09 Jun, 2026 |
The regulatory environment for health-related data has grown increasingly fragmented. HIPAA remains the foundation, but state laws like Washington's My Health My Data Act are expanding obligations well beyond traditional covered entities. Tech companies, digital marketplaces, advertising platforms, and others that may not have previously considered themselves subject to health data regulation are now under the microscope.
This Continuing Legal Education (CLE) will share a practical framework for in-house counsel to gauge their organization’s data flows and determine which regulatory regimes apply.
We discuss the distinctions between personal data, health data, PHI, and how compliance obligations differ amongst different types of companies (not just for HIPAA-covered entities). We’ll also address major contractual obligations at these companies like BAAs and DPAs, data subject access requests, records retention and deletion, and more. The CLE wraps with a list of best practices for enterprise-wide data governance and a public Q&A.
With many states expanding their definitions of “health data”, organizations are discovering new compliance obligations they didn’t even know they had. Register to learn about the expanded scope and find where your organization falls on the spectrum.
This CLE is eligible for credit in all 50 states and free to register.
