Tag archives: HIPAA

OCR and FTC Issue a Joint Letter Suggesting Enforcement Actions May Be in the Pipeline

Photo of Anna Rudawski (US)Photo of Alexis Wilpon (US)By Anna Rudawski (US) and Alexis Wilpon (US) on Posted in Compliance and risk management, Data Protection, Privacy law
On July 20, 2023 HHS and the Federal Trade Commission (“FTC”) issued a joint letter to approximately 130 companies regarding their online data collection processes.  The letter follows the much discussed December 1, 2022, Bulletin that expanded the kinds of websites and applications governed by HIPAA (you can read about our analysis of the bulletin … Continue reading

HHS: Online trackers without prior authorization and BAAs can violate HIPAA

Photo of Steve Roosa (US)Photo of Anna Rudawski (US)Photo of Susan Ross (US)Photo of Daniel Rosenzweig (US)By Steve Roosa (US), Anna Rudawski (US), Susan Ross (US) and Daniel Rosenzweig (US) on Posted in Compliance and risk management
NT Analyzer blog series, cookieHHS: Online trackers without prior authorization and BAAs can violate HIPAA By Steve Roosa, Sue Ross, Dan Rosenzweig On the evening of December 1, 2022, the U.S. Department of Health and Human Services (HHS) issued a 12-page Bulletin titled “Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates (the “Bulletin”).  In the … Continue reading

FCC TCPA order partially upheld and partially set aside

Photo of Susan Ross (US)By Susan Ross (US) on Posted in Dispute resolution and litigation
Data Protection Report - digital privacy, CCPA and cybersecurityOn March 16, 2018, the U.S. Court of Appeals for the District of Columbia Circuit issued its decision on the Federal Communications Commission (FCC) omnibus order of 2015, relating to challenges to four of the FCC’s determinations relating to cell phones.  The appellate court upheld the FCC’s determinations that consumers can revoke consent to receive … Continue reading

Uber as a HIPAA business associate

Photo of Alexis Wilpon (US)By Alexis Wilpon (US) on Posted in General
Norton Rose Fulbright - Data Protection Report blogUber recently announced the launch of Uber Health, a non-emergency ride service that allows healthcare providers to schedule and pay for transportation for their patients. The stated purpose of the service is to expand medical transportation to traditionally underserved areas. Roughly 3.6 million Americans miss medical appointments each year due to lack of reliable transportation, contributing to the … Continue reading

Amended Colorado bill aims to enhance data privacy laws

By on Posted in Regulatory response
Data Protection Report - Norton Rose FulbrightAs Data Protection Report posted on January 29, 2018, lawmakers in Colorado are considering legislation that, if enacted, would significantly strengthen Colorado’s data privacy protections.  On Wednesday, February 14, 2018, an amended bill passed unanimously in Colorado’s House Committee on State, Veterans and Military Affairs.… Continue reading

South Dakota and Colorado strengthen data breach protections

By on Posted in Regulatory response
Norton Rose Fulbright - Data Protection Report blogLast week, South Dakota moved closer to implementing a data breach notification law, while Colorado legislators introduced a new bill requiring “reasonable security procedures,” imposing data disposal rules and shortening the time frame in which to alert authorities regarding a breach.  South Dakota and Colorado are the latest states taking steps in cybersecurity lawmaking in … Continue reading

HHS Update: Looking Toward Audits and Increased Enforcement

Photo of Anna Rudawski (US)Photo of Mark Faccenda (US)By Anna Rudawski (US) and Mark Faccenda (US) on Posted in Compliance and risk management, Regulatory response, Vendor management and transactions
Data Protection Report - Norton Rose FulbrightThe Department of Health and Human Services and its Office of Civil Rights (OCR) are capping off a very active 2016. In the last 6 months, the OCR has released a new audit protocol, announced new rounds of HIPAA audits, and stepped up enforcement. The flurry of activity comes after a prolonged period of anticipation in … Continue reading

Your Money or Your PHI: New Guidance on Ransomware

Photo of Mark Faccenda (US)Photo of Anna Rudawski (US)By Mark Faccenda (US) and Anna Rudawski (US) on Posted in Compliance and risk management, Data breach, Regulatory response
Data Protection Report - Norton Rose FulbrightOn June 12, 2016, the HHS Office of Civil Rights (OCR) released guidance, entitled “FACT SHEET: Ransomware and HIPAA,” in response to the rising number of ransomware attacks perpetrated against healthcare entities. The guidance addresses Health Insurance Portability and Accountability Act (HIPAA) issues that may arise when medical records containing Protected Health Information (PHI) are compromised … Continue reading

New HIPAA compliance resource available to mobile health app developers

By on Posted in Compliance and risk management
Data Protection Report - Norton Rose FulbrightAs we reported on the Health Law Pulse blog, the HHS Office of Civil Rights (OCR) has unveiled a new resource to provide mobile health developers guidance on complying with applicable Health Information Portability and Accountability Act (HIPAA) requirements. The portal allows developers to submit questions and offer comments on existing OCR guidance regarding how mobile medical applications … Continue reading

Anthem breach poses significant cybersecurity risks for Anthem’s customers; may trigger legal obligations

By on Posted in Compliance and risk management, Data breach
Data Protection Report - Norton Rose FulbrightOrganizations whose employees are insured by Anthem or whose self-insured health plans are administered by Anthem should consider steps to mitigate the cybersecurity and legal risk arising from the breach recently reported by Anthem. The hackers who perpetrated the Anthem breach are likely to use the personal information they took for further cyberattacks against affected … Continue reading

Encryption of patient personal information to be the law of the land in New Jersey

By on Posted in General
Data Protection Report - Norton Rose FulbrightFollowing a number of reports of theft and misplacement of computer disks, laptops, and thumb drives containing unencrypted patient information from New Jersey medical centers, the New Jersey state legislature enacted a law on January 9, 2015, which prohibits health insurance carriers from electronically compiling and maintaining certain patient information unless that information has been … Continue reading
LexBlog