From Dragging Feet to Dragged Along: The Uneven March Into TEFCA

From Dragging Feet to Dragged Along: The Uneven March Into TEFCA

by | Aug 8, 2025 | , , ,

On August 6, 2025, ONC unveiled the first public TEFCA Organizational Map, a tool that makes it possible to see which health systems are stepping into the national interoperability framework—and which are not. For some, this marks a milestone in transparency and progress; for others, it raises questions about strategy, governance, and whether more national data sharing is always a good thing. The uneven pace of adoption, particularly among Epic’s vast customer base, shows just how complicated the march into TEFCA has become.

read more
Audacious Inquiry Sues CRISP: A Patent Showdown with National Interoperability Implications

Audacious Inquiry Sues CRISP: A Patent Showdown with National Interoperability Implications

by | Jul 15, 2025 | , , ,

Audacious Inquiry has filed a patent infringement suit against CRISP, Maryland’s state-designated HIE. At issue are core encounter notification and care coordination tools that providers nationwide rely on daily. With high-stakes infrastructure and TEFCA participation on the line, the outcome could reshape how HIEs balance public good with private innovation.

read more
Regulatory Roller Coaster: District Court Judge Vacates HIPAA Reproductive Health Privacy Rule

Regulatory Roller Coaster: District Court Judge Vacates HIPAA Reproductive Health Privacy Rule

by | Jun 23, 2025 | , ,

On June 18, 2025, Judge Kacsmaryk of the U.S. District Court for the Northern District of Texas vacated key provisions of HHS’s HIPAA Privacy Rule that had imposed new federal protections for reproductive health care information. This means that HIPAA-covered entities must immediately stop requiring a HIPAA-compliant Attestation from requestors seeking PHI that includes (or is likely to include) reproductive health information. Covered entities must now also reevaluate their current processes for handling requests for PHI related to reproductive health information. However, if you operate in a state that has its own state-level reproductive privacy or provider shield law, those state protections still apply and may even require similar or stronger privacy safeguards.

read more
Does the TEFCA Exception Hinder Participation?

Does the TEFCA Exception Hinder Participation?

by | Jun 9, 2025 | , , , ,

HHS has opened the door to one of the biggest questions in health information law: should the TEFCA exception to the information blocking rules stay or go? The May 16, 2025 RFI asks whether this carve-out encourages participation in TEFCA or instead creates confusion and double standards for networks like Carequality, which already impose requirements stricter than HIPAA. With comments due June 16, stakeholders have just days to weigh in on a decision that could reshape the balance between nationwide interoperability and local control.

read more
Impact of Executive Order 14117 and DOJ’s Final Rule on HIEs Operating as Business Associates

Impact of Executive Order 14117 and DOJ’s Final Rule on HIEs Operating as Business Associates

by | May 21, 2025 | , ,

The U.S. Department of Justice’s Final Rule titled Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons became effective on April 8, 2025, but its compliance requirements are currently stayed until July 8, 2025 to give organizations time to adjust. This sweeping rule applies to U.S. hospitals, health systems, health information exchanges (HIEs), health IT and cloud vendors, research institutions, and any other U.S. persons or entities that handle, transfer, or store large volumes of sensitive personal data. HIEs should coordinate closely with legal counsel to update their compliance programs and ensure that no aspect of their technology stack or vendor chain inadvertently creates a prohibited or restricted data transaction.

read more
Do Recent Changes to the Carequality Framework Policies Implicate Information Blocking For Some?

Do Recent Changes to the Carequality Framework Policies Implicate Information Blocking For Some?

by | May 14, 2025 | , , ,

Carequality’s new Version 3 Framework Policies add stricter requirements than HIPAA and could expose participants to Information Blocking risks. At the same time, TEFCA alignment creates a paradox: practices permitted under the new TEFCA Exception may still be questioned outside of TEFCA. This article unpacks the double standard—and what it means for HINs, HIEs, and nationwide interoperability.

read more
Join Us June 11th for a Free Q&A Panel on 42 CFR Part 2!

Join Us June 11th for a Free Q&A Panel on 42 CFR Part 2!

by | Apr 4, 2025 | , ,

Join us for a 1-hour Q&A session addressing some of the most pressing questions that Part 2 Providers and HIE/HINs are asking about the Final Rule for 42 CFR Part 2. The session will cover: Compliance obligations & enforcement risks for Part 2 Providers, QSOs,& “Lawful Holders”; the NEW Part 2 “TPO Consent” and its application in an HIE-networked environment; sharing Part 2 information for Public Health & Scientific Research; QSO language; sharing Part 2 Information through HIE/HINs, and much more!

read more
Preventing IAS from Becoming a Trojan Horse

Preventing IAS from Becoming a Trojan Horse

by | Mar 9, 2025 | , ,

Last week, I attended HIMSS 2025 in Las Vegas and came away with four big themes that stood out for me: the industry’s growing focus on Individual Access Services (IAS) and rock-solid identity verification, the push to expand non-treatment use cases for interoperability (like payment and healthcare operations), the urgent need for modernized consent management, and the overarching importance of trust to tie it all together. Yet of all these, for me, IAS is the real showstopper: if we don’t get identity and access right, the rest of our digital transformations—from AI-driven insights to cross-network data sharing—could quickly unravel. In today’s post, I want to zero in on IAS—where it fits into HIPAA’s right of access, where personal representatives enter the picture, and why it risks becoming a Trojan Horse for unauthorized data if we don’t take the proper safeguards.

read more
NOW LIVE! The Updated 42 C.F.R. Part 2 Helper is Available!

