tag:blogger.com,1999:blog-33806362026-10-27T08:28:57.532-05:00A discussion of medical privacy issues buried in political arcanaJeffhttp://www.blogger.com/profile/12067054401696214042noreply@blogger.comBlogger2997125tag:blogger.com,1999:blog-3380636.post-28109102200014791462026-10-27T08:28:57.531-05:002026-10-27T08:28:57.532-05:00

Labcorp Settles With State AGs: Labcorp agreed to pay $2.3 million to 44 different state AGs to settle a data breach by its debt collection vendor.  The state AGs alleged HIPAA violations; prior to the HITECH Act, only the OIG could issue HIPAA fines, but state AGs now have enforcement authority as well. Labcorp previously agreed to a $35 million settlement of class action lawsuits brought

Jeffhttp://www.blogger.com/profile/12067054401696214042noreply@blogger.com0tag:blogger.com,1999:blog-3380636.post-85323528529493483222026-10-27T08:13:31.616-05:002026-10-27T08:13:31.616-05:00

ONC Streamlines EHR Certification Requirements: The Office of the National Coordinator for Healthcare Information Technology has issued new rules streamlining the process by which electronic health record systems are certified as being compliant.  I haven't read the rules yet, but ONC feels that the new rules will save the health industry billions in compliance costs.On the other hand, the

Jeffhttp://www.blogger.com/profile/12067054401696214042noreply@blogger.com0tag:blogger.com,1999:blog-3380636.post-33487486043572218862026-10-12T17:21:54.053-05:002026-10-12T17:21:54.053-05:00

OCR Settles Its 56th "Right of Access" Case:  This time it's a Pennsylvania dental practice, Linda L. Shen d/b/a Shen Smiles, PC.  The practice paid $140,000 to settle the case regarding its failure to provide a patient with his/her records, which apparently had been stolen by a former employee.  Copy of the resolution agreement here.

Jeffhttp://www.blogger.com/profile/12067054401696214042noreply@blogger.com0tag:blogger.com,1999:blog-3380636.post-57399922526501582052026-09-01T10:21:34.714-05:002026-09-01T10:21:34.714-05:00

HIPAA at 30.  A video message from OCR.

Jeffhttp://www.blogger.com/profile/12067054401696214042noreply@blogger.com0tag:blogger.com,1999:blog-3380636.post-41232764015794543722026-08-31T15:56:00.769-05:002026-08-31T15:56:00.769-05:00

Another OCR Patient Access to PHI Settlement Agreement: For the 55th time, OCR has slapped the hand of a HIPAA covered entity that did not give an individual access to their own medical records.  This time it's Azul Vision of California, which failed to provide a patient with access to her PHI until 2 years after she initially asked.  More information here.

Jeffhttp://www.blogger.com/profile/12067054401696214042noreply@blogger.com0tag:blogger.com,1999:blog-3380636.post-68947452396366638392026-08-11T09:07:46.187-05:002026-08-11T09:07:46.187-05:00

Some thought on the HIPAA impact of using AI tools.  The key on the HIPAA side is dependent on whether the AI loop is open (learning or training) or closed (private or proprietary).  On the non-HIPAA side, the issues are human-in-the-loop, accountability, and auditability.

Jeffhttp://www.blogger.com/profile/12067054401696214042noreply@blogger.com0tag:blogger.com,1999:blog-3380636.post-5078973471468839412026-08-04T18:14:42.811-05:002026-08-04T18:14:42.812-05:00

Amgen Breach:  Pharmaceutical giant Amgen announced that they were the victim of a major cybersecurity incident that resulted in the theft of company data and patient health information.  The report is thin with respect to what data was actually taken.  Stay tuned.  Of course, the health care sector faces the most costly data breaches, according to a recent IBM report.&

Jeffhttp://www.blogger.com/profile/12067054401696214042noreply@blogger.com0tag:blogger.com,1999:blog-3380636.post-24763387836170757282026-07-30T08:17:49.488-05:002026-07-30T08:17:49.489-05:00

OCR Ransomware Settlement #21: OCR recently entered into a settlement agreement with OSF Health System in Illinois and Michigan regarding a ransomware event that affected 54,000 patients.  OCR fined the entity $500,000, and OCR will specially monitor OSF for 2 years to ensure HIPAA compliance.Guess what the primary HIPAA failure of OSF was?  As usual, the lack of a sufficient security

Jeffhttp://www.blogger.com/profile/12067054401696214042noreply@blogger.com0tag:blogger.com,1999:blog-3380636.post-11937843332250437992026-07-15T16:34:28.794-05:002026-07-15T16:34:28.795-05:00

Another law firm breached and sued: This time, it's Wilmer Hale.  

