Data Privacy & Security/HIPAA/HITECH

Blog SeriesConference Post (1)

This is the second in a series of articles designed to provide SXSW and LSI USA ’26 attendees and other MedTech professionals with practical considerations for efficiently executing mission-critical life science deals.

Collaborations often start with a simple premise: build something together, share the risk, and create value.

The complexity shows up later when investors or buyers ask who actually owns the platform.

In co-development structures involving devices and software, ownership and control are rarely binary. They are defined by layered licensing arrangements, regulatory allocations, manufacturing dependencies, and IP assignments that were often negotiated quickly to get a deal done.

dataLocks148650499

This post is part of our The Top 2025 Privacy and Security Issues Still Shaping Healthcare series, in which our team of attorneys provides essential strategies and insights for healthcare privacy and security.

The healthcare sector continues to grapple with an unrelenting wave of cyberattacks, with a notable shift in 2024 and 2025 toward targeting third-party vendors and business associates entrusted with sensitive protected health information (“PHI”). This trend has led to a surge in data breaches, affecting tens of millions of Americans and prompted heightened regulatory scrutiny over how healthcare providers manage and oversee their vendor relationships. 

This post is part of our The Top 2025 Privacy and Security Issues Still Shaping Healthcare series, in which our team of attorneys provides essential strategies and insights for healthcare privacy and security.

Innovations in artificial intelligence (AI), including advances in generative AI (GenAI) and machine learning, provide new opportunities for healthcare providers, promising improved efficiency in areas such as medical record keeping and billing, as well as advances in clinical decision-making, diagnosis, and treatment. 

Blog SeriesConference Post (1)

This is the first in a series of articles designed to provide SXSW and LSI USA ’26 attendees and other MedTech professionals with practical considerations for efficiently executing mission-critical life science deals.

Electronic medical record with patient data and health care information in tablet. Doctor using digital smart device to read report online. Modern technology in hospital.

This post is part of our The Top 2025 Privacy and Security Issues Still Shaping Healthcare series, in which our team of attorneys provides essential strategies and insights for healthcare privacy and security.

The Health Insurance Portability and Accountability Act (HIPAA) has long been the cornerstone of patient privacy and data protection. Among its most patient-centric provisions is the Right of Access rule, which guarantees individuals timely access to their medical records. This right is not just a regulatory requirement—it’s a fundamental principle of patient empowerment, enabling individuals to make informed decisions about their health.

Healthcare_148231933-300x268.jpg

This post is part of our The Top 2025 Privacy and Security Issues Still Shaping Healthcare series, in which our team of attorneys provides essential strategies and insights for healthcare privacy and security.

In 2025, eight new U.S. state privacy laws took effect and several states tightened existing regulations, significantly impacting healthcare organizations. Major changes…

Doctor writing survey, insurance and claim form for medical paperwork, document and script for patient records, test result and research in a hospital. Physician hands signing and planning healthcare

This post is part of our The Top 2025 Privacy and Security Issues Still Shaping Healthcare series, in which our team of attorneys provides essential strategies and insights for healthcare privacy and security.

Reproductive health privacy rule vacated.

On June 18, 2025, the U.S. District Court for the Northern District of Texas vacated the HIPAA Privacy Rule to Support Reproductive Health Care Privacy Final Rule (Privacy Rule). As a result, the additional privacy protections that had been granted to reproductive healthcare information through President Biden’s Executive Order 14076, (“Protecting Access to Reproductive Health Care Services”), are no longer enforceable or required.

HIPAA Regulations

This post is part of our The Top 2025 Privacy and Security Issues Still Shaping Healthcare series, in which our team of attorneys provides essential strategies and insights for healthcare privacy and security.

Why Now? The Rising Cyber Threats Driving HIPAA Reform 

In December 2024, the U.S. Department of Health and Human Services Office for Civil Rights (OCR) proposed the first significant update to the HIPAA Security Rule since 2013, prompted by a surge in cyberattacks against healthcare organizations that have compromised patient information and disrupted care. 

HC Privacy & Security Top 10 Graphic

The 2025 Top Ten list reflects a regulatory environment in significant transition. Last year’s healthcare privacy and security landscape presented extraordinary challenges for compliance professionals, marked by sweeping regulatory changes on the federal and state level, intensified enforcement activity, and a growing and evolving environment that demanded constant vigilance. The volatile landscape demanded adaptability, careful attention to the regulatory details, and comprehensive compliance programs. The Top Ten list offers a capsulized version of the year’s highlights—and what it all means for healthcare privacy and security professionals moving forward.

The regulatory landscape for substance use disorder (SUD) treatment records is changing—and the impact will extend far beyond traditional addiction treatment programs. With treatment options for SUD limited, some providers are exploring ketamine as a potential therapy due to its effects on glutamatergic neurotransmission.[i] Additionally, psychedelic-assisted therapies involving certain Schedule I substances – such as psilocybin, ibogaine, and MDMA – are currently being studied by researchers as potential treatments for SUDs.[ii] While these investigational therapies are not yet available in clinical practice and the new federal privacy rules do not apply to research records, providers should be aware of the evolving treatment landscape as these therapies move closer to potential approval and clinical use.