Earlier this month, the U.S. Department of Health and Human Services, Office for Civil Rights (OCR), has announced a Health Insurance Portability and Accountability Act of 1996 (HIPAA) civil money penalty of $3,217,000.00 against Children’s Medical Center of Dallas (Children’s), a pediatric hospital that is part of Children’s Health, the seventh largest pediatric health care provider in the nation. OCR based this penalty on its finding that Children’s failed to comply with HIPAA Security Rule over many years and that Children’s impermissibly disclosed unsecured electronic protected health information (ePHI) when it suffered two data breaches that were reportable to OCR.

The Breaches

  • On January 18, 2010, Children’s reported to OCR the loss of an unencrypted, non-password protected BlackBerry device at an airport on November 19, 2009. The device contained the ePHI of approximately 3,800 individuals.
  • On July 5, 2013, Children’s reported to OCR the theft of an unencrypted laptop from its premises sometime between April 4 and April 9, 2013. The device contained the ePHI of approximately 2,462 individuals.

Because Children’s devices were unencrypted, Children’s was obligated to report their loss, along with the unsecured ePHI they contained, to the HHS. Had Children’s devices been encrypted, it could have taken advantage of the “safe harbor” rule, pursuant to which covered entities and business associates are not required to report a breach of information that is not “unsecured.”

The Investigation

  • OCR’s investigation revealed that, in violation of HIPAA Rules, Children’s (1) failed to implement risk management plans, contrary to prior external recommendations to do so, and (2) knowingly and over the course of several years, failed to encrypt, or alternatively protect, all of its laptops, work stations, mobile devices, and removable storage media.
    • OCR’s investigation established that Children’s knew about the risk of maintaining unencrypted ePHI on its devices as far back as 2007.
    • Despite this knowledge, Children’s issued unencrypted BlackBerry devices to nurses and allowed its workforce members to continue using unencrypted laptops and other mobile devices until 2013.

The Takeaways Continue Reading Key Takeaways from OCR’s Latest HIPAA Fine: Hospital to Pay $3.2 Million for Its Cybersecurity Violations

In an interesting decision regarding the spoliation of evidence via a mobile device, Magistrate Judge Terry F. Moorer determined that the newly amended Federal Rule 37(e) – enacted on December 1, 2015 – did not apply to the spoliation case, as the case was filed prior to the rule’s enactment.  (Morrison v. Charles J. Veale, M.D., P.C., 2017 BL 21478, M.D. Ala., No. 3:14-cv-1020-TFM, 1/25/17).

Karla Morrison, a former employee of the medical practice Charles J. Veale, M.D., P.C. sued her employer in October of 2014 alleging that the practice violated the Fair Labor Standards Act.  Following the close of discovery in August of 2016, the defendant filed a motion for sanctions for spoliation of evidence alleging that Morrison logged into her office email account after her termination and deleted emails from the account.  The defendant bolstered this argument by alleging that Morrison added 2-step verification to her log-in process in April 2015 – almost 6 months after her termination.  Morrison admitted to accessing her office email days after her termination to “close out” items, but denied any further use of the account.

For those unfamiliar, 2-step verification is an additional security measure that confirms a user’s identity through two components, usually a password followed by a code sent to a personal device, for example.  When in place, it adds an additional level of security to an account, thus making it less susceptible to hacking.  Continue Reading Interesting Sanctions Analysis Applies “Old” Bad Faith Standard Post-December 2015 Amendments

Last month, The Sedona Conference released the public comment version of The Sedona Conference Data Privacy Primer, a comprehensive catalog of U.S. data privacy issues, legislation, and resources, designed to provide “immediate and practical benefit” to organizations and practitioners dealing with privacy issues. The Primer is a work product of The Sedona Conference Working Group Eleven on Data Security and Privacy Liability (WG11). The Primer is open for public comment until April 16, 2017.

A quick read through the Primer makes clear that this publication will become a practical reference book for any attorney seeking to understand basic privacy issues in the United States. At over 100 pages, the Primer is organized much like a treatise, with chapters devoted to the basic data privacy concepts, federal and state government privacy protection, general consumer protection, protection of health and financial information, and workplace and student privacy.