Jeffhttp://www.blogger.com/profile/12067054401696214042noreply@blogger.com0tag:blogger.com,1999:blog-3380636.post-59011410660180637802026-07-14T08:06:01.295-05:002026-07-14T08:06:01.295-05:00

Security Rule Update Delayed: The likely effective date of the proposed revisions to the HIPAA Security Rule to increase encryption, MFA, and other security safeguard requirements has been pushed back.  The Notice of Proposed Rule Making was published January 2025, and HHS had indicated that it would likely be announced as final (possibly with some tweaks) in May 2026.  I was always

Jeffhttp://www.blogger.com/profile/12067054401696214042noreply@blogger.com0tag:blogger.com,1999:blog-3380636.post-81444220046044954142026-07-07T09:50:51.317-05:002026-07-07T09:50:51.317-05:00

AI Usage Generally Requires a BAA: If you are a covered entity and you use any AI product, keep one thing in mind: if that AI product touches any patient information, you better have a BAA in place with the AI vendor.A business associate relationship exist whenever the BA provides a service to or for a covered entity and PHI is involved (used, disclosed, exchanged, etc.).  Many healthcare AI

Jeffhttp://www.blogger.com/profile/12067054401696214042noreply@blogger.com0tag:blogger.com,1999:blog-3380636.post-69739589040782901512026-07-07T09:18:36.509-05:002026-07-07T09:18:36.509-05:00

It happens to everyone, even lawyers: The biglaw firm Blank Rome was hit with a couple of class action lawsuits over a May data breach in which 57,000 individuals' data was exposed.  Apparently an attorney was duped into uploading files that contained the information.  While this breach does not implicate HIPAA, in some ways it's worse because law firms often have some pretty valuable

Jeffhttp://www.blogger.com/profile/12067054401696214042noreply@blogger.com0tag:blogger.com,1999:blog-3380636.post-12393576176034074122026-06-22T16:15:44.434-05:002026-06-22T16:15:44.435-05:00

Law Firm Data Breaches Surge: While few of these are specifically HIPAA related (law firms can be business associates of covered entities, but that's not a relevant issue here), it is interesting to see how law firms are a hot new target for hackers.  Like healthcare entities, law firms have access to confidential and highly sensitive information; some attacks target business and deal

Jeffhttp://www.blogger.com/profile/12067054401696214042noreply@blogger.com0tag:blogger.com,1999:blog-3380636.post-29439545433877299322026-05-26T11:28:22.011-05:002026-05-26T11:28:22.011-05:00

 You already knew this, but the healthcare sector is still the industry most targeted for cybersecurity incidents.  Large amounts of data, good/useful data for hackers, a disjointed industry, and lots of small players with poor cybersecurity protections makes it such a big target.  

Jeffhttp://www.blogger.com/profile/12067054401696214042noreply@blogger.com0tag:blogger.com,1999:blog-3380636.post-5704390623362194292026-03-17T08:35:00.004-05:002026-03-17T08:35:46.346-05:00

 Epic Ramps Up the Fight: It appears that Epic is not happy simply rousing up some of its customers to sue Health Gorilla regarding potential improper access to PHI through the CareQuality interoperability framework, part of Epic's Health Information Exchange structure, it seems that they are moving forward on multiple fronts.  Background here. A few days ago, it was announced that

Jeffhttp://www.blogger.com/profile/12067054401696214042noreply@blogger.com0tag:blogger.com,1999:blog-3380636.post-49216087906521037642026-02-03T22:55:00.003-06:002026-02-03T22:55:58.493-06:00

NoPP Changes Due February 16:  You've likely seen plenty of law firms and others noting that HIPAA covered entities need to make changes to their Notices of Privacy Practices by February 16 to meet certain requirements included in HHS' 2024 changes to HIPAA.  These changes stem from 2 separate rules, one relating to "reproductive rights" and one relating to substance use disorder

Jeffhttp://www.blogger.com/profile/12067054401696214042noreply@blogger.com0tag:blogger.com,1999:blog-3380636.post-57999625521608626602026-01-26T10:24:00.003-06:002026-01-26T10:24:19.165-06:00

OCR Chief Paula Stannard:My friend and reporter Theresa Defino recently interviewed Paula Stannard, the (new-ish) current Director of HHS' Office for Civil Rights, the HIPAA enforcement agency.  This is Paula's third stint at OCR.  The interview is available here.  Why do you want to hear what Paula Stannard has to say?OCR directors are political appointees who change with

