Health Data Privacy and Cybersecurity

HIPAA Privacy and Security Rule policy, OCR enforcement, reproductive health and substance use data, Privacy Act notices and health sector cybersecurity requirements.

Health privacy policy no longer sits inside HIPAA alone. A growing share of health data is held by entities HIPAA does not reach, and a growing share of the enforcement risk for entities it does reach comes from cybersecurity expectations rather than from disclosure rules.

For a small practice the two arrive together, as a security requirement written for an organization with a security team and a budget. Whether a rule scales down is usually the whole question, and it is the one most often left to implementation.

What this covers

HIPAA Privacy and Security Rule rulemaking, including proposed cybersecurity requirements and the recognized security practices question. OCR enforcement actions and the theories behind them. Right of access, including response timelines. Part 2 substance use disorder records and their alignment with HIPAA. Reproductive health privacy. Privacy Act system of records notices, which are where federal agencies disclose what they are collecting and how they will use it. Sector cybersecurity performance goals and incident reporting obligations.

Why it is hard to track

Much of it never appears as a privacy rule. A system of records notice, a paperwork notice, or a revised security guidance document can change what an organization must do without amending a regulation, and these are published in places most health policy coverage does not read.

In this area

22 briefs, newest first. Tag archives: Privacy and Security

Dates that bind

Open comment windows and effective dates are on the regulatory tracker, which regenerates every weekday. Compliance dates are on the compliance page. Verify any date you intend to rely on against the primary document linked in the brief; see disclosures for how these briefs are produced.