Careers

Diversity

With 18 offices, from New York to Los Angeles and Seattle to Orlando, we live and work in communities all over the U.S., collaborating across locations, disciplines and even borders. Our experienced, highly ranked lawyers serve businesses wherever they are and wherever they want to go.

Offices

About Us

Pages

Professionals

Thought leadership: blogs, podcasts, videos, publications, events and news

Insights

Services

Pro Bono

Am Law 100 firm with practices in Business, Digital Assets and Data Management, Intellectual Property, Labor & Employment, Litigation and Tax.

Home | BakerHostetler

The Privacy Strategist: The Latest CCPA Regulations – Are You Scared Yet?

Jonathan Cardenas Moderates ABA Business Law Section Crypto ETFs Webinar

BakerHostetler M&A Advises Grant Thornton France Joining Grant Thornton Advisors and New Mountain

BakerHostetler Attorneys Participate in District of Delaware 2025 Bench & Bar Conference

core/heading

HHS indicates that information blocking enforcement is a priority and on the horizon.

core/list-item

Permanent Medicare telehealth flexibilities remain elusive.

Part 2 compliance obligations loom, with OCR as the new enforcement sheriff in town.

State laws may impact compliance with information blocking and artificial intelligence regulations.

core/list

Information Blocking Crackdown

Earlier this month, the U.S. Department of Health and Human Services (HHS) <a href="https://www.hhs.gov/press-room/hhs-crackdown-health-data-blocking.html" target="_blank" rel="noreferrer noopener">published</a> a press release announcing a “crackdown on health data blocking” as the HHS Secretary had directed HHS to “increase resources dedicated toward curbing the harmful practice of information blocking.” As discussed in our previous <a href="https://www.bakerlaw.com/insights/healthcare-providers-beware-finalized-disincentives-sharpen-the-teeth-of-information-blocking-rule/" target="_blank" rel="noreferrer noopener">client alert</a>, the Information Blocking Rule (IBR) prohibits certain entities (including healthcare providers and developers of certified health IT) from blocking the access, exchange or use of electronic health information Notably, the fines for information blocking can be steep, ranging to $1 million per violation for <a href="https://www.bakerlaw.com/insights/steep-penalties-for-information-blocking-finalized/" target="_blank" rel="noreferrer noopener">certified health IT developers</a>, or hefty <a href="https://www.bakerlaw.com/insights/healthcare-providers-beware-finalized-disincentives-sharpen-the-teeth-of-information-blocking-rule/" target="_blank" rel="noreferrer noopener">disincentives</a> for healthcare providers.

core/paragraph

According to the HHS announcement, “unblocking the flow of health information is critical to unleashing health IT innovation and transforming our healthcare ecosystem.” The announcement made clear that HHS had already begun reviewing reports of information blocking against developers of certified health IT and was working with the HHS Office of the Inspector General to investigate these claims. The HHS announcement also included a link for patients to submit information blocking concerns. In light of the anticipated crackdown, it is prudent for industry stakeholders to review and update workflows, policies and procedures that were put in place to comply with the IBR.

State law must also be taken into consideration when developing an IBR compliance plan. Texas is the latest state to join the likes of California and Kentucky with its new <a href="https://capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&amp;Bill=SB922">law</a> requiring that sensitive pathology and radiology test results not be disclosed to the patient via electronic means (such as through a patient portal) until three days after the results are finalized. It is conceivable that additional state legislation could be forthcoming in light of the proposed HHS crackdown.

The Telehealth Cliffhanger*

As we<a href="https://www.bakerlaw.com/insights/no-longer-on-edge-of-the-telehealth-cliff-for-now-congress-extends-medicare-telehealth-flexibilities-for-additional-6-months/" target="_blank" rel="noreferrer noopener"> previously</a> analyzed, after more than five years of kicking the proverbial legislative can down the road, permanent federal telehealth flexibilities remain elusive. Instead, the industry continues to be forced to rely on the temporary telehealth waivers enacted during the COVID-19 pandemic that leave the industry on a perpetual cliff whenever the waivers are slated to expire. Presently, these temporary telehealth flexibilities are set to expire on Sept. 30. However, there are several pending bills that the health care industry is closely monitoring, which would either extend the telehealth flexibilities until mid-November or permanently establish telehealth flexibilities for Medicare beneficiaries. As of this writing, no legislation to extend the telehealth flexibilities has been passed. If Congress fails to act to extend or make these flexibilities permanent before Sept. 30, the consequences could be devastating for Medicare beneficiaries who rely on telehealth, as they will generally no longer be able to receive telehealth in their home. While there is bipartisan support for permanently enabling the use of telehealth, as with the previous telehealth cliffs, industry stakeholders should continue to prepare yet again for the scenario in which the waivers may not be extended in a timely manner or at all.

HHS recently <a href="https://www.federalregister.gov/documents/2025/08/27/2025-16391/statement-of-delegation-of-authority" target="_blank" rel="noreferrer noopener">delegated</a> the authority to enforce the Confidentiality of Substance Use Disorder Patient Records regulations (Part 2 regulations) to the HHS Office for Civil Rights (OCR). As part of this authority, OCR can now:

Impose civil money penalties for failure to comply with Part 2;

Enter into resolution agreements, monetary settlements and corrective action plans, to resolve indications of noncompliance with Part 2; and

Issue subpoenas related to a Part 2 investigation.

