Privacy

A Unified Agenda entry shows HHS planning updates to its Privacy Act regulations, including changes affecting access to medical records and removal of duplicative FDA privacy regulations. The item signals forthcoming rulemaking that could alter how individuals access records and how HHS aligns agency privacy rules. It is distinct from previously published privacy and FDA software posts because it centers on departmentwide Privacy Act regulatory revisions rather than data-sharing ethics or device-related guidance.

CMS issued a request for information on increasing health care resiliency that explicitly addresses ransomware, cyberattacks, patient data protection, and safeguarding health information across digital infrastructure. The notice frames privacy as part of operational resilience in the health sector, linking continuity of care with stronger protection for sensitive patient data. It is materially distinct from previously covered FDA software and health AI items because it focuses on systemwide resiliency and protection of health information from cyber threats.

DOJ announced indictments on October 13, 2026 in a remote IT worker conspiracy that affected more than 70 U.S. companies, including healthcare entities. The case underscores privacy and security risks tied to insider access, remote hiring, and unauthorized handling of company and potentially sensitive health-related data. For healthcare organizations, it highlights the importance of identity verification, access controls, and monitoring to reduce exposure from deceptive staffing schemes.

ASPR TRACIE updated its healthcare cybersecurity topic collection on October 9, 2026, bringing together current HHS and sector resources on cyber threats, ransomware preparedness, and protection of health information systems. For privacy-focused readers, the update is relevant because it consolidates practical material on reducing risks to sensitive health data and improving organizational readiness. The collection serves as a centralized reference point for healthcare entities reviewing cyber and information protection practices.

NIH announced an October 9, 2026 seminar focused on privacy-preserving genomic collaboration. The seminar highlights federated and cryptographic approaches that can support data sharing and reuse without exposing raw biomedical records, making it directly relevant to privacy, controlled access, and research governance. The event points to technical methods for balancing scientific collaboration with protections for sensitive genomic data.

CMS announced $20 million for rural North Carolina investments in telehealth, healthcare technology, electronic health records, and cybersecurity. From a privacy perspective, the announcement highlights the need to secure patient data as providers expand digital infrastructure and remote care tools. The item is distinct in its focus on North Carolina and on technology upgrades tied to telehealth access.

CMS announced nearly $23 million for Delaware rural health centers to support electronic medical record upgrades, remote patient monitoring, care coordination, and cybersecurity improvements. The privacy significance lies in strengthening the security of digital health systems that handle patient information while expanding connected care. The funding links access improvements with more resilient data protection practices in rural healthcare settings.

This CMS fact sheet outlines operational anti-fraud controls for the Federal Marketplace, including restrictions on broker access, electronic consumer authorization, and stronger identity and application checks. The measures are relevant to privacy because they aim to reduce unauthorized use of personal data in enrollment and account changes. The document adds implementation detail beyond the related press announcement.

Published on September 17, 2026, this peer-reviewed article examines how open health data can be governed across biomedical research, healthcare, and public health while addressing privacy, equity, and trust. It emphasizes controlled access and ethical governance as key mechanisms for balancing data sharing with protection of sensitive information. The paper contributes a cross-sector privacy framework relevant to researchers, health systems, and public health institutions.

On September 15, 2026, the FTC announced that it withdrew its 2021 policy statement on breaches involving health apps and connected devices, describing that earlier statement as obsolete. The action signals a change in how the agency frames privacy and breach oversight for digital health technologies. For organizations handling sensitive health data outside traditional clinical settings, the move is a notable federal privacy development to watch.

FDA published a meeting notice seeking public input on future medical device regulatory science. While the notice is broad, it is relevant to privacy because connected, software-driven, and sensor-based devices depend on governance for data handling within digital health systems. The agenda-setting process may influence how privacy and cybersecurity questions are addressed in device development and oversight.

WHO’s event page for the third meeting of the Global Initiative on AI for Health highlights privacy-preserving evaluation approaches that keep clinical data under institutional control while models are assessed securely. This is relevant to privacy because it points to governance and technical methods that reduce the need to centralize sensitive health data. The meeting suggests continued international interest in evaluating health AI without broad data sharing.

The FTC updated its case page for an enforcement action alleging that a telehealth company shared sensitive health information with advertising platforms. The matter is notable for privacy because it centers on handling of health-related data in a consumer-facing digital care setting. It also signals continued regulator focus on how telehealth firms disclose, use, and share sensitive information for marketing and advertising purposes.

FDA requested input for its 2026 report on non-device software functions, covering areas such as electronic patient records and software that transfers or displays data. The request is privacy-relevant because these functions often involve the handling, movement, and presentation of sensitive patient information, even when they are not regulated as medical devices. It also highlights patient-safety implications tied to data management tools that sit outside traditional device oversight.

ASTP/ONC’s HTI-3 Final Rule updates federal health IT policy on information blocking, including privacy-related changes. The rule adds a new Protecting Care Access Exception and revises provisions connected to reproductive health information, which is significant for how providers, developers, and health information networks handle sensitive data requests and disclosures. For privacy watchers, this is a notable regulatory development affecting access, permitted restrictions, and compliance expectations in electronic health information exchange.

FDA’s January 2026 final guidance clarifies which clinical decision support software functions are excluded from device regulation. While focused on regulatory scope, the guidance matters for privacy because it helps define oversight boundaries for software that uses, analyzes, or presents patient data in clinical settings. The document is relevant to ongoing questions about digital health data use, accountability, and when federal requirements attach to software functions handling sensitive health information.