emphasis is needed on incorporating revised long-term and annual measures into funding decisions. OCR's FY 2006 budget has begun to integrate financial reporting data with performance measures. The budget includes all of the agency's financial resources and associated expenditures, including direct costs and overhead.

Evidence: OCR's FY 2006 Congressional Justification Budget Submission.

Has the program taken meaningful steps to correct its strategic planning deficiencies?

Explanation: A recently identified deficiency included the need for enhancing the ability to track the expenditure of resources to the civil rights and privacy program. OCR is pilot testing a Resource Entry Module (REM) as part of its case management system, Program Information Management System (PIMS), to overcome this deficiency. In addition, OCR has revised its measures to capture results on the entirety of its complaint and review mission areas in a more consisten manner, previously results were reported on issue-specific subsets that varied from year to year and caused OCR to frequently change its goals.

Evidence: Development of the REM software is completed and the pilot project began in May-June 2005. This module will allow OCR to track the expenditure of resources, and to more efficiently track performance measures. OCR's revised performance measures will be reflected in their FY 2007 budget submission.

Are all regulations issued by the program/agency necessary to meet the stated goals of the program, and do all regulations clearly indicate how the rules contribute to achievement of the goals?

Explanation: OCR has issued seven regulations; the first five regulations support the OCR mission to provide nondiscriminatory access to HHS-funded programs by providing a mechanism for individuals to file complaints against entities that receive financial assistance. OCR as the coordinating agency under the Age Discrimination Act issued the sixth regulation. The seventh regulation serves the OCR mission of protecting the privacy of individually identifiable health information held by covered entities identified by Congress. The Preambles (and in the case of Title VI of the Civil Rights Act of 1964, the legislative history) of the statutes contain specific information concerning the need for implementing regulations. The regulations themselves contain information concerning how they carry out the purpose and intent of the statute, and specifically how the regulations contribute to the achievement of the goals set forth in the statute.

Evidence: For example, in the regulation entitled, "Standards for Privacy of Individually Identifiable Health Information" (45 C.F.R. Part 160 and Part 164, Subpart E)(2000), "three major purposes: (1) To protect and enhance the rights of consumers by providing them access to their health information and controlling inappropriate use of that information; (2) to improve the quality of health care in the U.S. by restoring trust in the health care system among consumers, health care professionals, and the multitude of organizations and individuals committed to the delivery of care; and (3) to improve the efficiency and effectiveness of health care delivery by establishing a framework for health privacy protection that builds on efforts by states, health systems, and individual organizations and individuals" directly support OCR annual and long-term goals.

Does the agency regularly collect timely and credible performance information, including information from key program partners, and use it to manage the program and improve performance?

Explanation: OCR has an automated case management system, PIMS, that captures data in real time related to complaint processing, Medicare application reviews, outreach and technical assistance.

Evidence: Data from PIMS is used to provide the numbers included in the annual and long-term performance measures, as well as the case management data provided in OCR's budget submissions. OCR reviews PIMS reports monthly to determine whether operations are on-track to meet long-term goals and corrective actions are initiated when necessary.

Are Federal managers and program partners (including grantees, sub-grantees, contractors, cost-sharing partners, and other government partners) held accountable for cost, schedule and performance results?

Explanation: OCR's senior leaders have performance contracts or performance plans with measurable goals linked to OCR's annual performance goals, which support the long-term outcome goals. In FY 2005, OCR focused on case management goals. In FY 2006 there will be a greater emphasis on including management initiatives, as well as continued progress on case management goals. When activities related to achievement of program goals are outsourced, OCR enters into contracts or other cooperative agreements that specify performance standards, and OCR reviews the performance of its contractors.

Evidence: OCR has aligned the Director's preformance contract throughout OCR headquarters and regional offices to hold staff accountable for supporting and achieving each of OCR's performance goals. In OCR's Cascading Performance Plan for FY 2006, the plan is divided into program and management goals. Under program goals, the plan specifies the performance criteria necessary for the Regional Managers, Deputy Director for Management Operations, and Director to meet OCR's long-term and annual measures. For instance, one of OCR's long-term goals is the rate of closure for civil rights and privacy cases, and new Medicare application reviews. In the Cascading Performance Plan for FY 2006, the Regional Managers, Deputy Director for Management Operations, and Director are held accountable for OCR to resolve at least 87% (target for FY 2006) of the number of civil rights and privacy complaints, and Medicare applicaiton reviews received.

