March 5, 2026 · HIPAA · OCR Enforcement
OCR settles with a business associate over a breach affecting 15 million people
The HHS Office for Civil Rights announced a resolution agreement with MMG Fusion, LLC, a Maryland software vendor that acts as a HIPAA business associate. An unauthorized actor accessed MMG systems in December 2020, and protected health information later appeared on the dark web. OCR found that MMG never conducted an accurate and thorough risk analysis and failed to notify the covered entities affected by the breach.
MMG paid $10,000, a figure OCR set after weighing the company's financial condition, and accepted a three-year corrective action plan. This is OCR's twelfth action under its Risk Analysis Initiative. For expert work it reinforces that business associates carry direct Security Rule and breach-notification duties, and that the 60-day notification clock runs from discovery.
Primary source: HHS Office for Civil Rights press release
June 18, 2025 · HIPAA · Litigation
Federal court vacates the 2024 HIPAA Reproductive Health Privacy Rule nationwide
In Purl v. U.S. Department of Health and Human Services, the U.S. District Court for the Northern District of Texas set aside the 2024 HIPAA rule that had added special protections for reproductive health care information. The court held that HHS exceeded its statutory authority and improperly interfered with state reporting laws, including child-abuse reporting.
The vacatur is nationwide, so covered entities and business associates are no longer bound by the rule's attestation requirement for certain requests, with a narrow exception tied to changes for 42 CFR Part 2 in notices of privacy practices. The core HIPAA Privacy Rule obligations remain fully in force.
Primary source: HHS HIPAA and Reproductive Health page
March 31, 2025 · FDA · Diagnostics
Court strikes down the FDA rule regulating laboratory developed tests
The U.S. District Court for the Eastern District of Texas vacated FDA's 2024 final rule that treated laboratory developed tests as medical devices subject to FDA oversight. In consolidated cases brought by the American Clinical Laboratory Association and the Association for Molecular Pathology, the court held that FDA lacks authority under the Federal Food, Drug, and Cosmetic Act to regulate these in-house testing services, an area Congress addressed through CLIA.
The decision erased the rule's phased compliance deadlines. Laboratories offering these tests remain regulated under CLIA. The ruling is also a notable early application of the Supreme Court's Loper Bright decision on agency authority.
Primary sources: FDA Laboratory Developed Tests page and Congressional Research Service report LSB11312
January 6, 2025 · HIPAA · Rulemaking (pending)
OCR proposes the first major HIPAA Security Rule overhaul in two decades
OCR published a notice of proposed rulemaking in the Federal Register that would substantially rewrite the HIPAA Security Rule. The proposal would remove the distinction between required and addressable safeguards, making nearly all of them mandatory, and would add explicit requirements for encryption of electronic protected health information, multi-factor authentication, vulnerability scanning, and penetration testing.
The public comment period closed March 7, 2025. As of this update OCR has not issued a final rule, and the proposal remains under review, so it is not yet a compliance obligation. It signals the direction of federal healthcare cybersecurity expectations.
Primary source: Federal Register notice of proposed rulemaking
December 1, 2023 · Expert Testimony
Amended Federal Rule of Evidence 702 raises the bar for expert admissibility
The amendment to Federal Rule of Evidence 702 took effect on December 1, 2023. It clarifies that the party offering expert testimony must show, by a preponderance of the evidence, that each admissibility requirement is met, and that the expert's opinion reflects a reliable application of the methods to the facts of the case.
The change responds to courts that had treated expert testimony as presumptively admissible or had sent reliability questions to the jury. Federal courts have applied the clarified gatekeeping standard since it took effect. For expert witnesses, it puts a premium on documenting methodology and showing that the method fits the specific facts.
Primary source: U.S. Courts, Federal Rules of Evidence (December 1, 2023)
Last updated July 2, 2026.
These entries are general information about publicly reported legal developments. They are not legal advice, and they do not create an attorney-client or expert-engagement relationship. Court decisions can be appealed or stayed, and rules can change. Confirm current status against the cited primary source before relying on any item. Andrew Hillman works under retaining counsel and is not a licensed attorney.