On November 9, 2017, Steven R. Peikin, Co-Director of the SEC’s Division of Enforcement, delivered a keynote speech at a conference commemorating the 40th anniversary of the enactment of the Foreign Corrupt Practices Act (“FCPA”) in which he reflected on “the past, present, and future” of the SEC’s enforcement of the FCPA.
After confirming the…
The days of speculation may have ended. Immigration and Customs Enforcement’s (ICE) acting director recently made clear that Form I-9 audits and worksite enforcement actions will surge in the coming year.
In line with the Trump Administration’s tough position on immigration and its budget requests, most employers have anticipated increased immigration-focused audits and enforcement actions.…
“A significant data breach is likely to cost the company materially, and costs could drag on for a number of years,” analyst Shlomo Rosenbaum, commenting on the Equifax breach.
Organizations increasingly rely on third-party service providers for data collection, processing, transfer and storage. As a result of this dependence on external data management sources, most companies are rethinking data breach risk and cost allocations in new and existing vendor agreements.
Limitation of liability and indemnification clauses form the framework for reducing unforeseeable, and potentially devastating, data breach costs. To defend against unpredictable damages, these clauses are fast becoming the most fiercely negotiated language in service provider agreements. Both liability and indemnity have taken on new importance as organizations become acutely aware that the customer, not the vendor, most likely has the ultimate responsibility for data breached while in the hands of a vendor. The harsh reality that a majority of state statutes allocate the risk and costs of unauthorized disclosure to the data owner, not the vendor, is a red flag in contract negotiations. Customers now realize that they are probably legally required to investigate a breach, provide required notifications and cover any and all costs related to a breach despite the fact the vendor is the sole culpable party. Under most state statutes, a service provider’s obligations, and liability for costs, end with notification to the customer. Simply put, if the organization’s sensitive data is breached while under the control of a vendor, the vendor’s only obligation is to notify the organization. It is then the customer’s obligation to handle the fallout, unless the customer’s contract with the vendor provides otherwise.
Another court ruling this week concludes that the Illinois Biometric Information Privacy Act (IBIPA) covers face geometry scans that are created from digital images, again rejecting the argument that the statute should apply only to facial scans made in person. The case, Monroy v. Shutterfly, Inc., No. 16 C 10984 (N.D. Ill. September 15,…
On Sept. 6, 2017, the Centers for Medicare and Medicaid Services (CMS) issued an advanced copy of guidance to state survey agency directors that is intended to clarify how to determine whether a hospital seeking Medicare certification, or going through a continuing certification survey, is “primarily engaged in providing inpatient services” under the Social Security…
A recent federal district court case raises significant issues regarding privilege that should be on the radar of any in-house or outside counsel conducting an internal investigation with the goal of producing a public report. As discussed in a recent Privilege Points, the investigation at issue was conducted for the Washington Metropolitan Area Transit…
By many accounts, 2017 is the 35th anniversary of widely propagating computer viruses. The recent “WannaCry” and “NotPetya” ransomware outbreaks demonstrate that computer viruses (or more broadly, “malware”) are still evolving, developing, and posing new threats. But IT contracts don’t move at the same pace. Contract provisions that address computer virus risk have…
Last year in Universal Health Services, Inc. v. United States ex rel. Escobar et al. (discussed on this blog), the Supreme Court reminded litigants that the False Claims Act “is not an all-purpose antifraud statute.” In that case, the Court expanded upon the FCA’s materiality standard, calling it both “rigorous” and “demanding.” How…
On Monday, July 10, 2017, the Consumer Financial Protection Bureau (CFPB) issued a game-changing final rule regarding the use of arbitration clauses in consumer contracts. The Rule is effective 60 days following its publication in the Federal Register and applies only to contracts entered into more than 180 days after that date. The final rule…
The U.S. Department of Health & Human Services (HHS) issued a recent report noting that cybersecurity is a key public health concern that needs “immediate and aggressive attention.” Shortly thereafter, HHS’ Office for Civil Rights (OCR) released a checklist of practical steps health care providers can take to protect themselves and their patients in the event of a cyber attack. Both items underscore the Government’s increased focus on cybersecurity in the health care industry and remind health care providers of the importance of preparing for and appropriately responding to cyber attacks.
The Report
The interdisciplinary Health Care Industry Cybersecurity (HCIC) Task Force issued its 87 page report (the Report), mandated by the Cybersecurity Act of 2015, emphasizing the increased responsibility health care organizations have to secure their systems, medical devices, and patient data.
The increased focus on cybersecurity comes in the wake of recent rise and sophistication of cyberattacks on the health care industry. For instance, the Report notes that the health care sector experienced more cyber incidents resulting in data breaches in 2015 than any of the other 15 critical infrastructure sectors in the U.S. economy. As the health care industry increasingly shifts to electronic health records (EHRs), automated medication delivery systems, and generally more connectivity and dependence on the Internet of Things (IoT), the prevalence and severity of these attacks is likely to increase.
The Report includes several high-level recommendations to federal regulators that could have a significant impact on members of the health care industry, including, among others:
The Report also suggested creating managed security service provider models to support small and medium-size health care providers. The Task Force also recommended that the industry evaluate options to migrate patient records and legacy systems to secure environments (e.g., hosted, cloud, shared computer environments). The imperatives, recommendations, and action items identified in the Report may be a guidebook for future rule-making from HHS aimed at strengthening the privacy of protected health information (PHI) in a new age of cybersecurity risks.
OCR Checklist
In the wake of the Report and an unprecedented year of increased cyber-attacks against health care entities (including the recent WannaCry attack and the Petya attack), OCR released a checklist of steps that HIPAA covered entities and business associates must take in response to a cyber-related security incident. OCR also published an infographic of the steps, which include:
