3.6 Interpreting Regulations and Knowing When to Buy Outside Expertise
Key Takeaways
- The authority hierarchy runs statute, then regulation, then preamble and formal guidance, then FAQs and bulletins, then secondary commentary — and a vendor whitepaper is never authority.
- Guidance can be vacated by a court, as OCR's tracking-technologies bulletin and the 2024 reproductive health rule both were, so a privacy officer must verify that a cited source is still operative.
- A written regulatory interpretation should record the question, the sources consulted with dates, the analysis, the decision, the decision-maker, and the review trigger.
- Outside expertise is warranted when the matter carries privilege, novelty, adversity, scale, or an independence requirement that in-house staff cannot satisfy.
- Retaining outside counsel to direct a forensic investigation is what creates the privilege posture; engaging the forensic firm directly through IT generally does not.
Interpreting Regulations and Knowing When to Buy Outside Expertise
Two outline tasks pair naturally. Task 2.G requires the privacy officer to maintain and apply knowledge of regulations and interpretation of laws. Task 2.H requires the officer to recognize need for outside expertise. The second is the honest counterpart of the first: a competent privacy officer knows a great deal and also knows the boundary of what they should decide alone.
1. The Authority Hierarchy
When two sources disagree, weight them. This ordering resolves the majority of real disputes.
| Rank | Source | Weight | Example |
|---|---|---|---|
| 1 | Statute | Binding; supersedes conflicting regulation | HIPAA, HITECH, CARES Act § 3221, 42 U.S.C. § 1320d-6 |
| 2 | Regulation in the CFR | Binding as written | 45 CFR Parts 160 and 164; 42 CFR Part 2 |
| 3 | Federal Register preamble | Highly persuasive; explains agency intent and answers comments | The 2013 Omnibus preamble on subcontractor liability |
| 4 | Formal agency guidance | Persuasive; reflects enforcement posture but is not law | OCR de-identification guidance; OIG compliance program guidance |
| 5 | FAQs, bulletins, resolution agreements | Indicative of enforcement priorities | OCR Right of Access settlements |
| 6 | State law | Binding where more stringent and not preempted | State breach clocks, shield laws, minor-consent statutes |
| 7 | Secondary commentary | No authority | Law firm alerts, association guides, vendor whitepapers, this guide |
Three rules that follow from the hierarchy:
- Read the regulation before the summary. A surprising share of "HIPAA requires" beliefs inside hospitals trace to a slide deck rather than a CFR section. Pull the text.
- Check whether the source still stands. Guidance is not permanent. OCR's online tracking bulletin was partly vacated in June 2024, and the 2024 reproductive health rule was vacated in June 2025. A citation is only as good as its current status.
- Note effective versus compliance dates. A rule that is effective is not necessarily enforceable yet. The 42 CFR Part 2 Final Rule took effect in April 2024 with a compliance date of February 16, 2026 — a twenty-two-month gap in which the correct answer to "must we comply?" changed.
2. Maintaining Currency Without Drowning
The horizon-scanning sources are covered in section 6.2. What belongs here is the discipline of turning a scan into a decision:
+---------------------------------------------------------------------------------------------------+
| FROM REGULATORY SIGNAL TO ORGANIZATIONAL DECISION |
| |
| 1. CAPTURE Signal enters the log: rule, guidance, enforcement action, court decision, |
| state statute, or accreditor change. Record source, date, and citation. |
| | |
| 2. TRIAGE Does it apply to us? Which entity, which service line, which system? |
| Not-applicable items are logged with the reason, never silently dropped. |
| | |
| 3. ANALYZE What exactly changes? Cite the operative text. Identify effective date AND |
| compliance date. Identify who inside the organization is affected. |
| | |
| 4. DECIDE Written interpretation with a named decision-maker. Escalate to counsel when |
| the criteria in section 4 below are met. |
| | |
| 5. IMPLEMENT Policy edit, control change, training update, system configuration, contract |
| amendment - each with an owner and a due date on the work plan. |
| | |
| 6. VERIFY Confirm the change landed. Add it to the audit plan. Close the log entry. |
+---------------------------------------------------------------------------------------------------+
The Written Interpretation Memo
Every non-obvious regulatory question should produce a short memo, because two years later no one will remember the reasoning and an investigator will ask. Six elements:
- Question presented, stated narrowly and factually.
