"Although this case is still working its way through proceedings, this strongly worded opinion calls into question some fundamental principles of OCR's enforcement approach. For example, OCR has consistently asserted that an unauthorized disclosure occurs whenever PHI is publicly accessible through an internet search--regardless of whether it can demonstrate that anyone actually accessed the PHI in that way. It will be harder for OCR to establish privacy rule violations if it has to prove that an unauthorized recipient actually accessed PHI." [Univ. of Texas M.D. Anderson Cancer Ctr. v. HHS, No. 19-60226 (5th Cir. Jan. 14, 2021)]