Articles and Blogs

On March 24, 2026, the U.S. Department of Health and Human Services (“HHS”), through the Centers for Medicare & Medicaid Services (“CMS”), published a long‑anticipated final rule adopting national Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) standards for health care claims attachments transactions and electronic signatures (the “Final Rule”). The Final Rule... READ MORE

Once again, 2025 was a busy year for health care data privacy. Ensuring up-to-date and compliant data privacy and security programs and being able to assess, understand and adapt to the risk of evolving technologies will remain critically important in 2026. We continue to await updated regulations under both the Health Insurance Portability and... READ MORE

On January 21, 2025, the Department of Homeland Security (“DHS”) rescinded its “Protected Areas” policy that had been in place since 2011. This policy largely restricted the U.S. Immigration and Customs Enforcement (“ICE”) and Customs and Border Protection (“CBP”) from conducting enforcement actions in or near “protected areas” or “sensitive locations.” These areas included... READ MORE

On April 26, 2024, the U.S. Department of Health and Human Services (“HHS”) Office for Civil Rights (“OCR”) published the HIPAA Privacy Rule to Support Reproductive Health Care Privacy (the “Final Rule”). This Final Rule strengthens the privacy protections under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) for reproductive health care by... READ MORE

On Thursday, June 20, 2024, the United States District Court for the Northern District of Texas (“the Court”) issued a ruling in a case that could have significant implications for enforcement of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). The case, which was brought by the American Hospital Association (“AHA”), the... READ MORE

On March 18, 2024, the Office for Civil Rights (“OCR”) issued an update to its December 2022 Bulletin regarding the usage of online tracking technologies by HIPAA-regulated entities. When originally published, the Bulletin aimed to clarify when identifiable information collected by tracking technologies on a regulated entity’s website may constitute protected health information (“PHI”)... READ MORE

On February 8, 2024, the U.S. Department of Health and Human Services (“HHS”) Office for Civil Rights and the Substance Abuse and Mental Health Services Administration (“SAMHSA”) issued a Final Rule that modified the “Confidentiality of Substance Use Disorder Patient Records” regulated by 42 CFR Part 2 (“Part 2”). The Final Rule was published... READ MORE

The U.S. Department of Health and Human Services (“HHS”) Office of Civil Rights (“OCR”) recently released updated guidance in its October 2023 Cybersecurity Newsletter emphasizing the importance of sanction policies in maintaining HIPAA compliance. This guidance builds upon a threat brief previously issued in August 2022 by HHS’ Health Sector Cybersecurity Coordination Center (“HC3”).... READ MORE

On April 12, 2023, the Office for Civil Rights (“OCR”) in the U.S. Department of Health & Human Services (“HHS”) issued a Notice of Proposed Rulemaking (“NPRM”) to strengthen privacy protections under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) for reproductive health care. The proposed rule builds on the previous guidance... READ MORE

On December 7, 2022, the Federal Trade Commission (“FTC”) in conjunction with the U.S. Department of Health & Human Services (“HHS”) updated the Mobile Health App Interactive Tool (the “Tool”) to include new questions and new use cases. The Tool is a result of collaborative efforts between the FTC, HHS Office for Civil Rights... READ MORE