Privacy rule changes

The rules behind your privacy documentation, and how they moved.

Over the past decade more than 20 state and federal mandates have changed what Privacy Notices must say. You can try and chase them down in your spare time, or you can let us do the legwork.

Fix my notice nowSee how it works

What actually changed, and why it caught people out

The last two years are a useful illustration of why an annual set-and-forget approach fails.

March 2024Washingtonhealth data policyJuly 2024Texasnotice contentsJuly 2025Minnesotahealth data consentFebruary 202642 CFR Part 2disclosuresYour noticeAll still in forceMarch 2024Washington health data policyJuly 2024Texas notice contentsJuly 2025Minnesota health data consentFebruary 202642 CFR Part 2 disclosuresYour noticeAll still in force

  1. March 2024

    Your privacy policy alone is not sufficient. Washington now requires a second one, just for health data, with its own link on your homepage. And it isn’t only the Attorney General you answer to: consumers can take you to court themselves.

  2. July 2024

    Texas made the notice itself the obligation. It must name the categories of personal data you process, including sensitive data, why you process it, who you share it with, and how a consumer can appeal when you deny their request. Leave a piece out and each violation can cost up to $7,500.

  3. July 2025

    Minnesota went after the data HIPAA leaves behind. Health information on your website, in your marketing, anywhere HIPAA doesn’t reach, now needs consent. If your systems profile people to make decisions about their healthcare, education, or employment, they can question the result and demand an explanation. And the grace period for fixing mistakes is over.

  4. February 2026

    You may hold substance use disorder records without realizing it. They arrive through referrals, care coordination, and integrated care, and every HIPAA covered entity holding them had to update its notice. Under 42 CFR Part 2, you have specific obligations, and OCR is already taking complaints.

Year after year, the changes keep coming.

Federal regulation 42 CFR Part 2. Washington's My Health My Data Act. Nevada SB 370. Minnesota's consumer health data provisions. California AB 45. New York's proposed health information privacy act. All of these changes can reach an organization that handles health information, from medical practices to law firms and schools.

Your privacy documentation does not hold still.

There will be a next one.

Every entry above was a deadline someone had to spot, read, and act on, and most practices missed at least one. When the next one lands, you can hear about it from us — in an email with the corrected documents already attached. Updates from $395, monitoring from $39 a month.

Fix my notice now

Blackwood Operations Inc provides compliance and operations consulting to small and mid-sized organizations. Compliance is a document maintenance and regulatory monitoring service. Blackwood Operations Inc is not a law firm and does not provide legal advice. Documents delivered under this service should be reviewed by your own legal counsel before adoption.