NOW LIVE! The Updated 42 C.F.R. Part 2 Helper is Available!

by | Mar 2, 2025 | , , ,

The wait is finally over!! Our brand-new, UPDATED 42 C.F.R. Part 2 Helper compliance package is now live for current members of Legal HIE. Loaded with carefully crafted checklists, tools, sample forms, policies, and training resources, all updated for the Part 2 Final Rule, it’s just what the doctor ordered for every organization to stay miles ahead of the February 16, 2026 compliance deadline! Read our new blog post for more information about what’s included with our Part 2 Helper and to get access to a sample checklist to update your Part 2 consents!

read more
Judge Decides Class Action Can Proceed Against UnitedHealth for Use of AI

Judge Decides Class Action Can Proceed Against UnitedHealth for Use of AI

by | Feb 28, 2025 | , ,

Yesterday, a federal court issued a highly anticipated ruling in Estate of Gene B. Lokken v. UnitedHealth Group—denying UnitedHealthcare’s attempt to dismiss certain state law claims and allowing breach of contract and good faith claims to move forward. It’s a major development in a case when back in November 2023 UHG was first sued over AI-driven coverage denials under its Medicare Advantage plans. Given this new ruling, it’s a perfect time to revisit the original lawsuit’s claims and the broader legal risks that AI poses in healthcare.

read more
Tick Tock: The 42 CFR Part 2 Compliance Clock is Counting Down!

Tick Tock: The 42 CFR Part 2 Compliance Clock is Counting Down!

by | Feb 16, 2025 | , ,

One year. That’s all the time left before the February 16, 2026 compliance deadline for the 42 CFR Part 2 Final Rule officially arrives. If you haven’t started preparing yet, now is the perfect time to get things in motion. One of the most challenging aspects of Part 2 implementation is the new consent structure. While the new consent for treatment, payment, and health care operations (“TPO consent”) introduces opportunities for improved data sharing and alignment with HIPAA, it is also complex and requires careful implementation. To help navigate these changes, today’s post offers readers a checklist of the key elements required in Part 2 consents.

read more
Kelly Thompson Joins Legal HIE as its Strategy and Interoperability Lead

Kelly Thompson Joins Legal HIE as its Strategy and Interoperability Lead

by | Feb 4, 2025 |

Kelly Hoover Thompson has joined Legal HIE Solutions as its new Strategy & Interoperability Lead! Kelly is a powerhouse in healthcare law, interoperability, and transformation. She is the former CEO of SHIEC, and former Deputy Secretary at the Pennsylvania Department of Health, and services in numersou advisory and leadership roles, including for the CDC’s Center for Health Statistics Board, the National POLST Technology Committee, and UPMC’s Patient Safety Committee. Kelly has been at the forefront of shaping health IT, regulatory policy, and organizational development. Learn more about Kelly in today’s post!

read more
The Winding Road of Changes to 42 CFR Part 2

The Winding Road of Changes to 42 CFR Part 2

by | Feb 1, 2025 |

Over the years, 42 CFR Part 2 has traveled a winding road of amendments and updates—beginning with the 2016 Proposed Rule and continuing through a series of updates, each one modernizing how Part 2 information is shared while preserving essential privacy safeguards. Today’s post offers a chronological list of these rulemakings, each with its own executive summary.

read more
State HIE Sued for Alleged “Unauthorized” Use of PHI for Research

State HIE Sued for Alleged “Unauthorized” Use of PHI for Research

by | Jan 31, 2025 | , ,

On January 3, 2025, a significant lawsuit was filed against a state HIE. The case was brought by a former employee and whistleblower who alleges that the HIE permitted unauthorized access and use of PHI for research purposes in violation of federal and state law, as well as operational policies. Although the facts that are currently known to the public are not sufficient to conclude whether or not HIPAA’s standards applicable to research were met, this case has the potential to influence not only the immediate parties involved but also broader interpretations of HIPAA compliance and enforcement in research settings. At a minimum, the case serves as a reminder that HIEs should be taking proactive steps to ensure that their internal policies, data use agreements, and HIPAA BAAs explicitly address research-related and similar activities in compliance with federal and state laws, including HIPAA.

read more
HIPAA’s Security Rule Glow-Up: What’s Changing and Who’s Affected

HIPAA’s Security Rule Glow-Up: What’s Changing and Who’s Affected

by | Jan 12, 2025 | , ,

On December 27, 2024, the Office for Civil Rights (OCR) at the Department of Health and Human Services (HHS) decided it was time to give the HIPAA Security Rule a much-needed cybersecurity makeover—and let’s just say, it’s not just a light touch-up. These proposed changes mean stricter security rules, fewer loopholes, and a whole lot more paperwork for covered entities, business associates, and especially Health Information Exchanges (HIEs) and Health Information Networks (HINs).

read more

Archives