PrivacySignal
Healthcare

OCR Clarifies When SUD Records Can be Used to Verify Medicaid Community Engagement Exclusions

HIPAA Journal · · US Federal · Healthcare Privacy

The HHS Office for Civil Rights has released guidance addressing when states may use substance use disorder records to verify whether Medicaid recipients qualify for exemptions from community engagement requirements. The guidance clarifies the conditions under which such sensitive health records can lawfully be accessed for eligibility purposes.

Why this matters: Substance use disorder records get special legal protection for a reason. People avoid treatment when they fear their records will be used against them. Now states running Medicaid work requirements have clearer rules about when they can pull those records to check who qualifies for an exemption. That sounds administrative. It is not. If the line is drawn loosely, people with addiction histories could have sensitive medical information reviewed by government eligibility workers in ways they never anticipated when they sought care. The rules here matter for whether people trust the health system enough to use it.

Who should care: Healthcare professionals · Privacy officers · Compliance · Lawyers

This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.

Analysis

All analysis →

Weekly Editorial Analysis from Experts and Editors

The Attacker Did Not Need to Sleep

Spain received its first reported personal-data breach carried out by an AI agent. The techniques were familiar. The speed and autonomy were not.

· 4 min read Read →

Related stories

Healthcare
HIPAA Journal · · US Federal

Data Breaches Announced by Saber Healthcare & Buchalter

Saber Healthcare, an Ohio-based care provider, and Buchalter, a California law firm, have each announced separate data breaches. Both organizations handle sensitive personal and legal information, making the incidents significant for the individuals they serve.

Who should care: Healthcare professionals · Privacy officers · Compliance

#healthcare Read original →
Healthcare
The Guardian — Privacy · · International

More than 44,000 file legal objections to Palantir NHS platform handling their data

More than 44,000 people in the UK have filed formal legal objections to NHS England's Federated Data Platform, which is built on Palantir technology, demanding it be blocked from processing their personal health data. The campaign has grown alongside broader criticism of Palantir's ties to Israeli military operations and its work supporting ICE deportation efforts in the United States.

Who should care: Healthcare professionals · Privacy officers · Compliance · General readers · AI governance · Policy

#healthcare#ai#privacy Read original →
Healthcare
The Guardian — Tech · · International

RFK Jr outlines expansive vision for collecting US health data at Maha event

Health Secretary Robert F. Kennedy Jr. called for broad collection and sharing of Americans' medical and lifestyle data — from doctor visits to exercise habits — to be analyzed by AI and made available to government and independent researchers, framing it as a response to chronic disease.

Who should care: Healthcare professionals · Privacy officers · Compliance · General readers · AI governance · Policy

#healthcare#ai Read original →
Healthcare Critical
HIPAA Journal · · US Federal

Citrix Patches Actively Exploited NetScaler ADC & NetScaler Gateway Vulnerabilities

Citrix has released patches for two critical zero-day vulnerabilities in NetScaler ADC and NetScaler Gateway that are being actively exploited in the wild. The flaws affect widely used network access and application delivery products common in enterprise and healthcare environments.

Who should care: Healthcare professionals · Privacy officers · Compliance

#healthcare#security Read original →
Healthcare
HIPAA Journal · · US Federal

Astrana Health Notifies SEC About Social Engineering Incident

Astrana Health, a managed care services company serving healthcare providers, has filed a disclosure with the SEC reporting a social engineering incident. The filing indicates the company experienced a security event in which attackers likely manipulated people rather than systems to gain access.

Who should care: Healthcare professionals · Privacy officers · Compliance

#healthcare Read original →
Healthcare
Military Times · · US Federal

Congress presses Oracle for answers on VA’s $17 billion EHR increase

Congressional lawmakers are demanding that Oracle explain why the Department of Veterans Affairs raised the ceiling on its electronic health record contract by $17 billion. The contract, already one of the largest in federal health IT history, is now facing direct scrutiny from legislators.

Who should care: Healthcare professionals · Privacy officers · Compliance

#healthcare Read original →