Health Information Privacy & Security

The breathtaking pace of technological innovation in the health sector has drastically changed how medical data is generated, used and stored. The patchwork of federal and state laws addressing privacy and the security of health information is in continual flux. New risks and opportunities abound as the health sector strives to innovate and thrive while fending off cybersecurity threats and managing compliance and litigation risks.

Our lawyers have focused on health care privacy and security issues for over 20 years and have the deep understanding necessary to handle health information privacy and security issues in these dynamic times. We assist health industry participants—including hospital systems, medical device companies, pharmaceutical companies, pharmacies, health plans, third-party administrators, research entities, software vendors, service providers, trade associations and professional sports leagues—in addressing complex privacy and information security issues.

We work with traditional, established health sector participants as well as newcomers and start-ups. Our team develops and implements strategies to address privacy and security compliance risks associated with the complex data flows involved in health care innovations, including digital health solutions.

Our team provides a complete range of regulatory, transactional, incident response, litigation, policy and strategic services concerning privacy and information security requirements relevant to the health sector, including:

The Health Insurance Portability and Accountability Act of 1996 and the Health Information Technology for Economic and Clinical Health Act of 2009, as well as their implementing regulations (HIPAA)
Section 5 of the Federal Trade Commission Act (“Section 5”)
The Interoperability and Information Blocking Rule adopted under the 21st Century Cures Act
Confidentiality of Substance Use Disorder Patient Records regulations, codified at 42 C.F.R. Part 2 (“Part 2”)
Common Rule and other regulations governing clinical research
State laws addressing health information privacy, security and breach notification.

In evaluating opportunities, analyzing risks, responding to incidents and developing client-oriented strategies, we consider not just the letter of the law, but government enforcement priorities, compliance trends and the broader policy and economic environment.