Healthcare · Regulation & Compliance
Articles in this selection, newest first. Change the filters, or clear them to see every article.
15 articles · Healthcare · Regulation & Compliance
Articles
Week of 27 July 2026
Why WISeR providers should keep their own record while Congress argues
The Senate’s July vote left Medicare’s AI-assisted prior authorization model running in six states, its future still disputed. Providers bound by it need their own record of decisions, documentation and appeals, a record that serves daily operations and the policy fight alike.
Week of 16 February 2026
Why Part 2’s compliance date reached hospitals that never ran a treatment program
On February 16, 2026, addiction treatment records came under the same complaint, breach and penalty system that governs other health data under HIPAA. Because the duties follow the records, general hospitals, health plans and their vendors were covered too.
Week of 7 July 2025
How the DOJ’s bulk data rule made reach, not storage, the health data test
The Justice Department’s grace period ended on July 8, 2025, leaving health systems and life sciences firms facing a rule that asks who could reach their data, not how well it is protected. That puts procurement, research administration and HR on the front line.
Week of 3 March 2025
HHS’s end of voluntary comment periods hit grantees hardest and Medicare providers least
By dropping the Richardson Waiver, HHS stopped asking for public comment where the law did not require it. The lost warning fell unevenly: hardest on grant recipients, less on contractors and least on Medicare providers, whose own statute still requires comment.
Week of 16 September 2024
A hallucination rate is a sales claim, and Texas enforced it like one
Texas settled with Pieces Technologies by treating an AI tool’s advertised error rate like any other sales claim. Hospital leaders can test such a number on three counts: what it counts, where it was measured, and whether it stays true.
Week of 22 April 2024
HIPAA’s reproductive health attestation put the burden of purpose on the requester
HHS’s April 2024 rule made police, courts and oversight bodies sign a statement of why they wanted certain records. That moved paperwork onto requesters, but left hospitals with judgments no form could make, under a rule a court struck down in 2025.
Week of 5 February 2024
Part 2’s single consent freed the recipients and bound the source
HHS’s 2024 Part 2 rule let hospitals and insurers that receive addiction treatment records handle them much like other health data. The treatment programs that create those records, and the legal teams that answer subpoenas, ended up carrying more obligation than before.
Week of 4 December 2023
HHS could mandate hospital cybersecurity on its own; paying for it needed Congress
In December 2023, HHS sketched a cybersecurity baseline for hospitals, two ways to make it binding and incentives that needed Congress. Rules could arrive on the agency’s own timetable; the money could not. Hospitals had to plan for that gap.
Week of 15 May 2023
The FTC’s breach rule proposal drew the HIPAA line through the middle of a data flow
One patient’s health data can answer to different regulators as it moves from a hospital to a consumer product to an app. The FTC’s May 2023 proposal spelled out where those lines fall, and why sharing with advertisers can count as a breach.
Week of 28 November 2022
Hospital websites had a HIPAA problem because nobody owned the tags
OCR’s December 2022 bulletin on tracking code created no new rule. What it exposed was a gap in who was in charge: the scripts on hospital websites and portals sat with marketing teams and agencies, outside the controls protecting every other system holding patient data.
Week of 14 March 2022
Why hospitals could prepare for CIRCIA before CISA wrote its rule
The cyber incident reporting law signed in March 2022 set two deadlines in statute and left who is covered to a rulemaking that would take years. The decisions those deadlines force, inside a hospital’s incident command, never depended on the rule’s details.
Week of 10 January 2022
Surveyors counted the people hospitals don’t employ: the CMS staff rule after the Supreme Court
Once the Supreme Court let the CMS staff vaccination rule stand, the test became: could a hospital show a surveyor everyone who counted as staff, including contractors, students and practitioners it didn’t employ? Few had a single list that reached past the payroll.
Week of 13 September 2021
A breach with no attacker: the FTC’s warning to health apps
In September 2021 the FTC said a health app that shares users’ data without permission has suffered a breach. That moved breach prevention out of the security team and into three business decisions: what code ships, what partners receive, what users agreed to.
Week of 5 April 2021
Information blocking compliance lived in EHR defaults
The federal ban on information blocking took effect on April 5, 2021, and health systems found that compliance was decided less by policy than by portal settings and records queues. Three questions mattered: what gets released, when, and how withholding is defended.
Week of 30 March 2020
Hospitals without walls still had to say where the care happened
On March 30, 2020, Medicare’s waivers let care move into tents, surgery centers, new hands and video screens. Every claim and medical record still had to say where, by whom and how, and the systems recording those facts assumed the old answers.