With the United States having a multitude of national, local, and industry-specific privacy statutes and regulations, it can be a challenge to identify all the issues and applicable laws that might apply to a particular legal situation. The Primer conveniently gathers everything in one place and includes discussion of the protections provided by all major federal laws, including the Federal Trade Commission (FTC) Act, Children’s Online Privacy Protection Act (COPPA), Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (CAN-SPAM), Telemarketing and Consumer Fraud and Abuse Prevention Act (Telemarketing Act), Communications Act of 1934, Telephone Consumer Protection Act of 1991, Health Insurance Portability and Accountability Act of 1996 (HIPAA) and The Health Information Technology for Economic and Clinical Health Act (HITECH), The Gramm–Leach–Bliley Act (GLBA), The Fair Credit Reporting Act (FCRA), The Right to Financial Privacy Act of 1978 (RFPA), Family Educational Rights and Privacy Act, Protection of Pupil Rights Amendment, as well as a variety of state laws, proposed legislation, and best practices for approaching various data privacy issues.

Employers will find helpful the discussion of Workplace Privacy, in which the Primer touches upon use of company equipment and email, bring your own device (BYOD) policies, and social media privacy issues. Educational institutions will benefit from the discussion of Student Privacy, which covers FERPA, COPPA, consent requirements and exceptions, right of access, parental rights, and proposed legislation.

The Primer also includes “Side Bar” discussions for each section with practice pointers and best practices related to each area that could help increase compliance with privacy laws and mitigate risk. Most importantly, the Primer points out the interplay among different laws as they might bear on a particular situation, thereby minimizing the risk that some relevant considerations might be overlooked when organization makes a decision on how to discharge its privacy obligations.

shutterstock_307469480On September 19, 2016, Ross Compton told police that when he noticed a fire in his Middleton, Ohio home, he hastily packed suitcases, broke a window with his cane, and pushed his bags out the window, at which point he carried them to his car. After describing the scene to a 911 dispatcher, Compton added that he had an artificial heart. However, authorities began to question Compton’s story when they found gasoline on Compton’s clothes and discovered that the fire that destroyed his home appeared to have started in multiple areas at once.

As part of their investigation, authorities subpoenaed the data stored on Compton’s pacemaker, which would provide a historical record of Compton’s heart rate, cardiac rhythms, and pacemaker activity before, during, and after the fire. After reviewing this data, a cardiologist stated that it was “highly improbable” that Compton carried out the physically demanding activities described in his account. Authorities said that the pacemaker data represented some of the “key pieces of evidence” that resulted in charging Compton with aggravated arson and insurance fraud.

This case provides an excellent example of identifying non-traditional electronically stored information that can provide critical evidence unavailable from any other sources. During an investigation, it is important to identify what sources of electronically stored information exist and then to reasonably narrow that listing down to sources that may have unique, potentially responsive information. Although authorities may have independently pursued Compton’s pacemaker data, it may very well have been Compton’s own comments regarding the existence of his pacemaker that led them to request the data in the first place.

Further information can be found here:

http://www.wlwt.com/article/middletown-mans-electronic-heart-monitor-leads-to-his-arrest/8647942

President Trump is expected to sign soon Executive Order on Strengthening U.S. Cyber Security and Capabilities.   Reports about a “leaked draft” of the Executive Order on Cybersecurity surfaced on the Internet a few days ago, along with predictions that the Order will be signed on January 31.  The Order is yet to be signed and the publicized draft may undergo some changes.  The available draft orders three reviews:

  • Review of Cyber Vulnerabilities, which asks, within 60 days of the date of the Order, for a report of initial recommendations for the enhanced protection of the most critical civilian Federal Government, public, and private sector infrastructure.
  • Review of Cyber Adversaries, which asks, within 60 days of the date of the Order, for a first report on the identities, capabilities, and vulnerabilities of the principal U.S. cyber adversaries.
  • U.S. Cyber Capabilities Review, which asks for identification of an initial set of capabilities needing improvement to adequately protect U.S. critical infrastructure, based on the results of the other two Reviews.  As part of this review, the Secretary of Defense and Secretary of Homeland Security are directed to gather and review information from the Department of Education “regarding computer science, mathematics, and cyber security education from primary through higher education to understand the full scope of U.S. efforts to educate and train the workforce of the future.”  The Secretary of Defense is also directed to make recommendations “in order to best position the U.S. educational system to maintain its competitive advantage into the future.”

