Insights

Washington – June 6, 2024: Crowell & Moring earned 78 rankings for 67 lawyers, as well as 41 national and statewide practice area rankings, in the Chambers USA 2024 guide. The rankings are driven by independent interviews of clients and lawyers at peer firms.

The Department of Health and Human Services (HHS) continues its push on health data interoperability with a proposed rule, HHS Acquisition Regulation: Acquisition of Information Technology; Standards for Health Information Technology.  Specifically, HHS proposes to modify the Health and Human Service Acquisition Regulation (HHSAR) to implement an HHS-wide policy to align requirements related to the procurement of health IT with standards and implementation specifications adopted by the Office of the National Coordinator for Health IT (ONC) or compliance with the voluntary ONC Health IT Certification Program.  This proposed rule was published on August 9, 2024, just 4 days after the ONC proposed HTI-2 rule was published in the Federal Register.

On April 26, 2024, the Federal Trade Commission (“FTC”) announced a final rule (“Final Rule”) modifying the Health Breach Notification Rule (“HBNR”). The Final Rule, which largely finalizes changes proposed in a Notice of Proposed Rulemaking published last year (“2023 NPRM”), broadens the scope of entities subject to the HBNR, including many mobile health applications (“apps”) and similar technologies, and clarifies that breaches subject to the HBNR include not only cybersecurity intrusions but also unauthorized disclosures, even those that are voluntary. The Final Rule will take effect 60 days after its publication in the Federal Register.

On April 26, 2024, the Department of Health and Human Services’ Office for Civil Rights (“OCR”) published a final rule entitled HIPAA Privacy Rule to Support Reproductive Health Care Privacy (the “Final Rule”) to address new privacy issues that have resulted in the wake of the Supreme Court decision in Dobbs v. Jackson Women’s Health Organization (“Dobbs”). The Final Rule aims to strengthen reproductive health care privacy under the Health Insurance Portability and Accountability Act and its implementing regulations (collectively, “HIPAA”) by prohibiting covered entities and business associates (collectively, “regulated entities”) from using or disclosing protected health information (“PHI”) to investigate or impose liability on any person for the “mere act” of seeking, obtaining, providing, or facilitating lawful reproductive health care, or to identify any person for such purposes.

Though general rules established by the Health Insurance Portability and Accountability Act and its implementing regulations (collectively known as HIPAA) are relatively well known, fewer people are familiar with some finer details, such as the fact that HIPAA is somewhat limited in scope. It’s also a common misconception that HIPAA applies to all or most individually identifiable health information.