Anna Schall Kreamer

Over the past decade, the United States health care industry has experienced a significant increase in cyberattacks, including ransomware attacks, hacking incidents, and AI-driven threats, targeting electronic protected health information (also known as “ePHI.”) In response, on December 27, 2024, the Office for Civil Rights of the U.S. Department of Health and Human Services initiated a Notice of Proposed Rulemaking to the Security Rule of the Health Insurance Portability and Accountability Act.

Just as organizations use artificial intelligence to monitor the workplace, they must also monitor themselves and, as a result, reshape their risk, governance, and security expectations. AI must be managed from two directions: from the inside out, ensuring that organizations use AI in ways that preserve trust, and outside in, securing the AI systems against external threats.

The California Invasion of Privacy Act is testing modern data privacy boundaries. Data privacy laws across the United States have expanded greatly over the past five years. Comprehensive laws have been adopted by more than 20 states, and we have seen a corresponding rise in data privacy litigation. However, many of these lawsuits are not arising under new statutes as might be expected; instead, plaintiffs rely on decades-old wiretapping laws, most prominently the California Invasion of Privacy Act.