Are funds (Federal and partners') obligated in a timely manner and spent for the intended purpose?

Explanation: All OCR funds are obligated for the intended purposes as reported in the annual budget. OCR develops a financial operating plan, in close cooperation with the Regional Managers. OCR utilizes the DHHS CORE accounting system to track oligation rates on a monthly basis. To ensure that progress is made toward achieving the plan goals, OCR continuously monitors commitments and obligations against the plan through monthly Status of Funds reports delivered to OCR senior management and the HHS Office of the Secretary. Moreover, OCR is currently pilot-testing a funds management information system to enable real-time status of funds query and reporting OCR-wide.

Evidence: As noted in the OCR's FY 2005 Status of Funds Report (month ending June 30, 2005), OCR's obligation rate as of the completion of the third quarter of FY 2005 was 63%. OCR traditionally receives some large bills for shared costs (such as Service Supply Fund) in the last quarter of the year, hence the lower obligation rate.

Does the program have procedures (e.g. competitive sourcing/cost comparisons, IT improvements, appropriate incentives) to measure and achieve efficiencies and cost effectiveness in program execution?

Explanation: OCR has achieved considerable efficiencies through continuous updates to its IT systems, particularly the automated case management system, PIMS. The system allows paperless storage, retrieval, review, and communication of case files. The files are not only accessible by the investigator assigned to the case, but also by management personnel in the regional office as well as at the headquarters. This system, which was developed in 2002, supports OCR's efficiency goal of increasing the number of cases closed each year per FTE assigned by 3.3%.

Evidence: OCR's web-based PIMS captures data in real time related to complaint processing, Medicare application reviews, outreach and technical assistance. All of the data required for OCR's short and long-range goals is drawn from PIMS. OCR reviews PIMS reports monthly to determine whether operations are on-track to meet long-term goals in terms of both efficiency and effectiveness and corrective actions are taken when necessary.

Does the program collaborate and coordinate effectively with related programs?

Explanation: OCR works closely with many HHS components as well as other Federal agencies to achieve civil rights and health privacy awareness and enforcement in their operations. OCR is also a primary contributor to the LEP interagency work group established by the DOJ. OCR's work on this group led to the production of various interagency technical assistance materials, including an LEP interagency video and LEP brochures. Further, OCR routinely coordinates with CMS, Office of Minority Health (OMH), and other HHS agencies on civil rights and health privacy issues that affect these components. With respect to the privacy rule, one example of such coordination is OCR collaboration with the Office of the National Coordinator for Health Information Technology (ONCHIT) on its initiatives to implement the adoption of interoperable electronic health records.

Evidence: OCR played a critical, collaborative role working with nine Federal agencies in a rigorous self-evaluation, with public input, of their policies, programs, statutes, and regulations to determine whether any should be revised or modified to improve the availability of community-based services for qualified individuals with disabilities. This effort implemented the Administration's Executive Order issued on June 19, 2001 (E.O.13217). OCR's work on E.O. 13217 led to the production of "Delivering on the Promise: U.S. Department of Education Self-Evaluation to Promote Community Living for People with Disabilities," a comprehensive compilation of the reports of nine Federal agencies outlining more than 400 specific steps the agencies will implement to support community living for the nearly 54 million Americans living with disabilities. Also OCR and CMS follow a joint enforcement process outlined in the "Dual Provision Complaint (DPC) Enforcement Process Manual: A Coordinated Enforcement Process for HIPAA Privacy and Security Rules (April 20, 2005)." This manual sets procedures to coordinate and process dual provision complaints (i.e., complaints implicating both the Privacy and Security Rules) to avoid duplicative enforcement efforts.

Does the program use strong financial management practices?

Explanation: The HHS Office of Inspector General's financial audit of the Department in FY 2004 was unqualified or "clean." The audit does not cite any material internal control weaknesses specific to this program. In addition, OCR published "Internal Controls Policy for Purchases of Goods, Travel, and Other Services," which provides direction to OCR staff in the exercise of their financial responsibility for travel and procurement, particularly through the use of purchase and travel cards. The policy discusses appropriate separation of duties, proper transaction documentation, and other standards grouped under the general heading of "internal controls."

Evidence: OCR has had zero reports of improper usage of the purchase card in the past 12 months. There have been 5 reports of suspected improper usage of the government travel card in the past 12 months, all of which have been resolved with no loss to the government or the card issuer.

