In a dramatic rebuttal of how the Department of Health and Human Services Office of Civil Rights’ (“OCR”) has historically enforced HIPAA with potential far-ranging consequences, the Fifth Circuit Court of Appeals recently handed down a landmark decision criticizing and restricting how OCR interprets HIPAA and OCR’s penalty authority.  OCR brought an enforcement action against the University of Texas M.D. Anderson Cancer Center (“M.D. Anderson”) stemming from three separate alleged data breaches and violations of…