In August 2024, The Department of Defense (DoD) released a proposed amendment to the Defense Acquisition Regulations Supplement (DFARS) – which provides acquisition policies and procedures for the DoD – that would require a Cybersecurity Maturity Model Certification (CMMC) program to become a required part of the DoD’s contracting process. The CMMC program is a
HHS Continues Focus on Access Rights by Announcing Crackdown on Information Blocking
In August, the Office for Civil Rights (OCR) published guidance relating to individuals’ rights to access their protected health information (PHI) under HIPAA. As we covered in our earlier blog post about the August guidance, the new FAQs came amidst OCR’s continued enforcement focus on its Right of Access initiative, under which the OCR has
The Price You Pay: California Largely Strikes Down Bill Banning Surveillance Pricing
In today’s marketplace, businesses hold vast amounts of consumer data. That data plays a central role in shaping business strategies. One of the most critical aspects of any business strategy is pricing and the process of determining how much to charge for a product or service and to whom. Price discrimination refers to a business
Texas Mini-TCPA Gets a Makeover: What Businesses Need to Know
The Telephone Consumer Protection Act of 1991 (TCPA) is a federal law designed to protect consumers from unwanted telemarketing and intrusive solicitation practices. Many states have also enacted similar state laws governing telephone solicitations, so called “mini-TCPAs.” One such state is Texas, which has had a mini-TCPA in place since 2009.
The Texas mini-TCPA applies
HIPAA Privacy Rule in Focus: OCR Sheds Light on PHI Disclosures and Access Rights
On August 11, 2025, the Office for Civil Rights (OCR) published updated guidance relating to the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (Privacy Rule) in the form of two new FAQs. The FAQs clarify the OCR’s position on (1) permitted disclosures of protected health information (PHI) to value-based care arrangements and (2)
Pennsylvania Attorney General Announces Recent Cyber-Attack: What You Need to Know about Citrix Bleed 2
On August 11, 2025, the Pennsylvania Office of Attorney General (PA AG) issued a statement on its Facebook account regarding a cyber incident that had affected PA AG systems, including its website, email accounts, and phone lines.
The PA AG has not shared a specific cause of the incident. However, security researcher Kevin Beaumont recognized
New Updates to CCPA Regulations: California’s Focus on Automated Decisionmaking Technology, Cybersecurity Audits, Risk Assessments, and More
On July 24, 2025, during a public meeting following public comment, the California Privacy Protection Agency (CPPA) Board unanimously approved amendments to the California Consumer Privacy Act (CCPA). These substantial changes include new obligations for businesses subject to the CCPA. Significantly, the updates emphasize CPPA’s new regulatory focus over AI decision-making and cybersecurity in addition
The Future of the CFPB Open Banking Rule Remains…Open
On July 29, 2025, the Consumer Financial Protection Bureau (CFPB) stated in a legal briefing that it has decided to reconsider an agency rule “with a view to substantially revis[e] it and provid[e] a robust justification.” The federal district court hearing the case granted the motion, thus pausing the lawsuit for now.
The rule at
Privacy Under Pressure: What the NYT v. OpenAI Teaches Us About Data Governance
The rise of large language models (LLMs) such as ChatGPT has created novel legal implications surrounding the development and use of such artificial intelligence (AI) systems. One of the most closely watched AI cases currently is New York Times Co. v. Microsoft Corp., No. 1:23-cv-11195 (S.D.N.Y. filed Dec. 27, 2023), in which the New York
Purl v HHS: Resetting the Reproductive Health Privacy Landscape
Reproductive health privacy is once again in the legal spotlight with a recent federal district court decision that struck down nearly all of a recent rule under the Health Insurance Portability and Accountability Act (HIPAA) that protected reproductive healthcare-related information privacy.
In a ruling issued on June 18, 2025, in Purl v. Department of Health