Digital Media and Data Privacy Law Blog

Over the past months, my experiences with physician practices have made me realize that many practices do not understand how HIPAA applies to subpoenas for medical records.  More worrisome, I suspect that many practices nationwide routinely violate HIPAA when they receive a subpoena.

Here’s what I’ve observed:  Practices receive state court subpoenas that are signed by lawyers and that demand the production of medical records, and the practices automatically assume they must produce the records.  This is a dangerous assumption—the production of the records may very well ... Read More 

Suffering a data breach is bad enough. As often as it appears to happen, companies that are affected by a breach still shoulder a considerable burden. Management must stop the trains to identify the cause and scope of the breach—and then prepare for the aftermath. Lawyers are involved. The company’s brand is at risk. And the costs—employee time, legal fees, security consultants—quickly escalate.

But what if you determine that your company didn’t really need the information that was exposed? Suppose you find out that the breach involved a file that contained ... Read More 

Ed. Note: This entry is cross posted from Cady Bar the Door, David Smyth's blog offering Insight & Commentary on SEC Enforcement Actions and White Collar Crime.

We’re behind on this, but better (a little bit) late than never. Last month the SEC’s Office of Compliance, Inspections and Examinations released the first results of its Cybersecurity Examination Initiative, announced in April 2014. As part of the initiative, OCIE staff examined 57 broker-dealers and 49 investment advisers to better understand how these entities “address the legal, regulatory, and compliance ... Read More 

Ed. Note: This entry is cross posted from Cady Bar the Door, David Smyth's blog offering Insight & Commentary on SEC Enforcement Actions and White Collar Crime.

When I was at the SEC and online broker-dealers’ customers were the victims of hacking incidents, I used to wonder, why don’t the broker-dealers require multi-factor authentication to gain access to accounts? It was a silly question. I knew the answer. Multi-factor authentication is a pain and nobody likes it.

Do you know what it is? Here’s what Wikipedia says, so it must be true:

Multi-factor authentication ... Read More 

Unless you have been completely disconnected from all media, you are probably already aware that on Sunday, February 15, 2015, the FAA announced the release of its long-awaited rules to govern commercial sUAS (small unmanned aircraft systems) operations in the United States. The FAA’s proposed sUAS rules arrived like a barely-late valentine or box of candy, with the recipients hoping to read loving prose and enjoy fresh, rich chocolates. At this point, of course, the rules are merely a proposed regulatory regime (as embodied in a document that is called a “Notice of Proposed ... Read More 

You have probably heard about the recent data breach at Sony; after all, it’s not often that Kim Jong Un and Angelina Jolie are mentioned as part of the same story. Unlike other recent high profile hacks, the recent Sony hack appears to be somewhat different in character: the hackers appear to care most about using the information stolen from Sony to bring shame and scorn to the company, rather than for their own pecuniary gain.

And the story appears to continue down the proverbial rabbit hole, with reports of a tongue-and-cheek offer of investigative cooperation from the North Koreans ... Read More 

by Forrest Campbell, Health Law Attorney, fcampbell@brookspierce.com 

In December 2014, the U.S. Department of Health and Human Services ("HHS") and Anchorage Community Mental Health Services ("ACMHS") settled alleged HIPAA violations for $150,000.

Don't be misled--this settlement is not important just for parties subject to HIPAA. It's important to anyone who maintains confidential information in electronic form.

Here's what happened according to HHS. ACMHS failed to regularly update its IT resources with available patches, and ACMHS used outdated, unsupported ... Read More 

by Forrest Campbell, Health Law Attorney, fcampbell@brookspierce.com

In light of the Ebola outbreak, HHS's Office for Civil Rights ("OCR") issued a bulletin to accomplish two things: (i) ensure that HIPAA covered entities and business associates understand how PHI may be shared in emergency situations, and (ii) remind parties that HIPAA's privacy requirements are not set aside during an emergency. The bulletin can be accessed through this ... Read More 

In remarks delivered at the 2014 BAA Marketing Law Conference, Jessica Rich, director of the FTC’s Bureau of Consumer Protection, confirmed that, when it comes to privacy, the FTC is focusing on mobile technologies in a big way.   

This is nothing new—the FTC has brought a number cases in the past couple of years.  2014 was an especially active one, though.  For example, the FTC and Apple settled a complaint alleging Apple billed consumers for millions of dollars of charges racked up by children in kids’ mobile apps without first getting parental consent for those purchases.  The FTC ... Read More 

The U.S. Federal Trade Commission usually gets much of the glory for policing privacy and data security issues. For example, just a few months ago the FTC achieved a settlement requiring Fandango and Credit Karma to establish comprehensive data security programs and biennial security assessments following charges that the companies misrepresented to consumers the level of security of their mobile apps and failed to secure the transmission of consumers’ sensitive personal information. And who could forget the FTC’s Google Buzz settlement from 2011?

But recently the FTC ... Read More