HIPAA privacy and security
Trade and geopolitical risk functions handling cross-border health data, employee medical records, or protected health information in M&A due diligence sit squarely inside HIPAA's enforcement perimeter, regardless of their primary industry classification. The U.S. Department of Health and Human Services Office for Civil Rights and the Federal Trade Commission both carry active enforcement authority here, with OCR's 2024 updates to the HIPAA Privacy Rule on reproductive health information adding new documentation obligations that touch compliance workflows well beyond traditional healthcare. Teams are reviewing business associate agreements and data-sharing arrangements now, before the December 2024 compliance date hardens.
Watch
- OCR's reproductive health data amendment: December 2024 compliance deadline approaching
- FTC enforcement actions against non-HIPAA-covered entities handling health data
- Business associate agreement gaps surfacing in cross-border M&A data room reviews
- State-level health privacy laws diverging from federal HIPAA floor in California, Virginia, Washington
Recent material activity in Trade & Geopolitical Risk
Active monitoring in place across Trade & Geopolitical Risk. Material developments related to hipaa privacy and security will appear here as they are published.