• A Virtual Event
• Tuesday, November 10, 2026
• 9:00 am - 4:30 pm CT
• Click here for more info

MINNEAPOLIS, MN, USA -- HEALTHCARE UPDATE NEWS SERVICE -- SEPTEMBER 29, 2026: This virtual conference is designed to provide you with the clarity and foresight you need to make confident privacy decisions in a rapidly changing regulatory environment. You'll get guidance on navigating enforcement trends, responding effectively to new privacy regulations, and avoiding costly missteps that can put your organization—and your reputation—at risk.

If your role requires you to reduce exposure, strengthen trust, and demonstrate privacy leadership, this conference equips you with practical insight you can apply immediately. You'll come away with an understanding of emerging and critical issues, and ways to adapt your privacy efforts to stay compliant.

You'll also earn Compliance Certification Board (CCB)® continuing education units (CEUs) from the convenience of your home or office.

AGENDA
8:55 - 9:00 AM	Welcome and Announcements
9:00 - 10:00 AM	Update from the HHS Office for Civil Rights Timothy Noonan Deputy Director, Office for Civil Rights, Health Information Privacy Division, US Department of Health and Human Services, Washington, DC Intermediate Understand recent OCR health information privacy rulemakings and guidance Analyze recent trends in large HIPAA breaches reported to OCR Identify recent OCR HIPAA enforcement actions, priorities, and enforcement initiatives Learn about available resource to improve cybersecurity and HIPAA Security Rule compliance
10:00 - 10:15 AM	Break
10:15 - 11:15 AM	AI, HIPAA, and Data Governance: Managing Privacy Risks in Emerging Technologies Chandra Stephenson Senior Manager, Health Industries Advisory, PwC, Lebanon, IN Intermediate Identify HIPAA risks associated with AI technologies Strengthen vendor oversight for emerging technology tools Integrate privacy controls into AI governance frameworks
11:15 - 11:30 AM	Break
11:30 - 12:30 PM	Navigating 42 CFR Part 2 and Information Blocking: Rules, Data Sharing, and System Capabilities Andrew Mahler, JD VP, Privacy, Compliance, and Audit, Clearwater, Richmond, VA Intermediate Explain the key requirements of 42 CFR Part 2 and the Information Blocking Rule and how they apply to the exchange of health information Distinguish between information that must be shared, may be withheld, or requires additional consent or safeguards Evaluate health information technology system capabilities and workflows that support compliant information sharing while protecting substance use disorder records
12:30 - 1:00 PM	Mid-Conference Break
1:00 - 2:00 PM	"But the Information Is De-Identified!?" Unpacking the Misunderstandings Around HIPAA De-Identification Mark J. Fox, CHC ,CHPC, CHRC Privacy and Research Compliance Officer, American College of Cardiology, Washington, DC Thora A. Johnson, JD Partner and Co-chair, Life Sciences Group, Orrick Herrington & Sutcliffe LLP, Washington, DC Basic Discuss the permissible methods of de-identification under HIPAA Examine effective strategies for educating individuals on de-identification including benefits and limitations Explore evolving uses of de-identified data sets and associated risks/benefits
2:00 - 2:15 PM	Break
2:15 - 3:15 PM	Before the Breach: What Privacy Officers Need to Understand About Cybersecurity Operations Cyrus J. Walker III Founder & Chief Executive Officer, Data Defenders, Chicago, IL Intermediate Describe how cybersecurity failures become privacy breaches and what the detection layer beneath PHI protection looks like operationally Identify warning signs that a healthcare organization's cybersecurity posture is insufficient to sustain HIPAA and breach notification obligations Apply a governance framework for evaluating cybersecurity operations as a prerequisite to privacy program integrity
3:15 - 3:30 PM	Break
3:30 - 4:30 PM	Into the Light: A Dark Web HIPAA Enforcement Case Study Laura Seeton, MLS HIPAA Privacy Officer, Northern Arizona University, Flagstaff AZ Intermediate Analyze OCR's MMG Fusion enforcement action to show the link between investigation failures and HIPAA violations across multiple Rules Identify investigation lapses risk analysis, disclosure assessment, and breach notice, which created a silent incident into an enforcement case Apply lessons from the MMG Fusion settlement to design defensible privacy investigations before incidents escalate to enforcement
4:30 PM	Adjournment