Your AI agent can book your haircut and find you a cheaper flight, so why not send it to collect your medical records? Behind that helpful little bot is a company, a set of terms you probably didn’t read, and some very real questions about who is responsible. If you asked for last month’s labs and the agent walked away with your entire medical history, whose problem is that?
TEFCA’s October 26 compliance deadline is directed at QHINs, but organizations connected through them should be paying attention, too. A restriction further up the network could disrupt your access even if your organization followed the rules. With federal oversight expanding and data access disputes landing in court, participants may also need to explain what happened to records they exchanged long before this deadline.
Nolla’s AI prescribing pilot is being celebrated as a win for access to care. Byte also promised convenient, affordable treatment before the recall and reports of damaged teeth. But who determines whether a patient actually is “low risk,” and what happens when that judgment is wrong?
Ever have PHI accidentally land in the wrong inbox? In Black v. IEC Group, an employee emailed a spreadsheet containing patients’ health claims information to other plan members, and the patients sued. The Ninth Circuit allowed the case to proceed based on the alleged loss of confidentiality, even without identity theft or financial loss, showing how the wrong inbox can open the courthouse door.
The breach happened at Labcorp’s debt collector AMCA, Labcorp’s HIPAA Business Associate, but Labcorp still agreed to pay nearly $2.3 million to multiple States. So, before you hand over those PHI marbles, ask yourself: if your HIPAA BA vendor spills them, does your contract require it to help pay for the cleanup?
TEFCA’s Individual Access Services (IAS) rules are getting an update! Effective August 3, 2026, the revised requirements aim to help patients obtain their health records while strengthening identity verification and secure access. What changes for apps gathering those records, and the providers and health plans releasing them? Here’s what you need to know, including which requirements take effect now and which come later.
Your patient’s daughter asks for a copy of her mother’s records. Does she need a health care power of attorney, is a signed release enough, or can her mother simply direct you to send them? HIPAA, state law, and information blocking all affect the answer, and treating every “authorized representative” the same can result in releasing too much or improperly withholding access.
42 CFR Part 2’s consent rules got a major update, but did New Jersey’s HIV confidentiality law get the memo? A decades-old cross-reference may leave New Jersey’s HIV consent requirements tied to the 1987 version of the federal rule. For providers and HIEs, the answer could affect both how they share records and their exposure to patient lawsuits.
Epic got GuardDog to heel. But the stipulated judgment does not close the book for healthcare providers whose patient records may have been pulled, or answer whether they have a reportable breach. With patient class actions already in play, “Epic handled it” is not an incident response plan.
Time is up, and the enforcement infrastructure is now live. OCR’s complaint portal is open to 42 CFR Part 2, and Part 2 breach reporting is no longer a future workflow. A live portal changes behavior: it lowers the friction to file, increases complaint volume, and accelerates how quickly organizations receive the familiar “we have received a complaint, please explain” letter. If you are a Part 2 program, a QSO, or a lawful holder (including many HIPAA covered entities and business associates), this is the moment Part 2 stops being a policy project and becomes immediate operational exposure.
Epic’s new lawsuit casts the company as the white knight protecting patient records from alleged data thieves. For a company already facing antitrust claims over its own data-access practices, that is quite a wardrobe change. But will this fight make health information exchange safer, or leave everyone else afraid to share?
ONC just dropped four new Information Blocking FAQs on December 19, 2025, and they go straight to the real pressure points: revenue-sharing dressed up as fees, “alternative manner” gamesmanship, and whether automation counts as access. These clarifications matter most where policy meets operations. If you build, sell, operate, or rely on interoperability, this is the set to read.
HHS has declared that the “warning period” for information blocking is over, putting HIEs, HINs, developers, and providers squarely in the path of active enforcement. With OIG empowered to levy million-dollar penalties, ONC able to strip certifications, and CMS now finalizing monetary disincentives for certain providers, the consequences are real and far-reaching. At the same time, long-standing practices, such as conservative privacy policies or restrictive BAAs, may suddenly collide with federal interoperability mandates. This article examines the new enforcement posture, the risks and dilemmas it creates, and what health information networks and their provider members must do to prepare.
Ever burned valuable time chasing down what feels like endless versions of 42 CFR Part 2? No more! Bookmark this for your one-stop place to go for copies of every single Notice of Proposed Rulemaking (NPRM) and Final Rule for 42 CFR Part 2, starting with the very first proposal in 1974! Whether you’re a compliance officer, privacy lawyer, or just a regs nerd who loves immediate access to the rules you need, this list has you covered. Bookmark it, share it, and breathe easy knowing you’ll never again waste hours digging through archives. You’re welcome. 😉
Until now, Part 2 programs had no duty to report breaches under Part 2—even if disclosures clearly violated the rule. That “free pass” ends in February 2026, when HIPAA’s breach reporting framework will officially be grafted onto Part 2. What does this mean for programs? A new world of reporting obligations, OCR enforcement, and tougher compliance decisions.