It’s a good thing I don’t gamble. I’ve been wrong so many times in predicting the release of both the final rules for the changes to the HIPAA Privacy and Security Rules that I now vow not to make any further predictions on the subject. I simply have no clue (and neither does HHS, apparently). […]
Category Archives: HIPAA
Changes to the HIPAA Security Rule are coming. The Department of Health and Human Services’ Office for Civil Rights (OCR) recently confirmed that a final rule could be released as early as this month. The primary question now is the extent to which OCR will finalize the sweeping changes proposed under the previous administration. As […]
(This article was written in collaboration with Noah Block, J.D. Candidate, Quinnipiac University School of Law, ’26) Enforcement activity under the Health Insurance Portability and Accountability Act (HIPAA) offers a clear view of regulators’ shifting priorities. Over the past several years, regulators have steadily elevated cybersecurity as a core enforcement priority and it took center […]
Due to 2024 changes to HIPAA, covered entities that receive or maintain substance use disorder (SUD) records from programs subject to 42 CFR Part 2 (Part 2 Programs) must update their Notice of Privacy Practices (NPP) to clearly explain how these records are handled. This requirement applies even if the covered entity does not provide […]
On December 3, 2025, the Department of Health and Human Services’ Office for Civil Rights (OCR) issued a “Dear Colleague” letter addressing parental access to protected health information (PHI) of minors under the HIPAA Privacy Rule. For the first time, OCR explicitly asserts that parents must have access to all portions of a minor’s record […]
Not all behavioral health records are created equal. Under HIPAA, psychotherapy notes receive special protections that other behavioral health records do not. What Are Psychotherapy Notes? “Psychotherapy notes” are a very narrowly defined set of notes that exist only if the notes meet two requirements: (1) they may contain only the therapist’s impressions and analysis […]
As the use of artificial intelligence-powered scribe tools becomes more common in clinical settings, providers must carefully consider patient consent, including the possible applicability of state audio recording laws. While AI scribes can improve efficiency and documentation quality, providers must implement appropriate safeguards to remain compliant with state and federal laws. HIPAA and the Use […]
In the wake of Roe v. Wade’s reversal, states across the country have moved to either restrict or protect access to reproductive health care. Connecticut quickly positioned itself as a national leader in safeguarding both access and privacy. Building on its 2022 Reproductive Freedom Act, section 278 of Public Act 25-168 (the Act) expands protections […]
On June 18, 2025, a federal district court in Texas vacated regulations providing protections for reproductive health information (the 2024 Rule) as part of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The court found that the Department of Health and Human Services (HHS) exceeded its authority and unlawfully limited state law, effectively […]
On June 18, 2025, a federal district court in Texas vacated regulations providing protections for reproductive health information as part of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The court found that the Department of Health and Human Services (HHS) exceeded its authority and unlawfully limited state law, effectively eliminating the rule […]