February 16, 2026, is the deadline for each HIPAA covered entity to update its Notice of Privacy Practices (NPP) to incorporate new regulatory requirements enacted in 2024. Specifically, HIPAA-covered entities (including health care providers and health plans) are required to review and revise their NPPs as necessary to ensure compliance with a 2024 federal rulemaking
Health Information Exchanges and Electronic Medical Records (EMRs)
Appeals Dropped of Decision Vacating HIPAA Reproductive Health Privacy Rule, Confirming Apparent End of the Rule and Attestation Requirement
By Conor Duffy & Ivy Miller on
On September 10, 2025, the U.S. Court of Appeals for the Fifth Circuit dismissed an appeal of the federal court ruling vacating key provisions of the HIPAA reproductive health care regulations, which appears to signal the end of the Purl case (previously discussed here) and to confirm the end of provisions of the HIPAA…
Connecticut Enacts Wide-Ranging Health Care Law Modifying Various Existing Rules and Laws
By Nathaniel Arden, Victoria Larson & Ivy Miller on
On June 25, 2025, Connecticut Governor Ned Lamont signed into law Public Act No. 25-97, “An Act Concerning Various Revisions to the Public Health Statutes” (the Act). The Act includes a wide range of provisions affecting patient confidentiality, hospital and provider licensure, scope of practice, civil penalties, and Connecticut’s statewide health information exchange. Significant…
Massachusetts Supreme Court Rules Online Tracking Technologies Do Not Violate State Wiretap Law
In a highly anticipated decision on an issue facing courts across the country, the Massachusetts Supreme Judicial Court held in late October that Massachusetts hospitals’ use of online tracking technologies that collect and transmit browsing activities of website visitors does not violate the Massachusetts Wiretap Law.
The Court determined that online interactions between visitors and…
HHS Finalizes Updates to “Part 2” Regulations to Align Disclosure Rules with HIPAA and Promote More Coordinated Substance Use Disorder Care
By Conor Duffy & Robinson+Cole's Health Law Group on
Posted in Academic Medical Centers, Accountable Care Organizations, Department of Justice, Government Enforcement, Health Information Exchanges and Electronic Medical Records (EMRs), Health Policy, HIPAA, Hospitals and Health Systems, Legislation, Medicare and Medicaid, Physicians and Allied Health Professionals, Privacy and Security
On February 8, 2024, the U.S. Department of Health and Human Services (HHS) issued a final rule (Final Rule) updating federal “Part 2” regulations to more closely align the requirements applicable to substance use disorder (SUD) treatment records with the HIPAA privacy rule, and to make certain other changes. The regulations at 42…
ONC’s HTI-1 Final Rule Updates Information Blocking Regulations
On December 13, 2023, the Office of the National Coordinator for Health Information Technology (ONC) issued its final rule entitled “Health Data, Technology, and Interoperability: Certification Program Updates, Algorithm Transparency, and Information Sharing” and known as “HTI-1” (Final Rule). Among other issues addressed in the Final Rule, ONC revised the information blocking rules to add clarity and to create a new information blocking exception. We outline these changes in further detail below. The information blocking provisions of the Final Rule will be effective 30 days after it is published in the Federal Register.
Continue Reading ONC’s HTI-1 Final Rule Updates Information Blocking RegulationsHHS Proposes Disincentives for Providers that Commit Information Blocking
By Nathaniel Arden & Michael Lisitano on
On November 1, 2023, the U.S. Department of Health and Human Services (HHS) published a proposed rule titled “21st Century Cures Act: Establishment of Disincentives for Health Care Providers That Have Committed Information Blocking” (the Proposed Rule). The Proposed Rule, if finalized, would create disincentives for health care providers that the HHS Office of Inspector General (OIG) determines have committed “information blocking” (as defined at 45 C.F.R. § 171.103).
Continue Reading HHS Proposes Disincentives for Providers that Commit Information BlockingHHS Seeks to Strengthen Protections of Reproductive Health Information with Proposed Changes to HIPAA
On April 12, 2023, the U.S. Department of Health & Human Services (HHS) released a Notice of Proposed Rulemaking (Proposed Rule) that seeks to enhance safeguards of reproductive health care information through changes to the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. The proposal is intended to align with President Biden’s Executive Order…
HHS Proposes Rule to Align Part 2 Records and HIPAA
By Danielle Tangorre & Robinson+Cole's Health Law Group on
On November 28, 2022, the Department of Health and Human Services (HHS) issued a proposed rule to modify the confidentiality protections of Substance Use Disorder (SUD) patient treatment records under 42 CFR Part 2 (Part 2) to implement statutory amendments passed under Section 3221 of the Coronavirus Aid, Relief, and Economic Security (CARES) Act (42 U.S.C. 290dd-2). Comments are being accepted for 60 days from the date of publication.
Continue Reading HHS Proposes Rule to Align Part 2 Records and HIPAAREMINDER: October 6 Deadline for Information Blocking Rules Approaches
Health care providers subject to the Information Blocking rules issued under the 21st Century Cures Act, Pub.L. 114–255, are reminded that such Information Blocking rules will apply to an expanded set of information beginning on October 6, 2022. The Information Blocking rules currently apply only to a limited portion of electronic health information (EHI) represented by the specific data elements identified in the United States Core Data for Interoperability version 1 standard (commonly referred to as USCDIv1). Effective October 6, 2022, the Information Blocking rules will apply to all EHI, which is defined as all electronic protected health information (as defined by HIPAA) to the extent that such electronic protected health information is included in a designated record set (also as defined by HIPAA), and excluding psychotherapy notes and information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative proceeding.
Continue Reading REMINDER: October 6 Deadline for Information Blocking Rules Approaches