October 1, 2024
On April 26, 2024, the Office for Civil Rights (“OCR”) and the Office of the Secretary in the U.S. Department of Health and Human Services (“HHS”) issued a final rule entitled “HIPAA Privacy Rule to Support Reproductive Health Care Privacy” (“Final Rule”). The Final Rule strengthens the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) Privacy Rule[1] by prohibiting the…
May 11, 2023
On April 17, 2023, the Department of Health and Human Services (the “Department”) issued a Notice of Proposed Rulemaking (“NPRM”) proposing to expand protections afforded by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule following recent legal events involving reproductive health care.[1]
This NPRM aims to strengthen the Privacy Rule protections by prohibiting…
February 21, 2023
SAMSHA’S Recent Proposed Changes to 42 C.F.R Part 2
The U.S. Health and Human Services Department (HHS), through the Substance Abuse and Mental Health Services Administration (SAMHSA) on November 28, 2022, announced significant proposed changes to the Confidentiality of Substance Use Disorder (SUD) Patient Records Rule under 42 C.F.R. Part 2 (“Part 2”).[1]
Background on Part 2
Part 2 is a federal…
October 6, 2022
Telehealth is a growing trend in medicine. From 2019 to 2020, telehealth use increased an eye-popping 3000%, not including Medicaid and Medicare claims. Although the claims have decreased slightly as of 2021, telehealth is clearly here to stay and with it comes new challenges.
What is Telehealth?
For the purposes of Medicare, “telehealth services” are “professional consultations, office visits,…
June 16, 2022
On June 13, 2022, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced new guidelines clarifying how audio-only telemedicine can comply with the Health Insurance Portability and Accountability Act (HIPAA) Privacy, Security, and Breach Notification Rules (HIPAA Rules).[1] These guidelines were announced in response to Executive Order 14058, issued on…
March 2, 2021
Many of you are aware of “I’m sorry” laws that have been passed in many states which allow doctors and other healthcare providers to express sympathy and regret about an adverse event without it being used against them in a later civil suit. These laws are intended to provide freedom for the practitioner to communicate with a patient on a personal basis without worry over legal consequences of…
December 11, 2020
On December 10, 2020, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced proposed changes to the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. The proposed updates aim to give patients more access to their health information and improve coordinated care, while also ensuring that patients are afforded privacy and security…
March 19, 2020
Even in the midst of a nationwide public health emergency, the HIPAA Privacy Rule (“Privacy Rule”) provisions still apply. However, the Secretary of the U.S. Department of Health and Human Services (“HHS”) may waive certain provisions of the Privacy Rule pursuant to the Project Bioshield Act of 2004 and Section 1135(b)(7) of the Social Security Act.
President Trumps’ declaration of a nationwide…
March 16, 2020
As the COVID-19 pandemic escalates in the United States, it appears that hackers are using the crisis as an opportunity to exploit victims. The United States Department of Health and Human Services was the victim of a cyber-attack that occurred on March 16, 2020.1 Additionally, in recent weeks, various businesses and consumers have reported an increase in COVID-19-related “phishing” attempts.2 …
October 16, 2019
In a recent resolution agreement between Elite Dental Associates (“Elite”), a dental practice in Dallas, Texas, and the U.S. Department of Health and Human Services Office for Civil Rights (“OCR”), the OCR alleged that Elite impermissibly disclosed patients' protected health information (“PHI”) in its responses to patient reviews on the social media site Yelp. As part of its investigation,…
August 31, 2016
In July, the Office of the National Coordinator for Health Information Technology (“ONC”) released a report that examines the oversight of the privacy and security of health data collected by entities not regulated by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). The report primarily focuses on two areas of emerging technologies provided by entities that are not…
August 3, 2016
The Department of Health and Human Services (HHS) recently released guidance for health care entities to better understand and respond to the increased threats of ransomware. The guidance was published on July 11, 2016, and provides clarification regarding the interplay of ransomware and HIPAA, specifically that (1) a ransomware attack is a “security incident” under HIPAA, and (2) a…
