Representative Experience

Selected representative matters include:

• HIPAA: Developed a HIPAA compliance program for a digital health provider, including drafting privacy policies and conducting HIPAA training for employees, negotiated hundreds of business associate agreements on behalf of covered entities and business associates, and advised providers, health plans, and business associates on their regulatory obligations.
• Substance Use Disorder Information: Advised a multistate substance abuse treatment facility on navigating compliance with HIPAA, 42 C.F.R. Part 2, and state medical record confidentiality laws.
• General Data Protection Regulation (GDPR): Consulted with a U.S. health system on the applicability of GDPR, advised a clinical trial sponsor conducting trials in the EU on developing a GDPR compliance program, and negotiated a substantial number of data processing agreements as part of a client’s GDPR compliance initiative.
• California Consumer Privacy Act (CCPA): Advised a large health system on CCPA’s applicability, and counseled a manufacturer and sports management company on CCPA compliance, including drafting privacy notices, revising contracts, and developing protocols for responding to consumer rights requests.
• Data breaches: Guided a health care organization through breach notification as a result of use of online tracking technologies, assisted a physician practice with an investigation into a phishing incident, and advised a large health care system on the implications of an application security flaw resulting in unauthorized access to patient data.
• Regulatory investigations: Counseled a digital health provider in responding to a federal government inquiry regarding the provider’s data sharing practices, and represented a manufacturer in responding to an investigation by the federal Office for Civil Rights (OCR) and other regulatory authorities subsequent to a data breach affecting employee health plan data.
• Data de-identification: Advised a health system on de-identification of patient data and the licensing of such de-identified data in accordance with HIPAA and other applicable law, including negotiation of the licensing agreement.
• Health information exchanges: Assisted a health information exchange on navigating compliance with HIPAA, 42 C.F.R. Part 2, and state medical record confidentiality laws, including advising on the necessity of an opt-in versus opt-out consent model.
• Security policies: Drafted and revised security policies and procedures for clients including a digital health company, a health information exchange, and a sports management company.