Last month, the National Academies of Science, Engineering, and Medicine (“NASEM”) issued a report discussing the inclusion of pregnant and lactating people in clinical research and the health impacts of inadequate data from research involving this subpopulation. Titled “Advancing Clinical Research with Pregnant and Lactating Persons: Overcoming Real and Perceived Liability Risks,” the report came as a response to Congress calling upon NASEM to examine the real and perceived prevalence of legal liability resulting from including these research subjects in clinical trials. Overall, the report concluded that legal liability for including pregnant and lactating persons in research is very limited, but that perceptions of potential liability and a lack of explicit guidance for including this population safely have created real barriers to their inclusion.  In response, the report provides recommended actions for Congress, the Food and Drug Administration (“FDA”), the National Institutes of Health (“NIH”), and the Office of Human Research Protections (“OHRP”) to take to enhance the inclusion of this population in clinical trials, thereby enhancing data around the safety and efficacy of approved drug products for pregnant and lactating persons.  Study sponsors and institutions conducting research should continue to monitor developments in this area, including guidance from FDA.

Covered entities, business associates, and any entities that collect health information about consumers online should carefully review the latest joint letter from the Office for Civil Rights (OCR) and the   Federal Trade Commission (FTC). On July 20, 2023, the agencies sent a joint letter to approximately 130 hospital systems and telehealth providers warning them about “serious privacy and security risks related to the use of online tracking technologies” such ad Google Analytics and Meta/Facebook Pixel. That letter was subsequently shared publicly and should be reviewed by any entity subject to regulation by either agency.   

Covered entities, business associates, and any entities that collect health information about consumers online should carefully review the latest joint letter from the Office for Civil Rights (OCR) and the   Federal Trade Commission (FTC). On July 20, 2023, the agencies sent a joint letter to approximately 130 hospital systems and telehealth providers warning them about “serious privacy and security risks related to the use of online tracking technologies” such ad Google Analytics and Meta/Facebook Pixel. That letter was subsequently shared publicly and should be reviewed by any entity subject to regulation by either agency.   

A new Florida law will require certain Florida-licensed providers to ensure that patient information is physically maintained only in the continental United States and its territories or in Canada. Florida SB 264, which goes into effect July 1, 2023, amends the Florida Electronic Health Records Exchange Act, adding a ban on offshoring health information that goes beyond the requirements under HIPAA and most other generally applicable health privacy and security laws. Florida licensees to which the new requirements apply will need to attest upon initial licensure and any renewals that they are in compliance with the new requirements. Applicable licensees will also be required to ensure that no individual or entity with a controlling interest in the licensee has an interest in an entity that has a business relationship with certain foreign countries.

In response to concerns about the confidentiality of protected health information (PHI) related to reproductive health care less than one year after Dobbs v. Jackson Women’s Health Organization decision, and the prospect of such PHI being weaponized by states and used against patients, the U.S. Department of Health & Human Services Office for Civil Rights (OCR) has proposed amendments to the HIPAA Privacy Rule to protect that information.

Covered Entities and Business Associates should promptly and carefully review their use of online tracking technologies on their websites and mobile apps following a bulletin (Bulletin) published by the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) last week.  The Bulletin addresses multiple facets of compliance with HIPAA when using online third-party tracking technologies (Tracking Technologies).  In doing so, OCR significantly expands its interpretation of the definition of Protected Health Information (PHI) to include, in some instances, identifiable information gathered by Tracking Technologies where a user visits a website and does not interact with the entity in any other way. In its Bulletin, OCR interprets the act of an individual visiting a website as evidence of a relationship or anticipated future relationship between the visitor and the entity.