Lessons from 2017 Enforcement Actions and Guidance
Regulators including the FTC, the Department of Health and Human Services Office of Civil Rights (OCR) — the agency responsible for enforcing the HIPAA rules for protected health information (PHI) — and state attorneys general have issued guidance and announced a number of settlements in data security cases that are instructive about measures that organizations can take to reduce the potential for a data breach or, if a breach does occur, provide appropriate notice.











