On May 31, the Ninth Circuit Court of Appeals published an opinion in Bristol SL Holdings, Inc. v. Cigna Health and Life Insurance Company, which has significant implications for the healthcare industry, most notably by clarifying the broad scope of the Employee Retirement Income Security Act’s (ERISA) preemption of state law causes of action arising from pre-service coverage communications between medical providers and health plan administrators.

Yesterday, the Consumer Financial Protection Bureau (CFPB or Bureau) announced it has finalized a rule outlining the qualifications to become a recognized industry Standard Setter body (Standard Setter Rule). These bodies will be instrumental in issuing standards that assist companies in complying with the forthcoming Personal Financial Data Rights Rule under Section 1033 of the Consumer Financial Protection Act (Section 1033 Rule). The Standard Setter Rule outlines the attributes that these bodies must exhibit to gain recognition from the CFPB. It also provides a comprehensive guide detailing the application process for recognition and the CFPB’s evaluation methodology.

The Consumer Financial Protection Bureau (CFPB or Bureau) has issued a circular warning covered persons that including unlawful or unenforceable terms and conditions in consumer contracts can violate the prohibition on deceptive acts or practices in the Consumer Financial Protection Act (CFPA).

On June 3, the Consumer Financial Protection Bureau (CFPB or Bureau) issued its final rule requiring covered nonbanks to register enforcement orders, and it is a doozy. Not only will covered nonbanks be required to register public orders issued by agencies and courts with the CFPB, but they will have to go back to 2017. And not only will the CFPB publish the orders, but a large subgroup will have to certify on a yearly basis their full compliance with the orders or make a self-disclosure to the CFPB of any compliance failures. This rule has obvious major consequences for any covered person caught in its web, making the exact ambit of the rule crucial. Given the final rule clocks in at a whopping 486 pages, this post will attempt to provide a roadmap through the rule, focusing on what is required and who is covered.

Dear Mary,

I work in the IT department of a mid-sized company that recently detected a security incident. Everyone is freaking out – minus me. My manager asked our IT team to investigate the incident. But the incident is already contained, and business is back to normal. Why do we need to investigate further? Like seriously, why? And if we do need to investigate further, should I be doing this? I’ve been in IT for a while, and I have never been in this situation before.

– Forensic Forgoer in Florida

On May 30, the Consumer Financial Protection Bureau (CFPB or Bureau) issued a request for information (Request) regarding alleged “junk fees” in closing costs charged by mortgage lenders and related settlement service providers. The Bureau is accepting public comments until August 2, 2024.

On May 29, the Department of Veterans Affairs (VA) announced a targeted foreclosure moratorium on VA-guaranteed loans intended to allow servicers sufficient time to implement the Veterans Affairs Servicing Purchase (VASP) program. Servicers may begin implementing the VASP program beginning May 31, 2024, and the VA expects servicers will fully implement the program no later than October 1, 2024.

We are pleased to introduce ‘Dear Mary,’ a new advice column from Troutman Pepper’s Incidents + Investigations team. This column will answer questions about anything and everything cyber-related — data breaches, forensic investigations, responding to regulators, and much more. ‘Dear Mary’ goes beyond the articles, podcasts, webinars, and other content we produce, as we are responding directly to your questions with concise, practical answers. ‘Dear Mary’ can be found here on the firm website, and direct links can be found on our Privacy + Cyber related blogs and newsletters.

According to a recent report by WebRecon, court filings under the Fair Debt Collection Practices Act (FDCPA) and Fair Credit Reporting Act (FCRA) and complaints filed with the Consumer Financial Protection Bureau (CFPB) were all up for the month of April. Only court filings under the Telephone Consumer Protection Act (TCPA) were slightly down. Still, year-to-date everything is up by double digits compared to 2023.