Continue Reading President Trump to Issue Executive Order on Cybersecurity

Beginning on April 12, 2017, U.S. organizations that are subject to the investigatory and enforcement powers of the FTC or the Department of Transportation will be able to self-certify to the newly adopted Swiss–U.S. Privacy Shield Framework (“Swiss Privacy Shield”). The Swiss Privacy Shield will allow transfers of Swiss personal data to the United States in compliance with Swiss data protection requirements. The Swiss Privacy Shield will replace the U.S.–Swiss Safe Harbor Framework and will impose similar data protection requirements established last summer for cross-border transfers of personal data from the EU under the EU–U.S. Privacy Shield (“Privacy Shield”).

With the adoption of the Swiss Privacy Shield, transfers of personal data from Switzerland under the Swiss Safe Harbor Framework will no longer be permitted. Organizations currently registered with the Swiss Safe Harbor would need to certify under the Swiss Privacy Shield or implement alternative methods for complying with Swiss data transfer restrictions, such as Standard Contractual Clauses and Binding Corporate Rules. To join the Swiss Safe Harbor, organizations would need to ensure that their privacy policies, notices, statements, and procedures are in compliance with the new framework. The Department of Commerce provides sample language that can be used in an organization’s privacy policy to signify its participation in the Swiss Privacy Shield.

Organizations with active Privacy Shield certifications will be able to add the Swiss Privacy Shield registration to their existing Privacy Shield accounts, at a separate annual fee. Similarly to the Privacy Shield, the fee for participation in the Swiss Privacy Shield will be tiered based on the organization’s annual revenue. The exact fee structure will be made available sometime before April 12.

Notably, organizations with dual registrations, would need to recertify under both the Privacy Shield and the Swiss Privacy Shield one year from the date the first of their two certifications was finalized. That means, for instance, that an organization that registered for the Privacy Shield on September 1, 2016, which then registers for the Swiss Privacy Shield on May 1, 2017, would need to complete its annual recertification under both frameworks by September 1, 2017.

While the requirements of the two frameworks are nearly identical, there are a few differences:

Continue Reading The Swiss Privacy Shield Opens for Business on April 12

The EU Article 29 Data Protection Working Party (WP 29) is continuing its work in preparation for the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679), which will take effect in May 2018. Last month, the WP29 released three sets of guidelines for controllers and processors of personal data, including guidelines on the right to data portability, on data protection officers, and on the lead supervisory authority. Key takeaways from these three guidelines can be found on our blog.

This month, WP29 announced that it adopted its “2017 GDPR Action Plan.” The Plan identifies two areas of focus: (1) follow up on 2016 topics, and (2) new 2017 priorities. The follow-up work will include finalizing guidelines on certification and processing likely to result in a high risk and Data Protection Impact Assessments, administrative fines, the setting up of the European Data Protection Board (EDPB), and the preparation of the one-stop-shop” and EDPB consistency mechanism.

This year, WP29 plans to prepare and release guidelines on the topics of consent, profiling, and transparency. The WP29 will also work on the update of already existing opinions on data transfers to third countries and data breach notifications. This year, companies that rely on transfers of personal data from the EU may have the following three opportunities to engage with the WP29 and EU Data Protection Authorities (DPAs):

  • On April 5-6, 2017, the WP29 will hold a Fablab meeting, where interested stakeholders will have an opportunity to present their views and comments on the identified 2017 priorities.
  • On May 18-19, 2017, the WP29 will organize an interactive workshop where non-EU counterparts will be invited to exchange views on the GPDR and its implementation by the WP29.
  • The press release also states that relevant public consultations “may be” launched at a national level by local DPAs.

The WP29 plans to review its 2017 plan periodically and prepare a new plan for 2018 to finish the preparation work. We will be commenting on the forthcoming GDPR guidelines as they are released by the WP29.

