The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) recently announced a HIPAA enforcement action against an employer-sponsored group health plan. The action resulted in a payment to HHS of $245,000 and a two-year corrective action plan. While HIPAA enforcement is common in the healthcare sector, actions directly against employer-sponsored
A Reminder About Florida’s Ban on Offshore Health Data Storage: What Providers and Vendors Should Know
By Joseph J. Lazzarotti on
In May 2023, Florida enacted a significant change to its health data laws. Senate Bill 264 amended the Florida Electronic Health Records Exchange Act restricting where certain patient data can be stored and accessed. Codified at Section 408.051(3) of the Florida Electronic Health Records Exchange Act, the change mandates that:
In addition to the…
The Hidden Legal Minefield: Compliance Concerns with AI Smart Glasses, Part 4: Data Security, Breach Notification, and Third-Party AI Processing Risks
Using Patient Photos in Marketing? OCR Settlement Highlights HIPAA Compliance Requirements
By Joseph J. Lazzarotti on
Businesses across many industries naturally want to showcase their satisfied customers. Whether it’s a university featuring successful graduates, a retailer highlighting happy shoppers, or a healthcare facility showcasing thriving patients, these real-world testimonials can be powerful marketing tools. However, when it comes to healthcare providers subject to HIPAA, using patient images and information for promotional…
Florida AHCA Proposed Rules Would Establish New Breach Reporting, Continuity Planning Requirements
On September 17, 2025, the Florida Agency for Health Care Administration (AHCA) will hold its first public meeting to discuss proposed rules designed to enhance transparency and preparedness around health care information system breaches. AHCA is Florida’s agency responsible for the state’s Medicaid program, the licensure of the state’s health care facilities, and the sharing…
How a Texas Federal District Court Changed the HIPAA Reproductive Health Privacy Rule, But SCOTUS Decision May Say Not So Fast
By Joseph J. Lazzarotti & Melissa Ostrower on
- The broad prohibitions on disclosing protected health information (“PHI”) relating to reproductive health for law enforcement or investigatory purposes are vacated nationally.
- The attestation requirement that was included as
Health Fitness, OCR’s Risk Analysis Initiative, and the ERISA Fiduciary Duty to Select Plan Service Providers
By Joseph J. Lazzarotti on
On Friday, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced the fifth enforcement action under its Risk Analysis Initiative. In this case, OCR reached a settlement with Health Fitness Corporation (Health Fitness), a wellness vendor providing services to employer-sponsored group health plans.
This announcement is interesting for several…
Industry Groups Urge Rescission of Proposed HIPAA Security Rule Updates
By Joseph J. Lazzarotti & Cecilie E. Read on
Posted in Health Information Technology, HIPAA
In February, a coalition of healthcare organizations sent a letter to President Donald J. Trump and the U.S. Department of Health and Human Services (HHS) (the Letter), urging the immediate rescission of a proposed update to the Security Rule under HIPAA. The update is aimed at strengthening safeguards for securing electronic protected health information.…
Happy Privacy Day: Emerging Issues in Privacy, Cybersecurity, and AI in the Workplace
By Joseph J. Lazzarotti & Damon W. Silver on
Posted in ADA, Artificial Intelligence, BIPA, California Consumer Privacy Act, Cybersecurity, Data Breach Notification, Data Security, Employee Benefit Plans, Governance, Risk, and Compliance, HIPAA, Incident Response Planning, Monitoring, Photos, Videos and Surveillance, Record Retention and Destruction, Third Party Service Providers
As the integration of technology in the workplace accelerates, so do the challenges related to privacy, cybersecurity, and the ethical use of artificial intelligence (AI). Human resource professionals and in-house counsel must navigate a rapidly evolving landscape of legal and regulatory requirements. This National Privacy Day, it’s crucial to spotlight emerging issues in workplace technology…
California Attorney General Issues Two Advisories Summarizing Law Applicable to AI
If you are looking for a high-level summary of California laws regulating artificial intelligence (AI), check out the two legal advisories issued by California Attorney General Rob Bonta. The first advisory is directed at consumers and entities about their rights and obligations under the state’s consumer protection, civil rights, competition, and data privacy laws. The…