HIPAA privacy and security

Financial and capital markets firms are sitting at an under-mapped intersection: HIPAA applies wherever they handle protected health information, including through employee benefit plans, fintech health-linked products, and certain data-sharing arrangements with covered entities. The U.S. Department of Health and Human Services Office for Civil Rights and the U.S. Federal Trade Commission have both taken enforcement positions that reach financial sector actors holding health data, and the 2024 HIPAA Security Rule proposed update from HHS would impose materially stricter technical safeguard requirements than the 2003 baseline most firms quietly inherited. Compliance teams are reviewing business associate agreements and third-party data vendor contracts now, not after a breach.