October 1, 2024
On April 26, 2024, the Office for Civil Rights (“OCR”) and the Office of the Secretary in the U.S. Department of Health and Human Services (“HHS”) issued a final rule entitled “HIPAA Privacy Rule to Support Reproductive Health Care Privacy” (“Final Rule”). The Final Rule strengthens the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) Privacy Rule[1] by prohibiting the…
May 11, 2023
On April 17, 2023, the Department of Health and Human Services (the “Department”) issued a Notice of Proposed Rulemaking (“NPRM”) proposing to expand protections afforded by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule following recent legal events involving reproductive health care.[1]
This NPRM aims to strengthen the Privacy Rule protections by prohibiting…
February 21, 2023
SAMSHA’S Recent Proposed Changes to 42 C.F.R Part 2
The U.S. Health and Human Services Department (HHS), through the Substance Abuse and Mental Health Services Administration (SAMHSA) on November 28, 2022, announced significant proposed changes to the Confidentiality of Substance Use Disorder (SUD) Patient Records Rule under 42 C.F.R. Part 2 (“Part 2”).[1]
Background on Part 2
Part 2 is a federal…
October 6, 2022
Telehealth is a growing trend in medicine. From 2019 to 2020, telehealth use increased an eye-popping 3000%, not including Medicaid and Medicare claims. Although the claims have decreased slightly as of 2021, telehealth is clearly here to stay and with it comes new challenges.
What is Telehealth?
For the purposes of Medicare, “telehealth services” are “professional consultations, office visits,…
June 16, 2022
On June 13, 2022, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced new guidelines clarifying how audio-only telemedicine can comply with the Health Insurance Portability and Accountability Act (HIPAA) Privacy, Security, and Breach Notification Rules (HIPAA Rules).[1] These guidelines were announced in response to Executive Order 14058, issued on…
March 2, 2021
Many of you are aware of “I’m sorry” laws that have been passed in many states which allow doctors and other healthcare providers to express sympathy and regret about an adverse event without it being used against them in a later civil suit. These laws are intended to provide freedom for the practitioner to communicate with a patient on a personal basis without worry over legal consequences of…
December 11, 2020
On December 10, 2020, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced proposed changes to the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. The proposed updates aim to give patients more access to their health information and improve coordinated care, while also ensuring that patients are afforded privacy and security…
March 19, 2020
Even in the midst of a nationwide public health emergency, the HIPAA Privacy Rule (“Privacy Rule”) provisions still apply. However, the Secretary of the U.S. Department of Health and Human Services (“HHS”) may waive certain provisions of the Privacy Rule pursuant to the Project Bioshield Act of 2004 and Section 1135(b)(7) of the Social Security Act.
President Trumps’ declaration of a nationwide…
March 16, 2020
As the COVID-19 pandemic escalates in the United States, it appears that hackers are using the crisis as an opportunity to exploit victims. The United States Department of Health and Human Services was the victim of a cyber-attack that occurred on March 16, 2020.1 Additionally, in recent weeks, various businesses and consumers have reported an increase in COVID-19-related “phishing” attempts.2 …
October 16, 2019
In a recent resolution agreement between Elite Dental Associates (“Elite”), a dental practice in Dallas, Texas, and the U.S. Department of Health and Human Services Office for Civil Rights (“OCR”), the OCR alleged that Elite impermissibly disclosed patients' protected health information (“PHI”) in its responses to patient reviews on the social media site Yelp. As part of its investigation,…
August 31, 2016
In July, the Office of the National Coordinator for Health Information Technology (“ONC”) released a report that examines the oversight of the privacy and security of health data collected by entities not regulated by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). The report primarily focuses on two areas of emerging technologies provided by entities that are not…
August 3, 2016
The Department of Health and Human Services (HHS) recently released guidance for health care entities to better understand and respond to the increased threats of ransomware. The guidance was published on July 11, 2016, and provides clarification regarding the interplay of ransomware and HIPAA, specifically that (1) a ransomware attack is a “security incident” under HIPAA, and (2) a…
