Health-care privacy is at a crossroads. For almost 20 years, the health-care industry has addressed the requirements of the HIPAA Privacy and Security Rules, building reasonable and appropriate compliance programs from an uncertain and awkward beginning.

The stability has been important, and the important choices made in the HIPAA rules to both protect individual privacy and allow the health-care system to work effectively generally have been a positive for consumers and the industry. But there always have been gaps in HIPAA’s scope, and they are becoming more significant.

Originally published in Bloomberg Law - December 9, 2020.