Part 2 has been subject to several updates in recent years, and the &nbsp;finalized <a href="https://www.bakerdatacounsel.com/blogs/the-long-awaited-part-2-modifications-are-finalized-with-new-obligations-for-part-2-providers-and-less-friction-for-sharing-patient-information/" target="_blank" rel="noreferrer noopener">changes</a> to Part 2 require updates to patient consents, penalties, the notice of privacy practices, and breach notification requirements for Part 2 records by Feb. 16, 2026. It is advisable for stakeholders to review their Part 2 materials to ensure compliance with the new requirements.

DOJ Bulk Data Final Rule

As previously <a href="https://www.bakerlaw.com/insights/doj-implements-bulk-personal-data-transfer-restrictions/" target="_blank" rel="noreferrer noopener">analyzed</a> by our colleagues, a wide-reaching <a href="https://www.federalregister.gov/documents/2025/01/08/2024-31486/preventing-access-to-us-sensitive-personal-data-and-government-related-data-by-countries-of-concern" target="_blank" rel="noreferrer noopener">rule</a> (Bulk Data Rule) aimed at addressing threats to national security was issued by the Department of Justice (DOJ) and prohibits access to U.S. bulk sensitive personal data by “countries of concern,” which are defined as China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia and Venezuela, or “covered persons” who are affiliated with the countries of concern. Because the regulations specifically apply to “personal health data”, biometric identifiers and genomic data (among other types of data), careful review of the Bulk Data Rule and its requirements is advisable for health care industry stakeholders. &nbsp;Notably, the definition of “personal health data”&nbsp; under the Bulk Data Rule is much broader than the definition of “health information” under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) that much of the health care industry is accustomed to.&nbsp; The definition of “personal health data” is not limited to data collected and held by providers and health plans, but instead applies to any data related to the past, present or future physical or mental health condition of an individual, and the provision of healthcare or payment for such provision of health care.&nbsp; According to DOJ guidance regarding the Bulk Data Rule, the definition of personal health data even includes logs of exercise habits that are collected by fitness apps.&nbsp; Industry stakeholders should also be aware that the definition of bulk U.S. sensitive personal data includes the data in any format regardless of whether the data is anonymized, pseudonymized, de-identified or encrypted, which is also a significant departure from HIPAA. &nbsp;Finally, there are some notable exceptions to the Bulk Data Rule that are relevant to the health care industry, including exceptions related to data that is transmitted for certain clinical research or as part of transactions related to particular drugs, biological products and medical device authorizations that may need to be taken into consideration as well.

On Sept. 17, Joint Commission partnered with the Coalition for Health AI to release best practices <a href="https://www.jointcommission.org/en-us/knowledge-library/news/2025-09-jc-and-chai-release-initial-guidance-to-support-responsible-ai-adoption" target="_blank" rel="noreferrer noopener">guidance</a> on the responsible use of artificial intelligence (AI) by the U.S. healthcare system. Joint Commission noted in its press release that it intends to develop playbooks, tools and a new voluntary AI certification program. The guidance focused on several key elements that Joint Commission highlighted as necessary to ensure the responsible use of AI in healthcare, including (a) establishing AI policies and governance structures to manage responsible use of AI, (b) developing policies and safeguards to ensure patient privacy and transparency when AI tools are used, (c) promoting data security and data use protections when using AI, (d) utilizing ongoing quality monitoring to evaluate safe performance of AI tools, (e) creating a process for voluntary, blinded reporting of AI safety-related events, (f) identifying and addressing risks and bias in the AI tools, and (g) providing workforce education and training on the use of AI. With the current lack of cohesive federal oversight of AI in the healthcare industry, Joint Commission’s guidance and future playbooks could fill a much-needed gap in assisting healthcare providers with the safe and responsible deployment of AI tools within their organization. At the same time, however, a significant amount of legislation continues to be introduced at the state level that seeks to regulate the use of AI in healthcare. While many of these laws are aimed at limiting any unfair use of AI by insurers, other laws are geared toward regulating the use of chatbots and increasing transparency in the use of AI.

CMS Health Technology Ecosystem Initiative

The HHS Centers for Medicare &amp; Medicaid Services (CMS) recently announced a new <a href="https://www.cms.gov/priorities/health-technology-ecosystem/health-technology-ecosystem" target="_blank" rel="noreferrer noopener">Health Technology Ecosystem</a> initiative aimed at unlocking innovation and modernizing the data flows within the healthcare industry, including among data networks, EHR systems, health app developers, providers and innovators. As part of the initiative, CMS stated that it had <a href="https://www.cms.gov/newsroom/press-releases/white-house-tech-leaders-commit-create-patient-centric-healthcare-ecosystem" target="_blank" rel="noreferrer noopener">secured</a> commitments from 60 companies, including Amazon, Apple, Google and OpenAI, to “lay the foundation for the next-generation digital health ecosystem aimed at improving patient outcomes, reducing provider burden and driving value.” Two main focus areas of the initiative include promoting a <a href="https://www.cms.gov/health-technology-ecosystem/interoperability-framework" target="_blank" rel="noreferrer noopener">CMS Interoperability Framework</a> that will enable sharing information between patients and providers and increasing personalized tools to give &nbsp;patients more access to the information they need to make healthcare decisions.

core/separator

*After the publication of this article, the Medicare telehealth flexibilities expired; please see our updated telehealth analysis <a href="https://www.bakerlaw.com/insights/off-the-cliff-into-the-abyss-medicare-telehealth-coverage-interrupted/" target="_blank" rel="noreferrer noopener">here</a>.

From Crackdowns to Continued Cliffhangers – Health Tech Regulation Is as ‘Healthy’ as Ever

Featured Insights

Related Services

Featured Insights