The Tenth Circuit U.S. Court of Appeals has reaffirmed the authority of Occupational Health and Safety Administration’s (OSHA) to cite healthcare employers for workplace violence under its General Duty Clause. In a February 13, 2026 decision, Cedar Springs Hospital v. Occupational Safety and Health Review Commission (OSHRC), No. 24-9519 (10th Cir. 2026), the
Shaping the Future: Navigating State-Level AI Legislation in Healthcare
This post is part of our The Top 2025 Privacy and Security Issues Still Shaping Healthcare series, in which our team of attorneys provides essential strategies and insights for healthcare privacy and security.
Innovations in artificial intelligence (AI), including advances in generative AI (GenAI) and machine learning, provide new opportunities for healthcare providers, promising improved efficiency in areas such as medical record keeping and billing, as well as advances in clinical decision-making, diagnosis, and treatment.
MedTech Collaborations: Structuring for Scale and Exit
New Compliance Guidelines for Off-Campus Provider-Based Departments Seeking Medicare Reimbursement
A new law, the Consolidated Appropriations Act, went into effect on February 3, 2026, issuing new Medicare reimbursement guidelines for off-campus provider-based hospital outpatient departments (HOPDs). As of January 1, 2028, hospitals will be required to make certain operational changes to maintain OPPS reimbursement eligibility for their off-campus provider-based locations. These include such measures as
Enforcement Ramps Up on Patient Right of Access: What Providers Need to Know
This post is part of our The Top 2025 Privacy and Security Issues Still Shaping Healthcare series, in which our team of attorneys provides essential strategies and insights for healthcare privacy and security.
The Health Insurance Portability and Accountability Act (HIPAA) has long been the cornerstone of patient privacy and data protection. Among its most patient-centric provisions is the Right of Access rule, which guarantees individuals timely access to their medical records. This right is not just a regulatory requirement—it’s a fundamental principle of patient empowerment, enabling individuals to make informed decisions about their health.
2025 State Privacy Changes: What Healthcare Leaders Need to Know
This post is part of our The Top 2025 Privacy and Security Issues Still Shaping Healthcare series, in which our team of attorneys provides essential strategies and insights for healthcare privacy and security.
In 2025, eight new U.S. state privacy laws took effect and several states tightened existing regulations, significantly impacting healthcare organizations. Major changes
Understanding the Impact of the Vacated HIPAA Privacy Rule on Reproductive Healthcare
This post is part of our The Top 2025 Privacy and Security Issues Still Shaping Healthcare series, in which our team of attorneys provides essential strategies and insights for healthcare privacy and security.
Reproductive health privacy rule vacated.
On June 18, 2025, the U.S. District Court for the Northern District of Texas vacated the HIPAA Privacy Rule to Support Reproductive Health Care Privacy Final Rule (Privacy Rule). As a result, the additional privacy protections that had been granted to reproductive healthcare information through President Biden’s Executive Order 14076, (“Protecting Access to Reproductive Health Care Services”), are no longer enforceable or required.
Major HIPAA Security Rule Changes on the Horizon: Is Your Healthcare Organization Ready?
This post is part of our The Top 2025 Privacy and Security Issues Still Shaping Healthcare series, in which our team of attorneys provides essential strategies and insights for healthcare privacy and security.
Why Now? The Rising Cyber Threats Driving HIPAA Reform
In December 2024, the U.S. Department of Health and Human Services Office for Civil Rights (OCR) proposed the first significant update to the HIPAA Security Rule since 2013, prompted by a surge in cyberattacks against healthcare organizations that have compromised patient information and disrupted care.
New Proposed Healthcare Transaction Requirements and Mini-Stark Law in Colorado
The Colorado General Assembly is back in session and has introduced legislation (SB26-041) that, if enacted, would create new notification requirements and antitrust review processes for healthcare transactions. While Colorado already requires state-level notification of transactions that trigger federal notifications under the Hart-Scott-Rodino Act and notification of certain hospital transactions under the Hospital Transfer Act (“HTA”) of 2023, the proposed bill would create new notification requirements for a broader set of healthcare transactions, and would authorize the Colorado attorney general (“COAG”) to block or delay closing of transactions. The proposed bill also expands the scope of hospital transactions that must be reported under the HTA.
When the Rules Changed: The Top 2025 Privacy and Security Issues Still Shaping Healthcare
The 2025 Top Ten list reflects a regulatory environment in significant transition. Last year’s healthcare privacy and security landscape presented extraordinary challenges for compliance professionals, marked by sweeping regulatory changes on the federal and state level, intensified enforcement activity, and a growing and evolving environment that demanded constant vigilance. The volatile landscape demanded adaptability, careful attention to the regulatory details, and comprehensive compliance programs. The Top Ten list offers a capsulized version of the year’s highlights—and what it all means for healthcare privacy and security professionals moving forward.