Data breach Archives - OF DIGITAL INTEREST

Data breach

Trending in Telehealth: October 17 – 23, 2023

by Dale C. Van Demark and Ashley Ogedegbe | Oct 27, 2023 | Data breach, Telehealth

Trending in Telehealth highlights state legislative and regulatory developments that impact the healthcare providers, telehealth and digital health companies, pharmacists and technology companies that deliver and facilitate the delivery of virtual care.

Trending in the past week:

Interstate Licensure Compacts
Telehealth Practice Standards
Disciplinary Guidelines
Behavioral Health
Regulatory Licensing

A CLOSER LOOK

Finalized Legislation and Rulemaking

Alaska adopted a final rule creating new standards for optometrists providing telehealth services. To provide telehealth services, optometrists must: establish an optometrist-patient relationship verbally, in writing or in-person; verify the patient’s identity; maintain patient confidentiality; provide telehealth services at the same quality as in-person services; diagnose patients at the time of the patient visit; maintain complete and timely records; and perform additional examinations, in addition to telehealth, when dispensing prescription eyewear.

Legislation and Rulemaking Activity in Proposal Phase

Highlights:

In Wisconsin,
- Three Interstate Compact bills advanced through the first chamber:
  - SB 196 would enact the Counseling Compact;
  - SB 391 would enact the Social Work Licensure Compact; and
  - SB 197 would enact the Audiology and Speech Pathology Compact.
- The legislature is also considering AB 364, which advanced through the second chamber.
  - AB 364 would amend the Wisconsin tax code by adopting certain Internal Revenue Code provisions relating to high-deductible health plans (HDHPs) under the Consolidated Appropriations Acts of 2022 and 2023. Specifically, AB 364 authorizes individuals, covered by an HDHP, to claim a state income tax deduction for contributions to a health savings account, even if the plan has a $0 deductible for telehealth or remote services. The tax deduction would be available for taxable years beginning after 2021.
In Ohio, SB 90, a bill to enact the Social Work Licensure Compact (the Compact), passed through the first chamber. While Missouri is currently the only state to officially enact the Compact, Ohio is one of six states with pending legislation to join the Compact.
Oregon proposed a rule to implement and clarify SB 232. The Oregon Legislature passed SB 232 to enact certain exemptions for telemedicine licensure, clarify that the “temporarily” definition includes patients in Oregon for business, vacation or education, and authorize out-of-state physicians or physician assistants to provide telemedicine intermittently to Oregon patients when the healthcare professional has an established patient relationship. The proposed rule amendments align with these updates.

Why it matters:

Hybridization of Healthcare. Alaska’s final rule is an example of the further acceptance of hybrid healthcare models. While the new initiative authorizes optometrists to provide telehealth services to established patients, optometrists in the state must combine telehealth with other forms of examination, likely in-person, to dispense eyewear prescriptions to patients.
Modernizing Licensure Infrastructures. The legislative activity in Wisconsin, Ohio and Oregon facilitates the provision of services across state lines by standardizing licensing requirements for healthcare professionals. The streamlined licensure process also enables a [...]

Continue Reading

Top Takeaways | Cybersecurity & Insurance Coverage in the Age of Telehealth: Understanding and Mitigating Your Risk

by McDermott Will & Emery | Apr 20, 2021 | Cybersecurity, Data breach, Data Privacy, Telehealth

With more frequent and more severe ransomware attacks against health care platforms and vendors and the increasing use of telemedicine, it is critical to understand how to proactively defend your organization using robust legal, regulatory and cyber-coverage strategies. In this webinar, McDermott partners Dale Van Demark and Edward Zacharias joined Brett Buchanan of Marsh & McLennan Agency and Larry Hansard of Gallagher USA to explore the intersection of telemedicine and cybersecurity. Our panelists offered attendees a road map for navigating this rapidly changing space, including practical strategies for shoring up their defenses and addressing potential risks to their businesses.

Providers engaging in telemedicine should consider three critical areas of insurance coverage: medical professional liability, technology errors and omissions, and cyber/privacy liability. “Several carriers have packaged these three important coverages into a one-policy format, referred to as a virtual health program,” Hansard said.
A medical professional liability program should include incident reporting, punitive damages, and sexual abuse and molestation. The latter may seem surprising in a telemedicine context, but is important given reports of inappropriate patient behavior during telemedicine encounters, Hansard said.
New telehealth technologies, such as AI chatbots for patient intake, create new and more complex bodily injury exposures, Buchanan said. “Working with an insurance underwriter that understands these nuances is absolutely key,” he said. In addition to bodily injury, coverage should include technology errors and omissions, cyber liability and general liability.

Click here for the full list of highlights.
Click here to view the full webinar.

Federal Agencies Partner to Warn Healthcare Systems of Imminent Cyber Threat

by McDermott Will & Emery | Oct 29, 2020 | Data breach, Data Privacy, Enforcement

US hospitals and healthcare systems should be on high alert after a rare joint advisory issued by the Federal Bureau of Investigation (FBI), the Cybersecurity Infrastructure Security Agency (CISA) and the Department of Health and Human Services (HHS) warning all US hospitals and healthcare providers of an “increased and imminent cybercrime threat to US hospitals and healthcare providers.” The joint advisory can be found here.

