• The IBR Privacy Exception permits actors to not fulfill a request for access, exchange, or use of EHI under certain circumstances.
• If a federal or state law requires a legal precondition (e.g., consent) to be satisfied before EHI may be released, an actor may follow that law. If an actor operates in multiple states with

…

•  BetterHelp, an online counseling service App, falsely claimed it was certified “HIPAA Compliant” and maintained the privacy of consumer information.
• BetterHelp failed to obtain the express consent of consumers before sharing their identifiable health information with FaceBook, Snapchat, and other 3rd parties. 
• The FTC Health Breach Notification Rule was found to not apply here because

…

• Major health care system in Arizona agrees to pay $1.25 Million for HIPAA non-compliance with Security Rule.
• Corrective Plan includes OCR oversight until December 2024! 
• Cybersecurity incidents remain a high risk for breaches by HIPAA covered entities and their business associates — so, prevent, detect and mitigate!

Subscribe to HERE to Legal HIE’s compliance library…

• The FTC just enforced its Health Breach Notification Rule for the first time since the effective date 13 years ago!
• Vendors of Personal Health Records, and related entities, must comply with the FTC Health Breach Notification Rule.
• HIPAA covered entities and their business associates are, generally, excluded from compliance with the FTC Health Breach Notification

…

•  A HIPAA BAA must be in place for a regulated entity to use online tracking technologies to collect IIHI from its website, mobile apps, social media page(s) for health care operations purposes.
• OCR says all IIHI, including an individual’s IP addresses and geo location, collected by a regulated entity’s website, is protected by HIPAA.
• If

…

• Part 2 Rule gets 4th overhaul in five years.
• CARES Act required SAMHSA to revise rule one more time to support care coordination.
• Rule proposes a one-time consent, and alignment with HIPAA on downstream disclosures.
• Tighter restrictions on use of Part 2 info for civil/criminal proceedings and NEW enforcement levers allowing, for the first time,

…

     Today, the Information Blocking spigot has officially opened. As diligent students of the Information Blocking Rule will know, up until yesterday (October 5, 2022) the Content & Manner Exception permitted an Actor (i.e., health care provider; HIE/HIN; developer of certified health IT) to decline furnishing a requestor access to electronic health information (EHI)…