Privacy

California Governor Gavin Newsom recently signed a series of bills intended to protect workers from the impact of AI, automated technologies, and AI-assisted surveillance.

The legislation follows the Governor’s Executive Order issued in May 2026, which established a policy framework intended to help California anticipate and manage workforce disruption caused by AI.…

The U.S. Department of Health and Human Services has pushed back final action on its proposed overhaul of the HIPAA Security Rule from May 2026 to July 2027, giving covered entities and business associates additional time to prepare for what would be the first major update to the Security Rule since 2013. Employers that sponsor self-insured health plans should take note of the delay and consult with ERISA counsel on next steps to ensure their plans are in compliance.

The proposed rule, published in the Federal Register on January 6, 2025, would eliminate the distinction between “required” and “addressable” implementation specifications, mandate multi-factor authentication, expand encryption requirements, require comprehensive technology asset inventories and network mapping, extend documentation requirements, and impose detailed incident response and disaster recovery planning obligations, among other significant changes.…

Employers that sponsor self-insured health plans should note that the Department of Health & Human Services (HHS) last week rescinded its prior guidance on Gender Affirming Care, Civil Rights, and Patient Privacy, originally issued on March 2, 2022.

The rescission is in response to Executive Order 14187, which directed HHS to rescind the guidance.

The…

Yesterday, President Trump issued an Executive Order aimed at ending Diversity Equity and Inclusion (DEI) efforts by federal and private employers.: Ending Illegal Discrimination And Restoring Merit-Based Opportunity – The White House

In the federal sector, the Order dismantles the federal contractor affirmative action program and bars the Office of Federal Contract Compliance Programs from…

HIPAA covered entities, including employer sponsored health plans, and their business associates, must train employees who have access to protected health information.

Moreover, recent HIPAA settlement agreements with the Office of Civil Rights (OCR) have emphasized the importance of updating training materials and providing regular training to employees.

See here for a recent settlement along…