Seyfarth Synopsis: The Department of Health and Human Services has delegated enforcement authority to the Office of Civil Rights for 42 CFR Part 2, which protects the confidentiality of substance use disorder records. Covered entities must update their HIPAA documents to reflect these changes by February 16, 2026.

On August 25, 2025, the U.S. Department of Health and Human Services (HHS) Office of the Secretary authorized the Director of the Office for Civil Rights (OCR) to enforce the “Confidentiality of Substance Use Disorder (SUD) Patient Records” regulations found at 42 CFR Part 2, including the right to impose civil penalties, issue subpoenas and take corrective actions for noncompliance. These rules, finalized in February 2024, aim to protect the privacy of patients’ SUD treatment records, and require updates to HIPAA Privacy Policies and Notices of Privacy Practices.Continue Reading Enforcement of Substance Use Disorder Records

Seyfarth Synopsis: In the wake of a recent federal District Court decision, the reproductive health care HIPAA Privacy rules finalized during the Biden Administration have been vacated and plan sponsors should re-evaluate the language included in their HIPAA compliance documents.

In a somewhat unsurprising turn of events, a Texas District Court vacated the HIPAA

This post was originally published to Seyfarth’s Global Privacy Watch blog.

Seyfarth Synopsis: This past Monday, the Office for Civil Rights (OCR) at the Department of Health and Human Services (HHS) issued its final rule aimed at strengthening the HIPAA Privacy rules as they are applied to reproductive health data.

On the heels of the release of the 2022 US Supreme Court decision in Dobbs v. Jackson Women’s Health Organization, the Biden Administration directed the Federal agencies to examine what they could do to protect women’s health and privacy. Shortly thereafter, HHS released guidance under HIPAA related to reproductive health care services under a health plan, focusing on information required to be disclosed by law, for law enforcement purposes, and to avert a serious threat to health or safety (see our earlier Alert here). Then, in April 2023, HHS issued proposed modifications to the HIPAA Privacy Rule aimed at these concerns. A year later, the agency finalized those rules on April 22, 2024 – the Final Rule.Continue Reading HHS Strengthens HIPAA Rules to Protect Reproductive Health Privacy

This post was originally published to Seyfarth’s Global Privacy Watch Blog.

As organizations begin renewing and entering into new contractual relationships for 2024, an oft-forgotten aspect of the contracting process is determining whether a Business Associate Agreement (a “BAA”) is required. Under HIPAA, health care providers, health plans and health care clearinghouses (“Covered Entities”)

Seyfarth Synopsis: As employers continue to struggle with strategies for safely re-opening their workplaces, we have previously discussed the possibility of mandating a vaccine or providing incentives for getting the vaccine. [Here] As employers shift their focus toward the cost of COVID hospitalizations (which studies show are a much greater risk for unvaccinated individuals), employers

Seyfarth Synopsis: The Department of Health and Human Services (HHS) has proposed changes to the required Privacy Notice under the HIPAA privacy regulations. If finalized, these would be the first significant changes to the HIPAA rules since the HITECH changes effective back in 2013.

The press release issued by HHS on December 10, 2020, states

On Monday, March 23, at 1:00 p.m. Central, Seyfarth partners Diane Dygert, Benjamin Conley, Jennifer Kraft, Kaley Ventura, Jake Downing, and Christina Cerasale are presenting a 1 hour CLE webinar, “Employee Benefits in a Time of COVID-19.”

Keep up with the latest developments and rapidly changing laws and regulations relating to COVID-19 and your benefit

Seyfarth Synopsis: Because everything has a coronavirus angle now….this blog post covers various issues and considerations plan sponsors and administrators should keep in mind as the coronavirus outbreak continues to escalate.

 While this list is by no means exclusive (and may be added to over time), here are a few steps plan sponsors can take

Seyfarth Synopsis: The Director of HIPAA enforcement agency cautions that many covered entities are not meeting the basic HIPAA requirements and sees “low-hanging fruit” for enforcement activity.

The Director of the Office for Civil Rights at HHS, Roger Severino, recently gave an interview to Law360 about his office’s enforcement of the Health Insurance Portability