- Sources consulted, with citations and the date each was retrieved.
- Analysis, including the contrary reading and why it was rejected.
- Decision, stated as an operational rule someone can follow.
- Decision-maker, by name and role, and whether counsel concurred.
- Review trigger — the event or date that would require revisiting the conclusion.
A file of these memos is one of the strongest artifacts a program can hand an investigator. It converts "we thought it was fine" into "we analyzed it, here is the reasoning, and here is who decided."
3. When the Answer Is "Get Help"
Task 2.H is tested as a judgment item: a scenario is presented and the best answer is to bring in an outside expert. Five criteria justify it.
| Criterion | Signal | Typical Expert |
|---|---|---|
| Privilege | The analysis may be adverse to the organization and should be protected | Outside counsel |
| Novelty | No settled interpretation exists; the question is one of first impression | Outside counsel or specialist consultant |
| Adversity | A regulator, plaintiff, union, or media outlet is engaged, or an executive is implicated | Outside counsel |
| Independence | The finding will be disbelieved if produced internally, or a board or regulator requires an external view | Independent auditor or assessor |
| Scale or specialization | The work exceeds internal capacity or requires tooling the organization lacks | Forensic examiner, statistician for expert determination, security assessor |
Matching the Expert to the Problem
- Outside counsel — privileged internal investigations, OCR responses, regulator negotiations, novel interpretation, matters implicating senior leadership.
- Digital forensic examiner — ransomware and exfiltration analysis, evidence preservation, chain of custody, determining what was actually accessed rather than what was accessible.
- Independent auditor or assessor — validating a corrective action plan, satisfying a resolution agreement's independent-monitor obligation, board-requested assurance.
- Statistician or de-identification expert — expert determination under § 164.514(b)(1), which requires a person with appropriate knowledge and experience and cannot be self-certified by the privacy officer.
- Specialist counsel or consultant — multi-state law surveys, cross-border transfers, research and Common Rule intersections, 42 CFR Part 2 in complex delivery systems.
[!IMPORTANT] How privilege is actually created. Privilege does not attach because a document is labeled "privileged." It attaches when counsel — usually outside counsel — engages the expert, directs the work, and receives the findings for the purpose of providing legal advice. If the IT department signs the forensic firm's statement of work directly and the report circulates to operations, the report is very likely discoverable. Decide the privilege posture before the engagement letter is signed, not after the report is written.
The Limits of Privilege
Two boundaries the exam likes:
- Facts are never privileged. Counsel's advice is protected; the underlying facts — who accessed what, when — are not. A breach cannot be concealed by routing the investigation through a lawyer.
- Regulatory obligations run in parallel. Engaging counsel does not pause the 60-day breach notification clock, the duty to mitigate under § 164.530(f), or the obligation to respond to an OCR data request.
A privacy officer must decide whether a proposed data-sharing arrangement with a research collaborator is permissible. A vendor whitepaper says yes, an OCR FAQ suggests caution, and the text of 45 CFR 164.512(i) appears to require an IRB waiver. How should the officer weigh these sources?
A health system suspects that a senior executive directed staff to access a competitor-affiliated physician's medical record. The privacy officer needs a factual investigation that may become adverse to the organization. What is the most appropriate step to establish a privileged posture?
A privacy officer with a strong statistics background proposes to personally perform an expert determination under 45 CFR 164.514(b)(1) so that a research data set can be released as de-identified. What is the principal concern?