Data Privacy Archives - Page 9 of 35

Data Privacy

FDA Outlines the New Digital Health Innovation Action Plan and Software Precertification Pilot Program

by McDermott Will & Emery and Vernessa T. Pollard | Aug 7, 2017 | Data Privacy, General Interest, Telehealth

Last Tuesday afternoon, the US Food and Drug Administration (FDA) held a webinar to outline a recently-published Digital Health Innovation Action Plan (Plan). In the Plan, the agency recognized that the traditional regulatory approach toward moderate and high risk medical devices is not well suited for the fast-paced, iterative design, development and type of validation used for digital health software products today. Going forward, the agency plans to explore an innovative approach to regulating these types of products. The approach contains three primary prongs: (1) the issuance of new guidance, (2) the Digital Health Software Precertification Program and (3) an internal expansion of FDA’s digital health capabilities.

The webinar was presented by Bakul Patel, Associate Director for Digital Health at FDA. At least 905 attendees logged in to the webinar. (more…)

Regulating the Internet of Toys

by Amy C. Pimentel | Jul 28, 2017 | Consumer Protection, Cybersecurity, Data Privacy, General Interest

New technologies and the expansion of the Internet of Things have allowed children of this generation to experience seamless interactive technologies through microphones, GPS devices, speech recognition, sensors, cameras and other technological capabilities. These advancements create new markets for entertainment and education alike and, in the process, collect endless amounts of data from children–from their names and locations to their likes/dislikes and innermost thoughts.

The collection of data through this Internet of Toys is on the tongues of regulators and law enforcement, who are warning parents to be wary when purchasing internet-connected toys and other devices for children. These warnings also extend to connected toy makers, urging companies to comply with children’s privacy rules and signaling that focused enforcement is forthcoming.

Federal Trade Commission Makes Clear That Connected Toy Makers Must Comply with COPPA

On June 21 2017, the Federal Trade Commission (FTC) updated its guidance for companies required to comply with the Children’s Online Privacy and Protection Act (COPPA) to ensure those companies implement key protections with respect to Internet-connected toys and associated services. While the FTC’s Six Step Compliance Plan for COPPA compliance is not entirely new, there are a few key updates that reflect developments in the Internet of Toys marketplace. (more…)

False Claims Act Settlement with eClinicalWorks Raises Questions for Electronic Health Record Software Vendors

by Daniel F. Gottlieb and Tony Maida | Jul 7, 2017 | Consumer Protection, Data Privacy, General Interest, Uncategorized

On May 31, 2017, the US Department of Justice announced a Settlement Agreement under which eClinicalWorks, a vendor of electronic health record software, agreed to pay $155 million and enter into a five-year Corporate Integrity Agreement to resolve allegations that it caused its customers to submit false claims for Medicare and Medicaid meaningful use payments in violation of the False Claims Act.

Read the full article.

OIG Reports More Than $731 Million in Inappropriate Medicare Meaningful Use Payments

by Amanda Enyeart and Lisa Mazur | Jun 20, 2017 | Big Data, Data Privacy, General Interest, Telehealth

The Electronic Health Records (EHR) Incentive Program run by Centers for Medicare and Medicaid Services (CMS) garnered attention again last week following the release of a report by the Office of Inspector General of the US Department of Health and Human Services (OIG) describing inappropriate payments to physicians under the program. The report follows on the heels of a high-profile settlement under the False Claims Act between the US Department of Justice and an EHR vendor related to certified electronic health record technology (CEHRT) used in the EHR Incentive Program (which we’ve previously discussed in-depth).

The OIG reviewed payments to 100 eligible professionals (EPs) who received EHR incentive payments between May 2011 and June 2014 and identified 14 inappropriate payments. OIG extrapolated the results of the review to the 250,470 total EPs who received incentive payments during that time period and estimated that CMS made approximately $729 million in inappropriate EHR incentive payments out of a total of just over $6 billion in such payments during the review period. (more…)

Recent $2.5 Million OCR Settlement Is a Warning to Wireless Health Service Providers

by Amanda Enyeart, Drew Elizabeth McCormick and Lisa Mazur | May 3, 2017 | Consumer Protection, Cybersecurity, Data breach, Data Privacy, Telehealth

On April 24, the US Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced a Health Insurance Portability and Accountability Act of 1996 (HIPAA) settlement in the amount of $2.5 million based on the impermissible disclosure of unsecured electronic protected health information (ePHI) by a provider of remote mobile monitoring, with a focus on patients who are at risk for cardiac arrhythmias.

In January 2012, the remote monitoring company reported that a workforce member’s laptop containing the ePHI of over a thousand individuals was stolen from a parked vehicle outside of the employee’s home. A little over one year later, the same company reported a second breach that compromised the ePHI of twice as many individuals (details regarding this breach were not provided by OCR).

