Health-ISAC Hacking Healthcare® 7-18-2024

Welcome back to Hacking Healthcare®

U.S. Supreme Court Decision Likely to Impact Cybersecurity Regulations 

On June 28, SCOTUS released its decision on Loper Bright Enterprises v. Raimondo that reversed an earlier SCOTUS ruling in Chevron v. Natural Resources Defense Council.^[ii] The result of this decision will likely have momentous effects on the federal regulatory landscape for years to come and may invalidate or require the revision of existing cybersecurity and privacy regulations that affect the Healthcare and Public Health (HPH) sector.

Before we begin, please note that the authors of Hacking Healthcare® are not lawyers and that a detailed legal analysis is beyond the scope of this newsletter. For our purposes, the brief overview of the two cases provided below focuses on the legal precedent that was set after the Chevron decision in 1984, and the generally accepted understanding of what the Loper Bright Enterprises case means for challenges to federal regulations.

Why was “Chevron Deference” Important?

The SCOTUS decision in Chevron v Natural Resources Defense Council established which became known as “Chevron deference” or the “Chevron doctrine.”

This deference meant that when U.S. courts heard legal challenges to federal agency regulations or enforcement actions, the courts were required to “defer” to the agency’s interpretation of a statute (i.e., a law passed by Congress) as long as the agency’s interpretation was “permissible.” As a result, when congressionally passed laws are ambiguous, and the agency interpretation was reasonable, a federal agency had considerable discretion to determine the scope of its authority under the law to establish and enforce regulations.

For regulatory agencies within each presidential administration, this meant they were often able to pursue policy aims through creative but plausible interpretations of the law. For Congress, this meant that they did not necessarily need to be subject matter experts and could pass laws that were not overly prescriptive, relying on agencies to fill in the details. For industry or advocacy groups litigating federal regulations, it meant a more difficult time overturning or modifying regulations and enforcement decisions in court.

SCOTUS Ends Chevron Deference

The recent SCOTUS decision in Loper Bright Enterprises v. Raimondo essentially puts an end to Chevron deference and ushers in a new paradigm where the courts will have greater say in how ambiguous laws should be interpreted. As the Center for Cybersecurity Policy and Law describes it “The ruling will be used by courts in deciding cases that challenge whether a regulation exceeds Congressional authority” and that “[t]he ruling applies to both existing and future regulations.”^[iii]

Action & Analysis
**Included with Health-ISAC Membership**