Jeffhttp://www.blogger.com/profile/12067054401696214042noreply@blogger.com0tag:blogger.com,1999:blog-3380636.post-51904923521499744822026-01-24T15:58:00.000-06:002026-01-24T15:58:08.717-06:00

Check out OCR's January 2026 Cybersecurity Newsletter.  A link is here.The tips focus on system hardening, but most of the recommendations are just common sense.Patch softwareRemove unneeded software and servicesEnable and configure security settings

Jeffhttp://www.blogger.com/profile/12067054401696214042noreply@blogger.com0tag:blogger.com,1999:blog-3380636.post-42064159158802214512026-01-24T15:53:00.001-06:002026-01-24T15:53:10.474-06:00

"Part 2" Providers: Don't Forget to Update Your NoPPs by February 16.  Are you a "Part 2" provider?  If you don't know, you probably aren't.  "Part 2" refers to 42 CFR Part 2, which is the provision of the Code of Federal Regulations adding specifics to the general confidentiality provisions of 42 USC 290dd-2, requiring hightened confidentiality for the medical records of

Jeffhttp://www.blogger.com/profile/12067054401696214042noreply@blogger.com0tag:blogger.com,1999:blog-3380636.post-72232515691455042982026-01-06T09:15:00.002-06:002026-01-06T09:15:58.884-06:00

A Couple of Articles on Healthcare Data Breaches for 2025:  1. Data breaches in the healthcare industry are more expensive, at an average of $9.8 million, than any other industry.2. 57 million people were affected by healthcare data breaches in 2025, although the vast majority of that number came courtesy of the Change Healthcare breach, which affected almost 300 million

Jeffhttp://www.blogger.com/profile/12067054401696214042noreply@blogger.com0tag:blogger.com,1999:blog-3380636.post-1701796321683220352025-12-01T08:49:00.002-06:002025-12-01T08:49:39.039-06:00

The Evolving Threat of Ransomware in Healthcare: Attackers are getting faster, and ransomware software is getting trickier and cheaper, but healthcare organizations are getting better at stopping attacks before encryption occurs.  However, attackers are shifting their focus toward an extortion-only model: they don't encrypt your data, but they do access and copy PHI and threaten to release

Jeffhttp://www.blogger.com/profile/12067054401696214042noreply@blogger.com0tag:blogger.com,1999:blog-3380636.post-40278734074100259962025-11-25T17:08:00.001-06:002025-11-25T17:08:23.769-06:00

It's not just healthcare providers who suffer data breaches: I've been keeping up a stack of law firm data breaches, meaning to write a post on them.  But I've decided there's really not much to say, other than to note that a data breach can happen to anyone, and anyone who suffers a breach runs a decent likelihood to get sued by any individuals who might plausibly have been damaged by the

Jeffhttp://www.blogger.com/profile/12067054401696214042noreply@blogger.com0tag:blogger.com,1999:blog-3380636.post-60705997070175014342025-11-25T08:48:00.003-06:002025-11-25T08:48:44.590-06:00

 Healthcare wins again: Once again, the healthcare industry was the most affected industry when it came to data breaches in 2024.  Many reasons: the amount of personal information; the sensitivity, utility, and value of the information; the many different financial crimes that the information can help (identity theft, insurance fraud, ransom); the large and varied number of

Jeffhttp://www.blogger.com/profile/12067054401696214042noreply@blogger.com0tag:blogger.com,1999:blog-3380636.post-79955753513192889382025-09-10T08:49:00.001-05:002025-09-10T08:49:45.580-05:00

HHS' OCR, Asst. Secretary for Health Policy Release Latest Version of Security Risk Analysis Tool: If you've followed HIPAA much, you are aware that Security Rule compliance has always lagged Privacy Rule compliance.  At least part of this is because Privacy Rule requirements are much more of a one-size-fits-all regime, whereas Security Rule compliance requires a lot of individual

Jeffhttp://www.blogger.com/profile/12067054401696214042noreply@blogger.com0tag:blogger.com,1999:blog-3380636.post-83220597261867784162025-08-28T10:44:00.003-05:002025-08-28T10:44:57.136-05:00

OCR Named Enforcement Agency for Part 2: When HIPAA was first passed, the Privacy Rule was to be enforced by the Office for Civil Rights within HHS, and the rest of HIPAA was to be enforced by CMS.  I'm not sure why that bifurcation happened, but a few years later HHS decided that OCR should be the enforcement agency for all of HIPAA.Yesterday, HHS announced that OCR is now the enforcement

Jeffhttp://www.blogger.com/profile/12067054401696214042noreply@blogger.com0