Has the program taken meaningful steps to address its management deficiencies?

Explanation: OCR's leadership team periodically reviews operations and performance in order to identify and rectify operational inadequacies. OCR implemented a major reorganization starting in FY 2004, with completion scheduled for FY 2005. The headquarters organizational structure was flattened to reduce the number of management layers, and was reorganized into three divisions to bring more focused leadership to its efforts in Civil Rights, the Privacy Rule, and management operations; as shown in OCR's organizational chart in their FY 2006 budget submission.

Evidence: The administrative support functions were consolidated into one unit for greater efficiency, and new position descriptions were developed that are more reflective of the actual duties being performed. In the regional offices, approximately 30 percent of the position descriptions were rewritten to emphasize a new skill mix that was necessary to update the workforce and respond to the changing health and human services environment. In the Regions, Equal Opportunity Specialist (EOS) positions were transformed / redefined into those that directly supported OCR's program accomplishment and those designed for management / accountability functions. For example, the Statement of Difference for the EOS positions includes a number of factors not previously specified in the EOS position descriptions (i.e. the knowledge required by the position, supervisory control, etc.). At Headquarters, administrative support personnel distributed among the three divisions were consolidated into an Executive Secretariat under the Director for Management Operations.

Did the program seek and take into account the views of all affected parties (e.g., consumers; large and small businesses; State, local and tribal governments; beneficiaries; and the general public) when developing significant regulations?

Explanation: OCR has issued one regulation, "Standards for Privacy of Individually Identifiable Health Information" (45 C.F.R. Part 160 and Part 164, Subpart E), since 1988, and has taken into account the views of all affected parties and prepared the required analyses in compliance with OMB guidelines. The views of consumers, covered entities, and other interested parties were solicited and carefully considered during the development of the Privacy Rule. The Preambles to the final Privacy Rule and final modifications to the Rule responded to the thousands of public comments, providing an explanation of why the views expressed were or were not incorporated into the final Rule. The Preambles also discussed compliance with the Regulatory Flexibility Act, Unfunded Mandates Act of 1995, E.O. 13132 - Federalism, National Environmental Policy Act, and Small Business Regulatory Enforcement Fairness Act of 1996, as applicable.

Evidence: (1) 64 FR 59918 (proposed Privacy Rule). (2) 65 FR 82462 (final Privacy Rule). (3) 66 FR 12738 (request for additional public comments on the Privacy Rule). (4) 67 FR 14776 (proposed modifications to the Privacy Rule). (5) 67 FR 53182 (final Privacy Rule modifications). (6) 64 FR 60047-60048. (7) 65 FR 82752-82798. (8) 67 FR 53255-53262. (9) 67 FR 53259-53262.

Did the program prepare adequate regulatory impact analyses if required by Executive Order 12866, regulatory flexibility analyses if required by the Regulatory Flexibility Act and SBREFA, and cost-benefit analyses if required under the Unfunded Mandates Reform Act; and did those analyses comply with OMB guidelines?

Explanation: "Standards for Privacy of Individually Identifiable Health Information" (45 C.F.R. Part 160 and Part 164, Subpart E) is the only regulation that OCR has issued since 1988. Applicable regulatory impact analyses, regulatory flexibility analyses, and cost-benefit analyses were discussed in the preamble to the final December 2000 Rule and the August 2002 modifications to the Rule. All the analyses required by OMB guidelines were conducted.

Evidence: (1) 64 FR 60047-60048. (2) 65 FR 82752-82798. (3) 67 FR 53255-53262. (4) 67 FR 53259-53262).

Does the program systematically review its current regulations to ensure consistency among all regulations in accomplishing program goals?

Explanation: OCR's regional managers, investigators, and outreach staff in its ten regions are involved on a daily basis in enforcing and providing technical assistance to implement the regulations that OCR has issued pursuant to five Federal statutes. Issues regarding the interplay between these regulations and the resolution of questions regarding any possible conflicts are regularly addressed both at the regional level and through scheduled meetings with headquarters staff, including the Office of the General Counsel. Regional outreach staff often provides technical assistance to entities subject to these regulations regarding how they can comply with all applicable regulations. OCR analyzes public comments and suggestions that it receives through correspondence, its website, testimony at public hearings, meetings at the request of industry and other stakeholders, and other communications to inform its evaluation of whether its regulations accomplish program goals. Based on this information, OCR determines whether written guidance is needed and whether any regulatory modifications are warranted.