OCR’s investigation revealed that the company allegedly had insufficient risk analysis and risk management processes in place at the time of the theft. Additionally, the company’s draft policies and procedures implementing the standards of the HIPAA Security Rule had never been implemented, and the company was also unable to produce final versions of any policies or procedures regarding the implementation of safeguards for ePHI, including those for mobile devices.

(more…)

Guide from the Italian Data Protection Authority on the Application of the GDPR: Recommendations on How to Get Started!

by Martino Sforza | May 3, 2017 | Consumer Protection, Data Privacy

On April 28, 2017, the Italian Data Privacy Authority published a Guide on the application of the new General Data Protection Regulation (GDPR). The Guide does not set out implementing rules of the GDPR but rather provides a summary of “what will remain the same” and “what will change” in the main six areas covered by the GDPR:

Legal basis for the processing
Information to be provided to data subjects
Data subjects’ rights
Data controller, data processor and persons in charge of the processing
Data privacy risk assessment and accountability
International transfer of data

In addition, for each of the above six macro areas, the Guide provides recommendations on the measures that companies and public entities can already put in place, in order to ensure compliance with specific provisions of the GDPR, which do not need further intervention at a national level for their implementation.

The Guide will be amended, updated or supplemented in light of the development of the debate at a national and European level on the application of the GDPR. The data protection authorities of France and the Netherlands published similar guides respectively on March 15 and April 13, 2017, which are however structured in a slightly different way, as they propose (especially the French one) a more systematic “step by step” methodology in order to help organizations get ready for the GDPR.

Elisabetta Pagone contributed to this blog post.

More Federal Legislation Aimed at Expanding Medicare Coverage of Telehealth Services

by McDermott Will & Emery, Dale C. Van Demark, Lisa Mazur and Marshall E. Jackson, Jr. | Apr 11, 2017 | Consumer Protection, Data Privacy, General Interest, Telehealth

Late last month, Senator Cory Gardner (R-CO) and Senator Gary Peters (D-MI) introduced Senate Bill 787, the Telehealth Innovation and Improvement Act (Telehealth Improvement Act), which is focused on expanding Medicare’s currently limited coverage of telehealth services and opportunities for innovation.

The Telehealth Improvement Act would require the Center for Medicare and Medicaid Innovation (CMMI) to test the effect of including telehealth services in Medicare health care delivery reform models. More specifically, the Act would require CMMI to assess telehealth models for effectiveness, cost and quality improvement, and if the telehealth model meets these criteria, then the model will be covered through the Medicare program. (more…)

New York AG Settlement with App Developers Serves as a Warning for the Need for Evidence-Backed Commercial Claims

by Chelsea M. Rutherford and Jennifer S. Geetter | Apr 5, 2017 | Advertising & Marketing, Big Data, Consumer Protection, Data Privacy, Ecommerce, Electronic Contracting, Mobile Apps, Telehealth, Text Messaging

On March 23, 2017, the New York Attorney General’s office announced that it has settled with the developers of three mobile health (mHealth) applications (apps) for, among other things, alleged misleading commercial claims. This settlement highlights for mHealth app developers the importance of systematically gathering sufficient evidence to support their commercial claims.

Read the full article.

What You Need to Know about Changes to the Common Rule

by Bernadette M. Broccolo, Chelsea M. Rutherford, Jennifer S. Geetter, Jiayan Chen and Lisa Mazur | Feb 10, 2017 | Data Privacy, General Interest, Uncategorized

The Final Rule published by the US Department of Health and Human Services on January 18, 2017, largely avoids major modifications to the Common Rule. However, it specifically addresses creation of biospecimen and data repositories and use of those repositories for secondary research. All stakeholders involved in federally funded research should be aware of the Final Rule’s changes and prepare to implement them.

Read the full article here.

HHS Finalizes Overhaul of Federal Human Subjects Research Protections

by Chelsea M. Rutherford and Jennifer S. Geetter | Jan 18, 2017 | Data Privacy, General Interest, Uncategorized

On January 18, 2017, the Department of Health and Human Services (HHS) and 15 other federal agencies issued a final rule overhauling the federal human subjects research regulations known as the “Common Rule.” These are the first revisions to the Common Rule since its original enactment in 1991, and have been in progress since HHS first published an Advanced Notice of Proposed Rulemaking in July 2011. According to the press release accompanying the final rule, HHS made “significant changes” to its most recent proposals (published in September 2015) in response to the 2,100+ public comments they received.

The majority of the Common Rule’s changes and new provisions will go into effect in 2018. We are reviewing the final rule in detail, and a summary of changes and new provisions is forthcoming.

Older Posts »

« Newer Posts

BLOG EDITORS

Amanda Enyeart

Marshall E. Jackson, Jr.

BLOG EDITORS

STAY CONNECTED

TOPICS

ARCHIVES

RECENT POSTS