Scott Carlson has been selected to serve on the Georgetown Advanced eDiscovery Institute (AEDI) Advisory Board. The AEDI’s Advisory Board plans Georgetown Law Center’s annual eDiscovery conference.  Now entering its fourteenth year, the conference is recognized as the preeminent annual global eDiscovery Conference.

As a nationally recognized figure in eDiscovery and Information Governance, Scott Carlson will be a welcome addition to the Board.  Scott fills the position held by Seyfarth attorney James Daley, since the inception of the Conference in 2004.  You can find out more information about AEDI by visiting this link.   https://www.law.georgetown.edu/continuing-legal-education/programs/cle/ediscovery-institute/

Yesterday, President Trump signed Executive Order: Enhancing Public Safety in the Interior of the United States (Jan. 25, 2017). The Order states as its purpose “interior enforcement of our Nation’s immigration laws.” Section 14 of the Order calls for denial of any rights under the Privacy Act of 1974 to any non-U.S. citizen, “to the extent consistent with applicable law.”

Sec. 14. Privacy Act. Agencies shall, to the extent consistent with applicable law, ensure that their privacy policies exclude persons who are not United States citizens or lawful permanent residents from the protections of the Privacy Act regarding personally identifiable information.

Over the course of last year, the Obama Administration undertook a big task of putting in place the new cross-border data transfer framework, EU-U.S. Privacy Shield, which involved months of drafting and negotiations with the EU authorities and the validity of which is still being challenged by various EU privacy groups. The Privacy Shield’s provision of comprehensive privacy protections was key to ensure that cross-border commercial data transfers continued after the invalidation of the Safe Harbor framework in October 2015. The Privacy Shield was open for self-certification to business on August 1, 2016, and hundreds of companies have joined the framework since that time.

Continue Reading President Trump’s Executive Order May Impact the Privacy Shield

In his last week in the Office, President Obama issued a report on data privacy and cybersecurity, “Privacy in Our Digital Lives: Protecting Individuals and Promoting Innovation” (January 2017). The report serves as a high-level overview on how people’s interaction with technology has changed in the last several years and what the government has done to protect individual privacy while advancing economy and national security. The report also highlighted the path forward. Many of the initiatives currently in the works or yet to come will require strong cooperation between the government and the private sector.

Some of the data-privacy highlights pointed out in the report are:

  • Financial Privacy. The BuySecure Initiative announced by President Obama in 2014, which encouraged the deployment of new security technology (e.g., chip-and-PIN cards) for payments made in the United States.
  • Broadband Privacy. New rules approved by the Federal Communications Commission (FCC) that give consumers more control over how Internet Service Providers (ISPs) use their data, requiring ISPs to obtain user consent before sharing sensitive information they collect with advertisers and other third parties.
  • Drone Privacy. Six Federal entities that use government-operated drones – the Departments of Defense, Homeland Security, the Interior, Justice and Transportation, and the National Aeronautics and Space Administration – have put in place privacy policies for their use of drones pursuant to President Obama’s 2015 Presidential Memorandum on safeguarding privacy in domestic use of unmanned aircraft systems.
  • Children’s Privacy. The Children’s Online Privacy Protection Act (COPPA), enacted in 1998, was modernized in 2012 to address changes in technology and better protect online privacy of children under the age of 13.
  • Student Privacy. President Obama’s Student Privacy Pledge has been signed by over 250 companies, including some of the Nation’s largest, that have agreed to limit collection and sharing of student data.
  • International Commercial Privacy. The Obama Administration has undertaken a big task of putting in place the EU-U.S. Privacy Shield framework, which involved months of drafting and negotiations with the EU authorities. The Privacy Shield’s provision of comprehensive privacy protections, backed by FTC enforcement, was key to ensure that cross-border commercial data transfers continued after the invalidation of Safe Harbor.
  • Legislative Reforms. In 2015, President Obama signed into law the USA Freedom Act, which ended the U.S. Intelligence Community’s collection of bulk telephony metadata under the USA Patriot Act. The USA Freedom Act creates a more targeted approach whereby the government would generally require judicial permission to access call records held by telecommunications providers.

The Report also included “Areas for Further Attention,” which the Obama Administration hoped the new Administration would focus upon. These Areas are as follows:

Continue Reading The White House Report on Data Privacy Identifies “Areas for Further Attention”