"[T]he court found that the Security Rule did not require M.D. Anderson to have a 'bulletproof' mechanism, nor was it required to enforce the mechanism 'rigorously.' ... Under the court's pained interpretation of the Privacy Rule, M.D. Anderson's loss of ePHI via theft and loss did not qualify as a disclosure.... [T]he court held that the regulation required OCR to prove that someone outside the covered entity actually received the ePHI, and that OCR had failed to do so here." [Univ. of Texas M.D. Anderson Cancer Center v. HHS, No. 19-60226 (5th Cir. Jan. 14, 2021)]