Breaches under HIPAA and 42 CFR Part 2: New Requirements, New Risk | Compliance Summer Camp 2026

These trainings are Week 6 of 6 in the “Compliance Summer Camp 2026” webinar series.

Session 1: Breach Basics: From Discovery to Notification | Tuesday, August 11 from 3:00-4:00 PM ET

Health centers, like healthcare providers across the country, remain significant targets for cyberattacks and other privacy incidents involving patient information, including protected health information protected under HIPAA and substance use disorder treatment records protected under 42 CFR Part 2. This session will cover the basics of identifying and evaluating potential breaches, including the definition of a breach, risk assessment requirements, notification timelines, and reporting obligations to affected individuals, the U.S. Department of Health and Human Services (HHS), and, where applicable, the media. The presentation will also explore the impact of the 2024 amendments to 42 CFR Part 2 on breach notification for all health centers, including those without a Part 2 program.

Learning Objectives

• Identify what constitutes a reportable breach under HIPAA and 42 CFR Part 2
• Conduct and document a breach risk assessment as required by HIPAA and 42 CFR Part 2
• Understand the timing, content and reporting obligations for notifications to patients, HHS and the media

Session 2: Beyond Breach Basics: OCR Investigations, Litigation and Enforcement | Thursday, August 13 from 3:00-4:00 PM ET

Once a breach is reported, health centers are faced with government investigations, class action lawsuits and questions from the community. This session will walk through OCR’s investigation process into breach reports or complaints, highlighting recent areas of enforcement focus and focusing on building a corrective action plan that limits potential penalties. This session will also address the potential for class action lawsuits and response options. Finally, this session will address practical strategies for engaging with the community and building trust after a breach.

Learning Objectives

• Understand OCR’s investigation process following a reported breach or complaint.
• Identify common compliance deficiencies and enforcement trends arising from healthcare breaches.
• Recognize litigation risks associated with privacy and security incidents, including class action claims

Audience:

• COOs
• Compliance Officers
• Risk Managers
• Clinical Leadership