Evidence: For example, OCR recently posted on its website guidance regarding how sign language and foreign language interpreters can be used by health care providers, as may be required by Title VI or Section 504, while at the same time complying with the requirements for maintaining the privacy of individually identifiable health information pursuant to the HIPAA Privacy Rule. The HIPAA Privacy Rule was modified in August 2002 to address certain unintended consequences of the Rule and to ensure that protections for patient privacy were implemented in a manner that maximized the effectiveness of those protections while not compromising access to quality health care. In addition, Title VI of the Civil Rights Act of 1964 (Part 80) regulation has been regularly reviewed as OCR has developed various guidance documents regarding serving individuals with limited English proficiency. Section 504 of the Rehabilitation Act of 1973 (Part 84 and Part 85) is reviewed to ensure that the regulations are working consistently with the President's New Freedom Initiative and Executive Order on Community Integration.

Are the regulations designed to achieve program goals, to the extent practicable, by maximizing the net benefits of its regulatory activity?

Explanation: OCR has reviewed the regulations it has issued over the past 17 years and determined that those regulations are designed to achieve program goals by maximizing net benefits and were prepared in compliance with OMB guidelines. The HIPAA Privacy Rule requirements are designed to be both scalable and flexible to the extent practicable, giving covered entities the discretion to adapt them to their particular business needs and circumstances. One example of the flexibility provided under the Privacy rule is the minimum necessary standard - it allows providers to make their own reasonable determinations as to what is the "minimal" amount of information necessary for particular purposes. The minimum necessary standard also is intended to take into account the provider's business operations and to be consistent with the professional judgment of the provider. Providers have the flexibility to determine what information is reasonably necessary for a particular purpose, given the characteristics of their business and workforce. This flexibility helps to minimize the costs and burden of compliance on covered entities, while ensuring that individuals' privacy rights and health information are protected without impeding access to quality health care.

Evidence: (1) 64 FR 59918 (proposed Privacy Rule). (2) 65 FR 82462 (final Privacy Rule). (3) 66 FR 12738 (request for additional public comments on the Privacy Rule). (4) 67 FR 14776 (proposed modifications to the Privacy Rule). (5) 67 FR 53182 (final Privacy Rule modifications).

Has the program demonstrated adequate progress in achieving its long-term performance goals?

Explanation: OCR has made progress in the performance of one of its two long-term measures. The 2005 actual performance for OCR's first long-term measure greatly exceeded the target; therefore OCR will work to revise its measure and targets in the future to insure they are sufficiently ambitious. OCR has established a baseline and targets for its second long-term measure, but will not have performance data available until 2006.

Evidence: OCR achieved its 2004 target of 78% and exceeded its 2005 target of 82% by over 18 percentage points for the rate of closure for civil rights and privacy cases, and new Medicare application reviews per cases/reviews received.

Does the program (including program partners) achieve its annual performance goals?

Explanation: So far, OCR has made progress in two of its three annual measures. The 2005 actual performance for OCR's first annual measure greatly exceeded the target; therefore OCR will work to revise its measure and targets in the future to insure they are sufficiently ambitious. The second measure, HHS exceeded its by 5.5 percentage points.

Evidence: The first measure is the percent of civil rights cases and new Medicare application reviews resolved per cases/reviews received. In FY 2003, OCR resolved 85.1% of civil rights cases and Medicare application reviews per cases/reviews received (baseline). In FY 2004, OCR resolved 89.1% civil rights cases and reviews per cases/reviews received, 3.6 percentage points above the established target. In FY 2005, OCR's resolved 125.7% of civil rights cases and reviews per cases/reviews received; 35.8 percentage points above the established target. The second measure is the percent of privacy cases resolved per cases received. In FY 2004, OCR resolved 68.6% of privacy cases per cases received (baseline). In FY 2005, OCR's resolved 79.7% of privacy cases per cases received; 5.5 percentage points above the established target. The third measure is increased awareness of Federal laws requiring nondiscriminatory access to HHS programs and protection of the privacy of protected health information. In FY 2005, OCR trained 33,118 individuals (baseline).

Does the program demonstrate improved efficiencies or cost effectiveness in achieving program goals each year?

Explanation: OCR's efficiency goal is to close 50 cases each year per FTE assigned by the end of FY 2012. In 2005, OCR exceeded its target for its efficiency measure, and has made significant progress from the years prior to the baseline.

