HIPAA privacy and security
For Technology, AI, and Competition sector companies, HIPAA privacy and security obligations are no longer limited to traditional healthcare adjacency. The U.S. Department of Health and Human Services Office for Civil Rights and the U.S. Federal Trade Commission have both expanded enforcement posture toward tech firms handling health-adjacent data, with OCR's 2024 updated guidance on tracking technologies directly implicating analytics platforms, ad-tech stacks, and AI inference pipelines that touch protected health information. Compliance teams are currently auditing pixel and SDK deployments against that guidance before exposure surfaces in the next round of OCR resolution agreements.
Watch
- OCR's December 2024 tracking technology guidance: does your analytics stack qualify as a business associate?
- FTC enforcement under Section 5 for deceptive health data practices in consumer-facing AI products
- HIPAA Security Rule NPRM (proposed 2024): updated technical safeguard requirements for electronic PHI
- State AG coordination with OCR on health data breaches involving third-party AI vendors
- Right-of-access enforcement: OCR settlement pattern targeting patient portal delays at covered entities
Recent material activity in Technology, AI & Competition
Active monitoring in place across Technology, AI & Competition. Material developments related to hipaa privacy and security will appear here as they are published.