Healthcare cybersecurity insights on Privacy
State-level health privacy laws are creating a complex compliance landscape for health systems. Learn how California's CMIA and Washington's My Health MY Data Act reshape data governance, consent frameworks, and operational security requirements beyond federal HIPAA standards.
The modernization of 42 CFR Part 2 creates both compliance complexity and strategic opportunity for health systems managing substance use disorder treatment records. This post provides actionable frameworks for aligning these dual regulatory regimes and strengthening mental health data protections.
Understanding the technical and regulatory distinctions between HIPAA's two de-identification pathways is essential for health systems managing secondary data use, research initiatives, and compliance risk. This guide walks CISOs and compliance officers through Expert Determination and Safe Harbor decision criteria.
The Supreme Court's Dobbs decision has fundamentally altered the legal landscape for reproductive health data. Healthcare leaders must immediately reassess data governance, retention policies, and state law compliance to mitigate unprecedented privacy and liability risks.
The Dobbs decision fundamentally altered the threat landscape for reproductive health data, creating novel legal exposures that demand urgent attention from health system CISOs and compliance officers. This post provides a practitioner-level framework for identifying, quantifying, and mitigating these risks using established cybersecurity and privacy standards.
The final rule modernizing 42 CFR Part 2 represents the most significant change to substance use disorder data privacy in decades. Healthcare CISOs and compliance officers must act now to reconcile legacy consent workflows, update technical controls, and align information systems with the new HIPAA-convergent framework.