Audacious Inquiry has filed a patent infringement suit against CRISP, Maryland’s state-designated HIE. At issue are core encounter notification and care coordination tools that providers nationwide rely on daily. With high-stakes infrastructure and TEFCA participation on the line, the outcome could reshape how HIEs balance public good with private innovation.
Yesterday, a federal court issued a highly anticipated ruling in Estate of Gene B. Lokken v. UnitedHealth Group—denying UnitedHealthcare’s attempt to dismiss certain state law claims and allowing breach of contract and good faith claims to move forward. It’s a major development in a case when back in November 2023 UHG was first sued over AI-driven coverage denials under its Medicare Advantage plans. Given this new ruling, it’s a perfect time to revisit the original lawsuit’s claims and the broader legal risks that AI poses in healthcare.
On January 3, 2025, a significant lawsuit was filed against a state HIE. The case was brought by a former employee and whistleblower who alleges that the HIE permitted unauthorized access and use of PHI for research purposes in violation of federal and state law, as well as operational policies. Although the facts that are currently known to the public are not sufficient to conclude whether or not HIPAA’s standards applicable to research were met, this case has the potential to influence not only the immediate parties involved but also broader interpretations of HIPAA compliance and enforcement in research settings. At a minimum, the case serves as a reminder that HIEs should be taking proactive steps to ensure that their internal policies, data use agreements, and HIPAA BAAs explicitly address research-related and similar activities in compliance with federal and state laws, including HIPAA.
Texas Attorney General, Ken Paxton, has sued HHS alleging that the HIPAA Reproductive Health Care Privacy Rule amendments infringe on the state’s investigative authority and that the HIPAA statute does not grant sufficient authority to HHS to promulgate such a rule. Texas is seeking an injunction against enforcement of the final rule.
The American Hospital Association, joined by a few others, has sued the federal government to enjoin them from enforcing their published Guidance on “Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates.”
The Minnesota Supreme Court held that HIPAA “authorizes” disclosures for purposes of state law and consent was not required for a hospital to disclose PHI to its institutionally related foundation for fundraising purposes. Other states might take a similar stance. The Information Blocking Rule (IBR) prohibits health care providers from interfering with the access and exchange of EHI in an unreasonable manner. State with laws containing similar “as authorized by federal law” exceptions to consent must be carefully considered when claiming the IBR’s Privacy Exception to “block” EHI.
On December 1, 2022, OCR released a “guidance” Bulletin re: “Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates.” From it, we learned (among other things) that OCR believes that an individual’s IP addresses and geo location, collected by a regulated entity’s website, is protected by HIPAA. Now, we have come to learn that HIPAA compliance investigations by OCR are already underway concerning this topic. Are you ready?
The New Year is finally here, and I believe that there will be a LOT going on in 2023! Here are just a few of the things that Legal HIE is looking to stay on top of for our readers this year . . .
A recent opinion article published in STAT News explored whether potential litigation is looming surrounding the de-identified data exception in HIPAA. The authors of the article point out that “large volumes of data underpin the development of any AI effort,” which is why companies…
BCBS Plans Defend against Antitrust Class Actions Back at the end of July, a class action lawsuit was filed against Blue Cross Blue Shield of Alabama (BCBS Alabama), the Blue Cross Blue Shield Association (the “Association”), and multiple BCBS Plans for antitrust violations. The...
The ACA SCOTUS Decision in Plain English As we all know from the “media drama” as some might call the countless media coverage, news articles, blogs and other posts, the Supreme Court of the United States (“SCOTUS”) upheld the Patient Protection and Affordable Care Act (“ACA”) on June...
Will HIPAA Conviction Appeal Loss Open the “Zhou” Gates? This post is prepared by Christopher Dodson. Readers of this blog are probably familiar with the case of Dr. Huping Zhou, who was successfully prosecuted for violating HIPAA’s privacy protections. Zhou accessed the patient records of...
State AG Brings First HIPAA Lawsuit Against Business Associate Last month, I posted how treatment of business associates during HIPAA investigations remains unclear as well as assignment of liability for breaches of PHI. A final “omnibus rule” is expected to clarify the HITECH business...
Yet Another Class-Action Filed After Breaches of Patient Data In what appears to be the trend in California for 2011, another class-action lawsuit has been filed, this time by patients of the University of California-Los Angeles (UCLA) Health System affected by a data breach in early...
Supreme Court to Hear Arguments on Suit for Damages under the Privacy Act The Supreme Court is scheduled to hear oral arguments tomorrow, November 30, in a suit for damages under the Privacy Act stemming from a wrongful disclosure of confidential information. Federal Aviation...