Data Privacy & Security/HIPAA/HITECH

On February 8, 2024, the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) finalized long-awaited modifications to the Confidentiality of Substance Use Disorder (SUD) Patient Records regulations at 42 C.F.R. Part 2, which requires individuals or entities that receive federal funding and provide SUD treatment to implement additional privacy protections and obtain specific consent before using and disclosing SUD treatment records (see 42 C.F.R. § 2.11).

U.S. Senators Angus King (I-ME) and Marco Rubio (R-FL) recently introduced a bill addressing cybersecurity protections and oversight in the healthcare industry. The Strengthening Cybersecurity in Health Care Act, introduced on February 8, 2024, aims to bolster a vulnerable and often-targeted industry against cyberattacks. The proposal follows a number of significant cyberattacks on healthcare organizations in recent years; Senator King noted that approximately 133 million people, or nearly one in three Americans, had their personal information compromised in 2023 alone.

DEA waivers regarding the Ryan Haight Act could play a major role in telehealth’s future.

In the first decade of the 21st century, deaths attributable to overdoses of prescription drugs saw an alarming spike in volume, led higher by a tripling of deaths due to opioid use. Amid this surge, Congress enacted the Ryan Haight Online Pharmacy Consumer Protection Act in 2008 as part of an attempt to rein in the burgeoning online marketplace for prescription drugs—particularly those involving controlled substances—which had largely evaded prior enforcement actions.

Led out of the firm’s Milwaukee office, Husch Blackwell represented UpHealth in its recently closed business combination that created a publicly traded, comprehensive global digital healthcare company.

Our Kate Bechen and Robin Lehninger were thrilled to join the leadership team of UpHealth Inc. at the New York Stock Exchange to celebrate their listing as a

Since last year, the Husch Blackwell privacy attorneys have been working with various healthcare providers—from hospitals to hospices, to independent physician groups—to comply with the Information Blocking rule (the Rule) implemented by the Office of the National Coordinator for Health Information Technology (ONC) as part of the 21st Century Cures Act.  Recently, Education clients have been asking, “We’re a university – does the Information Blocking rule apply to our student health center?”  We discuss the answer to that question, along with practice tips, in this blog post.

You may recall on December 10, 2020 we wrote about the Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announcement of a proposed rule  that would revise the Health Insurance Portability and Accountability Act of 1996 (HIPAA) regulations. In the proposed rule, HHS has solicited public comments, that were originally due within 60-days  of the proposed rule publication in the Federal Register.

The pandemic of 2020 tested the mettle of our nation’s healthcare system in many unexpected and profound ways. As healthcare delivery was being rapidly restructured to accommodate COVID-19 diagnosis and treatment and socially-distanced care, bad actors simultaneously began to exploit the increased number of vulnerabilities in health information systems created by telehealth platforms, patient portals and the inattention of stressed, overworked staff. The result was an unprecedented number of cyberattacks culminating in an alert from the Cybersecurity and Infrastructure Security Agency (CISA) on October 28, 2020 addressing the plague of ransomware activity targeting the healthcare and public health sector.

On December 10, 2020, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) released a proposed rule that would revise the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

In its news release, OCR noted that the changes “seeks to promote value-based health care by examining federal regulations that impede efforts among healthcare providers and health plans to better coordinate care for patients.”  The proposed changes come on the heels of the recently delayed Information Blocking Rule, which seeks to prohibit interferences with access, exchange, or use of electronic health information (EHI).   The key proposed changes are discussed below.