Access the article.

OFAC Advisory Warns of Civil Penalties for Ransomware Payments

by McDermott Will & Emery | Oct 13, 2020 | Big Data, Consumer Protection, Cybersecurity, Data breach, Data Privacy, Enforcement

On October 1, 2020, the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) issued an advisory alert that serves as a warning to entities who have been or will be the victim of a ransomware attack. As such, the crucial decision of whether to pay a ransom now comes with the additional risk of legal scrutiny by a powerful federal agency and the possibility of steep fines.

Access the article.

Uber Criminal Complaint Raises the Stakes for Breach Response

by Todd McClelland, Austin Mooney and McDermott Will & Emery | Sep 3, 2020 | Big Data, Cybersecurity, Data breach, Data Privacy, Enforcement, Mobile Apps

On August 20, 2020, a criminal complaint was filed charging Joseph Sullivan, Uber’s former chief security officer, with obstruction of justice and misprision of a felony in connection with an alleged attempted cover-up of a 2016 data breach. These are serious charges for which Mr. Sullivan has the presumption of innocence.

At the time of the 2016 data breach, Uber was being investigated by the US Federal Trade Commission (FTC) in connection with a prior data breach that occurred in 2014. According to the complaint, the hackers behind the 2016 breach stole a database containing the personal information of about 57 million Uber users and drivers. The hackers contacted Uber to inform the company of the attack and demanded payment in return for their silence. According to the complaint, Uber’s response was to attempt to recast the breach as a legitimate event under Uber’s “bug bounty” program and pay a bounty. An affidavit submitted with the complaint portrays a detailed story of deliberate steps undertaken by Mr. Sullivan to allegedly conceal the 2016 breach from the FTC, law enforcement and the public.

Contemporaneous with the filing of the complaint, the Department of Justice (DOJ) submitted a press release quoting US Attorney for the Northern District of California David L. Anderson:

“We expect good corporate citizenship. We expect prompt reporting of criminal conduct. We expect cooperation with our investigations. We will not tolerate corporate cover-ups. We will not tolerate illegal hush money payments.”

The press release also quoted Federal Bureau of Investigation (FBI) Deputy Special Agent in Charge Craig Fair:

“Concealing information about a felony from law enforcement is a crime. While this case is an extreme example of a prolonged attempt to subvert law enforcement, we hope companies stand up and take notice. Do not help criminal hackers cover their tracks. Do not make the problem worse for your customers, and do not cover up criminal attempts to steal people’s personal data.”

Collectively, the case and statements from the DOJ are probably a unicorn based on, if the facts as alleged are true, a case involving a deliberate cover-up of a data breach in the course of an active FTC investigation. However, many of the statements from the DOJ and the specific allegations in the complaint appear to have potentially far-reaching implications (for companies, their executives and cybersecurity professionals) that breach response counsel must seriously consider in future incidents.

A common question when responding to a ransomware or other cyberattack is whether and when to inform law enforcement. The criminal complaint has the potential to make this an even more difficult decision for future cyberattack victims. Further, while the alleged conduct at issue may seem particularly egregious, the DOJ’s statements could cause a blurring of the lines between what the government may contend is illegal concealment of a security incident and activities generally thought to be legitimate security incident risk and exposure mitigation. We explore these and other key takeaways from the criminal complaint in more detail below.

[...]

Continue Reading

NYDFS—First Enforcement Action under Cybersecurity Regulation

by Mike Byrne and McDermott Will & Emery | Jul 29, 2020 | Cybersecurity, Data breach, Enforcement

On July 21, 2020, the New York Department of Financial Services (NYDFS) announced that it had filed its first enforcement action under 23 NYCRR 500 (the “Cybersecurity Regulation”) against a large title insurance provider. Covered entities should closely monitor this enforcement action.

Access the article.

Importance of CCPA Compliance Highlighted by First Round of Private Actions

by Jonathan Ende and McDermott Will & Emery | Jun 26, 2020 | Consumer Protection, Data breach, Data Privacy

The first wave of California Consumer Privacy Act litigation has begun to roll in, and the complaints are already raising interesting questions about the scope of CCPA’s private right of action. The actions assert a variety of claims under numerous theories and present a broad range of potential risks to businesses subject to CCPA. In light of the many questions that surround CCPA’s private right of action, the extent of possible liability from private litigation is still largely unknown and potentially significant.

The first wave of private lawsuits filed under the California Consumer Privacy Act (CCPA) has begun to roll in, and the complaints are already raising interesting questions about the scope of CCPA’s private right of action. The recent explosion in popularity of video conferencing and social media software in response to the COVID-19 pandemic—and the technical issues some of these products have experienced—has inspired its own wave of litigation, with several cases alleging violations of CCPA along with other laws. The flurry of litigation activity makes clear the importance of CCPA compliance, particularly in the current challenging business environment. Although it’s too early to tell how these lawsuits will play out, some themes are emerging.

