Privacy developments for providers, health plans and their vendors: HIPAA enforcement, patient data breaches, tracking pixels and state health data laws.
Healthcare carries the strictest privacy obligations and the most valuable stolen data, a combination that keeps it at the center of both enforcement and breach litigation. This hub covers developments affecting covered entities and business associates.
Montana's Genetic Information Privacy Act, Title 30, chapter 23, part 1, came from SB 351 of 2023 and was rewritten in 2025. Its free conference committee version reaches any organization that collects, uses or analyzes genetic data, ties government access to warrants, restricts foreign storage, and gives the attorney general sole enforcement power.
Read more →The HIPAA Privacy Rule lets a covered entity use six categories of patient information, or share them with a business associate or an institutionally related foundation, to raise money for itself without authorization. The entity must say so in its privacy notice, offer an opt-out with every solicitation and stop once a patient opts out.
Read more →In Vita v. New England Baptist Hospital the Supreme Judicial Court split 5 to 1 over whether browsing a hospital's public website is a wire communication under the Massachusetts wiretap act. The majority found the word ambiguous and applied the rule of lenity. The dissent read 'any communication' as plain. Bills filed in 2025 to rewrite the definitions went to study.
Read more →Virginia protects reproductive and sexual health data through its general consumer protection statute rather than its privacy law. SB 754, enacted in 2025 as chapter 591, added a prohibited practice to Va. Code § 59.1-200 and a seven-part definition to § 59.1-198, bringing the Act's private damages action and Attorney General remedies with it.
Read more →Section 105 of GINA told HHS to treat genetic information as health information and to stop group health plans, health insurers and Medigap issuers from using it for underwriting. HHS's 2013 Omnibus Rule went further, applying the ban to every HIPAA health plan except long-term care insurers, and required plans that underwrite to say so in their privacy notices.
Read more →The Illinois Genetic Information Privacy Act, 410 ILCS 513, has been in force since 1998. It adopts HIPAA's definition of genetic information, which covers family medical history, forbids employers to solicit that information, limits insurers, and lets any aggrieved person sue for $2,500 or $15,000 per violation. Public Act 104-642 adds biomarkers from January 1, 2027.
Read more →Five state statutes read for this explainer regulate companies that sell DNA tests directly to consumers or analyze the resulting data: California, Arizona, Utah, Virginia and Montana. Each requires layered consent, a way to delete data and destroy samples, and limits on sharing with insurers or employers. They differ on who is covered, who enforces, and how much a violation costs.
Read more →HHS does not treat ransomware as a mere outage outside the breach rules. Its Office for Civil Rights reads encryption by an attacker as an acquisition of the data, which brings the incident within the regulatory presumption of breach at 45 CFR 164.402. This sets out where that presumption came from, what rebutting it involves, and the clocks that follow when it stands.
Read more →HHS finalised a rule in April 2024 restricting disclosure of information about reproductive health care to law enforcement and in litigation. In June 2025 a federal judge in Amarillo vacated nearly all of it, holding HHS had exceeded its authority. The government did not appeal, and the Fifth Circuit dismissed the intervenors' appeal in September 2025.
Read more →In 2019 the Office for Civil Rights announced that enforcing a patient's right to their own records would be an enforcement priority. The resulting settlements had reached 41 cases by September 2022 and have continued since. Read together they describe an unusually repetitive fact pattern: a person asks for records, months pass, and the file arrives only after a federal complaint.
Read more →In January 2025 the Office for Civil Rights proposed rewriting the HIPAA Security Rule, retiring the addressable safeguard category and adding asset inventories, encryption, multi-factor authentication and annual compliance audits. Nothing has been finalised, and the Unified Agenda now carries the rulemaking as a long-term action.
Read more →Section 10 of the Illinois Biometric Information Privacy Act carves health care information out of the definition of a biometric identifier. In Mosby v. Ingalls Memorial Hospital, the Illinois Supreme Court held that the carve-out is two clauses joined by "or" and that only the first is limited to patients. The second turns on purpose, whatever the source.
Read more →HIPAA attaches to a category of organisation. A newer class of state statute attaches to a category of information instead, defined by what it reveals about a person's health rather than by who holds it. This guide compares how Nevada, Maryland and Washington draw that line, and where the federal Health Breach Notification Rule sits alongside them.
Read more →A ransomware incident sets off obligations that sit outside the state breach statutes entirely. Encryption alone can be a reportable event under HIPAA before any record leaves the building, and the decision to pay opens a separate track running through sanctions law, bank secrecy reporting and securities disclosure. This guide charts those duties and where each clock starts.
Read more →Plaintiffs suing over analytics pixels, session recording and web chat rarely plead a privacy statute. They plead eavesdropping laws written for telephone wires in 1967 and 1968, which carry per-violation damages and no requirement to prove loss. This guide sets out the statutory elements those claims turn on, the party-consent question that decides most of them, and the newer pen-register theory.
Read more →HIPAA is three interlocking rules rather than one, and they apply to a defined set of organizations rather than to health information generally. This guide covers who is covered, what the Privacy Rule permits without authorization, what the Security Rule requires, how business associate liability works, and the mechanics of breach notification.
Read more →The HIPAA Security Rule requires covered entities and business associates to conduct an accurate and thorough assessment of risks to electronic protected health information. The requirement recurs across HHS Office for Civil Rights resolution agreements more than almost any other provision. This sets out what the regulation says and how OCR has described the standard.
Read more →Most health data collected by apps, wearables and websites falls outside HIPAA, which reaches only covered entities and their business associates. Washington's My Health My Data Act was the first US statute written specifically to close that gap, and it is enforceable by individuals rather than only by the state.
Read more →