Evidence: In FY 2004, OCR closed 38.7 cases per FTE (baseline). In FY 2005, OCR closed 49.85 cases per FTE; almost 10 percentage points above the established target. Prior year data shows that OCR has made significant progress already in this measure. For example, OCR closed 17.23 cases per FTE in FY 2002 and 18.88 cases per FTE in FY 2003.

Does the performance of this program compare favorably to other programs, including government, private, etc., with similar purpose and goals?

Explanation: A comparison of time to resolve cases between offices of civil rights in the various departments across the government is appropriate; because OCR's function is primarily investigating and resolving complaints and ensuring compliance with privacy and civil rights laws. Additional emphasis is needed on implementing a consistent standard of measurement across the various departments. The USCCR reported that the Department of Education's primary method of measuring its success is the percentage of complaints resolved within 180 days. Its goal is 80%, and its actual performance has ranged from 78% to 91% over the past 5 years. The Department of Housing and Urban Development (HUD) has a goal of processing complaints within 100 days and the USCCR Report indicates HUD achieves its goal 70% of the time. OCR closes 85% of complaints in less than 170 days.

Evidence: DOE's and HUD's data is presented in the USCCR Report and HHS/OCR's data is reported in the FY-2006 CJ Budget Submission.

Do independent evaluations of sufficient scope and quality indicate that the program is effective and achieving results?

Explanation: OCR's programs have been reviewed and evaluated by the USCCR, the DOJ, the NCD, and the GAO. These evaluations mainly indicate that the program is effective and achieving results, although the USCCR report did acknowledge some deficiencies which OCR has addressed. The evaluations are process oriented which is appropriate since OCR's function is primarily investigating and resolving complaints and ensuring compliance with privacy and civil rights laws. The USCCR report states that "The Commission recommended that OCR reorganize and it did streamline its organization and operations by consolidating and realigning offices and functions." The NCD report states, "??there appears to be a strong correlation between appropriations and complaint numbers." In addition, in the section of the report highlighting successful practices, the report stated that "the HHS website is exemplary and should be emulated in how it provides relevant Section 504 information in a user-friendly format." The GAO report noted, "Organizations representing providers and health plans told us that implementation of the Privacy Rule went more smoothly than expected during the first year after most entities were required to be compliant. In addition, they reported that new privacy procedures have become routine practice for their members' staff."

Evidence: (1) USCCR report titled: "Ten-Year Check-Up: Have Federal Agencies Responded to Civil Rights Recommendations? Volume IV: An Evaluation of the DoE, HHS, and HUD, and the EEOC," September 2004. (2) NCD Report, "Rehabilitating Section 504," February 2003. (3) GAO Report titled, "Health Information; First-Year Experience under the Federal Privacy Rule," September 2004.

Were programmatic goals (and benefits) achieved at the least incremental societal cost and did the program maximize net benefits?

Explanation: OCR's approach to its enforcement responsibilities ensures that recipients and other covered entities are not overburdened with excessive compliance costs. OCR makes every effort to effectively resolve allegations of civil rights and health privacy violations at the least possible societal cost. For example, OCR has never found it necessary to withdraw Federal funding or issue penalties on the basis of violation findings; instead, OCR has effectively brought entities into compliance. Indeed, cases in which violation findings must be issued are relatively rare, because OCR regional offices work to assist recipients and covered entities in understanding their obligations to comply with the nation's civil rights and health privacy laws. Further, given the Privacy Rule is still a relatively new regulation, OCR is continuing to closely monitor the Rule's impact on covered entities, consumers, and access to quality health care, to identify the need for and implement appropriate regulatory initiatives to maximize the Rule's net benefits.

Evidence: For instance, based on comments received from stakeholders and testimony received at NCVHS hearings, OCR issued a final Rule in August 2002 modifying certain provisions of the Privacy Rule where it was determined that the incremental costs outweighed the realized benefits of those provisions. The Privacy Rules consent requirement was modified because it created the unintended effect of preventing health care providers from providing timely, quality health care to individuals in a variety of circumstances. The most troubling and pervasive problem was that health care providers would not have been able to use or disclose protected health information for treatment, payment, or health care operations purposes prior to the initial face-to-face encounter with the patient. To eliminate such barriers to health care, mandatory consent was replaced with the voluntary consent provision that permits health care providers to obtain consent for treatment, payment and healthcare operations, prior to the intitial face-to-face encounter, and enables providers to obtain consent in a manner that does not disrupt needed treatment.