Using Patient Photos in Marketing? OCR Settlement Highlights HIPAA Compliance Requirements
By Joseph J. Lazzarotti on
Businesses across many industries naturally want to showcase their satisfied customers. Whether it’s a university featuring successful graduates, a retailer highlighting happy shoppers, or a healthcare facility showcasing thriving patients, these real-world testimonials can be powerful marketing tools. However, when it comes to healthcare providers subject to HIPAA, using patient images and information for promotional…
Florida AHCA Proposed Rules Would Establish New Breach Reporting, Continuity Planning Requirements
On September 17, 2025, the Florida Agency for Health Care Administration (AHCA) will hold its first public meeting to discuss proposed rules designed to enhance transparency and preparedness around health care information system breaches. AHCA is Florida’s agency responsible for the state’s Medicaid program, the licensure of the state’s health care facilities, and the sharing…
How a Texas Federal District Court Changed the HIPAA Reproductive Health Privacy Rule, But SCOTUS Decision May Say Not So Fast
By Joseph J. Lazzarotti & Melissa Ostrower on
- The broad prohibitions on disclosing protected health information (“PHI”) relating to reproductive health for law enforcement or investigatory purposes are vacated nationally.
- The attestation requirement that was included as
Health Fitness, OCR’s Risk Analysis Initiative, and the ERISA Fiduciary Duty to Select Plan Service Providers
By Joseph J. Lazzarotti on
On Friday, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced the fifth enforcement action under its Risk Analysis Initiative. In this case, OCR reached a settlement with Health Fitness Corporation (Health Fitness), a wellness vendor providing services to employer-sponsored group health plans.
This announcement is interesting for several…
Industry Groups Urge Rescission of Proposed HIPAA Security Rule Updates
By Joseph J. Lazzarotti & Cecilie E. Read on
Posted in Health Information Technology, HIPAA
In February, a coalition of healthcare organizations sent a letter to President Donald J. Trump and the U.S. Department of Health and Human Services (HHS) (the Letter), urging the immediate rescission of a proposed update to the Security Rule under HIPAA. The update is aimed at strengthening safeguards for securing electronic protected health information.…
Happy Privacy Day: Emerging Issues in Privacy, Cybersecurity, and AI in the Workplace
By Joseph J. Lazzarotti & Damon W. Silver on
Posted in ADA, Artificial Intelligence, BIPA, California Consumer Privacy Act, Cybersecurity, Data Breach Notification, Data Security, Employee Benefit Plans, Governance, Risk, and Compliance, HIPAA, Incident Response Planning, Monitoring, Photos, Videos and Surveillance, Record Retention and Destruction, Third Party Service Providers
As the integration of technology in the workplace accelerates, so do the challenges related to privacy, cybersecurity, and the ethical use of artificial intelligence (AI). Human resource professionals and in-house counsel must navigate a rapidly evolving landscape of legal and regulatory requirements. This National Privacy Day, it’s crucial to spotlight emerging issues in workplace technology…
California Attorney General Issues Two Advisories Summarizing Law Applicable to AI
If you are looking for a high-level summary of California laws regulating artificial intelligence (AI), check out the two legal advisories issued by California Attorney General Rob Bonta. The first advisory is directed at consumers and entities about their rights and obligations under the state’s consumer protection, civil rights, competition, and data privacy laws. The…
Patient’s Request for Records Uncovers Dental Practice’s Ransomware Attack, Leading to $350K Settlement
By Joseph J. Lazzarotti on
The Indiana Attorney General Office (OAG) filed a detailed complaint on December 23, 2024 (Complaint) which arose out of the following patient complaint:
The OAG received a consumer complaint stating that the consumer had contacted Arlington Westend Dental on multiple occasions to receive copies of their x-rays, but Arlington Westend Dental stated it no longer…
OCR Proposed Tighter Security Rules for HIPAA Regulated Entities, including Business Associates and Group Health Plans
By Joseph J. Lazzarotti on
Posted in Health Information Technology, HIPAA
As the healthcare sector continues to be a top target for cyber criminals, the Office for Civil Rights (OCR) issued proposed updates to the HIPAA Security Rule (scheduled to be published in the Federal Register January 6). It looks like substantial changes are in store for covered entities and business associates alike, including healthcare providers…