Refresher on CCPA Private Right of Action

Businesses are now familiar with the long list of privacy obligations imposed by CCPA and enforceable by the California attorney general. Although CCPA contains a private right of action, that right is applicable only to CCPA’s sole data security provision. Cal. Civ. Code § 1798.150 authorizes consumers to institute a civil action against a business whose failure to implement and maintain reasonable security procedures resulted in the unauthorized access and exfiltration, theft or disclosure of the consumer’s nonencrypted and nonredacted personal information. The definition of “personal information” in the context of § 1798.150 is narrower than the expansive definition applicable to other CCPA provisions, applying only to an individual’s name together with an identifying data element, such as a Social Security number, driver’s license number or medical information. A plaintiff may seek injunctive or declaratory relief, actual damages or statutory damages in an amount not less than $100 and not greater than $750 per consumer, per incident. Before seeking statutory damages, however, the consumer must provide the business 30 days’ written notice to cure the alleged violation. The “notice and cure” provision is the subject of some controversy, because CCPA does not explain how a violation that resulted in a data breach can be “cured.” CCPA also explicitly prohibits consumers from using alleged violation of its provisions “to serve as the basis for a private right of action under any other law,” thus, in theory, prohibiting a plaintiff from alleging that a CCPA violation constitutes a violation of the California Unfair Competition Law, Cal. Bus. & Prof. Code §§ 17200, et seq. or other statutes. That hasn’t stopped plaintiffs from trying, as described below.

Theme #1: Suits Brought as Class Actions

Most, if not all, of the lawsuits brought under CCPA thus far have been brought as [...]

Continue Reading

Comprehensive Federal Privacy Law Still Pending

by McDermott Will & Emery | Jan 22, 2020 | Consumer Protection, Data breach, Data Privacy

The California Consumer Privacy Act (CCPA) has forced companies across the United States (and even globally) to seriously consider how they handle the personal information they collect from consumers. By its terms, however, the CCPA only protects the privacy interests of California residents; other “copy-cat” privacy laws proposed or enacted in other states similarly would only protect the rights of residents of each state. Given the burden on businesses imposed by the rapid proliferation of privacy and data protection laws, including data breach notification obligations, requirements for data transfer mechanisms imposed by international data protection laws (such as the EU General Data Protection Regulation (GDPR)), and the imposition of a variety of data subject rights, a comprehensive US federal privacy bill appears increasingly overdue.

In the past year, US legislators have proposed a wide variety of data privacy laws—none of which seems to have gained significant traction. In November 2019, two new proposals were released in the Senate: the Consumer Online Privacy Rights Act (COPRA), sponsored by Senate Democrats, and the United States Consumer Data Privacy Act of 2019 (CDPA), proposed by Senate Republicans. Both proposals require covered entities to:

(more…)

CCPA Has Just Gone Into Effect, But Businesses May Need to Prepare for a New California Privacy Law

by Jonathan Ende | Jan 21, 2020 | Consumer Protection, Data breach, Data Privacy

The California Consumer Privacy Act (CCPA) is not yet one month old, but movement has already started on a new California privacy law. In November 2019, the advocacy group Californians for Consumer Privacy, led by Alastair Mactaggart, the architect of CCPA, submitted a proposed California ballot initiative to the Office of the California Attorney General that would build upon the consumer privacy protections and requirements established by CCPA. In December 2019, as required under state law, California Attorney General Xavier Becerra released a title for and summary of the proposed ballot initiative, which will be known as the California Privacy Rights Act (CPRA).

Key Provisions of the CPRA

CPRA seeks to give California consumers additional control over and protection of their personal information in five core ways.

(more…)

CCPA and ‘Reasonable Security’: A Game Changer

by McDermott Will & Emery | Jan 21, 2020 | Consumer Protection, Data breach, Data Privacy

On January 1, 2020, the California Consumer Privacy Act of 2018 (CCPA) went into effect. The CCPA applies to a wide range of companies and broadly governs the collection, use and sale of personal information of California residents (i.e., consumers and certain other individuals) and households.

The CCPA provides that consumers may seek statutory damages of between $100 and $750, or actual damages if greater, against a company in the event of a data breach of nonredacted and nonencrypted personal information that results from the company’s failure to implement reasonable security. The amount of the statutory damages depends on factors such as the nature and seriousness of the company’s misconduct, the number of violations, the persistence of the company’s misconduct, the length of time over which the misconduct occurred, and the company’s assets, liabilities and net worth. To defend against these consumer actions, a company must show that it has implemented and maintains reasonable security procedures and practices appropriate to the nature of the personal information it is processing.

This CCPA private right of action promises to shake up the data breach class action landscape in which such actions have generally been settled for small amounts or dismissed due to lack of injury. With the CCPA, companies now face potentially staggering damages in relation to a breach. To provide some context, a data breach affecting the personal information of 1,000 California consumers may result in statutory damages ranging from $100,000 to $750,000, and a data breach affecting the personal information of one million California consumers may result in statutory damages ranging from $100 million to $750 million. These potential statutory damages dwarf almost every previous large data breach settlement in the United States.

To mitigate the risk of this increased exposure, companies need to take key steps to ensure they have implemented reasonable security procedures and practices.

What Is Reasonable Security?

(more…)