by Tom Fazio | Aug 18, 2026 | Compliance, HIPAA
In January 2025, HHS published a proposed rule to overhaul the HIPAA Security Rule for the first time since it took effect in 2005. The proposal drew thousands of public comments. HHS has since moved the rule to its long-term agenda, and the federal regulatory agenda...
by Tom Fazio | Nov 4, 2025 | Compliance, Information Security
The New York Department of Financial Services (NYDFS) amended its cybersecurity regulation, 23 NYCRR Part 500, in November 2023 and phased the new requirements in over two years. The final phase took effect on November 1, 2025. For banks, insurers, agencies, and other...
by Tom Fazio | Oct 7, 2025 | Compliance, DD Boards, General News
Ohio’s operating budget, House Bill 96, was signed on June 30, 2025, and included a significant cybersecurity provision for local government. The new Ohio Revised Code section 9.64 took effect on September 30, 2025. It requires every Ohio political subdivision...
by Tom Fazio | Aug 12, 2025 | Compliance, HIPAA
If you read through the HIPAA settlements the HHS Office for Civil Rights (OCR) has announced in 2025, one finding shows up again and again: the organization failed to conduct an accurate and thorough risk analysis. That is not a coincidence. OCR launched its Risk...
by Tom Fazio | Mar 18, 2025 | Business Associates & Others, Compliance, Information Security
When the Department of Labor (DOL) first published cybersecurity guidance for ERISA plans in 2021, many in the industry read it as a retirement plan issue. That reading no longer holds. In Compliance Assistance Release 2024-01, the DOL’s Employee Benefits...
