Statute
HITECH Act
331 published works
Data Protection Report
HHS and state AGs fine ambulance firm over $500,000, require enhanced security, privacy, and data minimization practices
By David Kessler (US), Susana Medeiros (US), Susan Ross (US), Remi Gambino (US)
Earlier this year, the Attorneys General of Massachusetts and Connecticut entered into settlement agreements with Comstar, LLC, an ambulance billing firm, relating to alleged HIPAA regulation violations in connection with…
Privacy Compliance & Data Security
HIPAA, but for non-Covered Entities?
By Odia Kagan
New bill, proposed by Bill Cassidy (R-LA), Chair of the Senate Health, Education, Labor and Pensions Committee (HELP), purports to apply the privacy and security practices under the HITECH Act,…
Legal Health Information Exchange
Are You Blocking? The Coming Crackdown on Information Blocking: What It Means for HIE/HINs, Developers of Certified HIT, & Health Care Providers
When HHS Secretary Robert F. Kennedy, Jr. announced on September 3, 2025, that the Department would launch an aggressive crackdown on information blocking, it signaled a turning point in federal…
Health Law Blog
‘Security! Security!’ HHS Proposes Updates To HIPAA’s Security Rule
By Erica Erman
Previously published in Healthcare News and Healthcare Michigan Can you remember healthcare security 20+ years ago? It seems like a different world from now. Believe it or not, the HIPAA Security Rule has…
Legal Health Information Exchange
Who’s On First? Confusion Continues About Who Should be Reporting the Change Healthcare PHI Breaches
On May 31, 2024, the Office of Civil Rights (OCR) released “updates” to its HIPAA FAQs regarding the Change Healthcare cybersecurity incident. In its Press Release, OCR pointed out that it updated its…
Paul W. Mollica Federal Courts Blog
Eighth Circuit Holds That Hospital’s Creation of Online Patient Portal Did Not Bring State-Law Privacy Claim Within the Federal Officer Removal Statute, 28 U.S.C. § 1442(a)(1)
In Doe v. BJC Health Sys., No. 23-1107 (8th Cir. Dec. 28, 2023), the Eighth Circuit – rejecting the persuasive authority of two district court opinions – holds that a…
Healthcare Law Blog
HHS OCR Delivered Annual Reports to Congress
By Sara Shanti, Elizabeth Nevins
In February, when the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) delivered two annual reports to Congress for the 2021 calendar year as mandated…
Rivkin Rounds
PHE HIPAA Enforcement Discretion to Expire, Restoring Compliance Obligations
By Eric Fader
The U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) announced on April 11 that the Notifications of Enforcement Discretion issued under HIPAA and the HITECH Act…
Global Policy Watch
FTC Announces First Enforcement Action Under Health Breach Notification Rule
By Libbie Canter, Anna D. Kraus
On February 1, the Federal Trade Commission (“FTC”) announced its first-ever enforcement action under its Health Breach Notification Rule (“HBNR”) against digital health platform GoodRx Holdings Inc. (“GoodRx”) for failing to notify…
Inside Privacy
FTC Announces First Enforcement Action Under Health Breach Notification Rule
By Libbie Canter, Anna D. Kraus
On February 1, the Federal Trade Commission (“FTC”) announced its first-ever enforcement action under its Health Breach Notification Rule (“HBNR”) against digital health platform GoodRx Holdings Inc. (“GoodRx”) for failing…