Cory J. Fox

Associate

Houston
T 713.646.1358  |  F 713.751.1717

Cory Fox focuses his practice on assisting clients in the healthcare industry, with an emphasis on issues related to privacy and data protection pursuant to the Health Insurance Portability and Accountability Act (HIPAA) and related state law. As a former research chemist, Cory leverages his prior experience working with academic medical centers, hospitals, pharmaceutical companies, and other healthcare organizations to efficiently assess a client's internal operations and provide the targeted advice and services necessary to address the wide variety of complex legal issues healthcare organizations face.

Cory is a regular contributor to the firm's Data Privacy Monitor and Health Law Update blogs.

Select Experience

  • Represented two large academic medical centers in data breach matters involving the theft of a laptop through all phases of breach response including crisis management, incident investigation, notification of affected individuals, and reporting to the U.S. Department of Health & Human Services (HHS) Office for Civil Rights (OCR) and state regulators. Assisted with subsequent OCR investigations by responding to requests for information regarding the breach incidents as well as each entity's overall HIPAA compliance. Both investigations closed with no disciplinary action taken.
  • Represented two state chartered credit unions in data breach matters involving malware attacks. Coordinated internal investigations regarding the incidents, preparing notification letters and regulatory filings in accordance with applicable state and federal laws, and providing legal support following breach notification.
  • Advised large hospital system during OCR investigation regarding the hospital's provision of auxiliary aids and services to the hearing impaired under Section 504 of the Rehabilitation Act and the Americans with Disabilities Act. Investigation closed with no disciplinary action taken.
More »

Experience

  • Represented two large academic medical centers in data breach matters involving the theft of a laptop through all phases of breach response including crisis management, incident investigation, notification of affected individuals, and reporting to the U.S. Department of Health & Human Services (HHS) Office for Civil Rights (OCR) and state regulators. Assisted with subsequent OCR investigations by responding to requests for information regarding the breach incidents as well as each entity's overall HIPAA compliance. Both investigations closed with no disciplinary action taken.
  • Represented two state chartered credit unions in data breach matters involving malware attacks. Coordinated internal investigations regarding the incidents, preparing notification letters and regulatory filings in accordance with applicable state and federal laws, and providing legal support following breach notification.
  • Advised large hospital system during OCR investigation regarding the hospital's provision of auxiliary aids and services to the hearing impaired under Section 504 of the Rehabilitation Act and the Americans with Disabilities Act. Investigation closed with no disciplinary action taken.
  • Advised pain management clinic regarding drug diversion matter, including reporting of the incident to the Drug Enforcement Administration (DEA) and implementation of controlled substance recordkeeping policies and procedures. Assisted with subsequent DEA investigation and audit by responding to the DEA's requests for information regarding the diversion incident and the clinic's controlled substance records. No disciplinary action has been taken against the clinic.
  • Assisted two home health agencies with the development and implementation of comprehensive compliance programs addressing fraud and abuse prevention under the Stark Law and the Anti-Kickback statute, health information privacy under HIPAA and Texas law, and operational issues associated with regulations promulgated by the Texas Department of Aging and Disability Services.
  • Advises hospitals, academic medical centers, pharmacies, physicians, and business associates regarding development, implementation, and review of health information privacy policies and procedures pursuant to HIPAA and applicable state law. Assists these entities in periodically revising privacy policies and procedures in response to statutory and regulatory amendments and addresses operational questions related to privacy and safeguarding of patient information.
  • Addresses healthcare operational questions on topics ranging from FDA regulatory matters to organ donation and informed consent issues by investigating and analyzing applicable state and federal statutes and regulations. 

Memberships

  • American Health Lawyers Association
  • International Association of Privacy Professionals
  • American Bar Association
  • State Bar of Texas
  • Houston Bar Association

Services

Industries

Prior Positions

  • U.S. Department of Health and Human Services Office of Counsel to the Inspector General: Summer Law Clerk (Summer 2011)
  • University of Texas Medical Branch: Law Clerk (2010 to 2012) 
  • MD Anderson Cancer Center Department of Pulmonary Medicine: Research Assistant (2009 to 2010)
  • BioAutomation: Research and Development Chemist (2007 to 2009)

Admissions

  • Texas, 2012

Education

  • J.D., University of Houston Law Center, 2012, National Order of Scribes; Chief Articles Editor, Houston Journal of Health Law & Policy; Moot Court
  • B.S., Biology and Chemistry, Texas Tech University, 2007, Beta Beta Beta Biological Honors Society

Blog

In The Blogs

Previous Next
Health Law Update
ONC’s Security Risk Assessment Tool Is Useful But Could Be Improved
April 16, 2014
Editor’s Note:  This post originally appeared on BakerHostetler’s Data Privacy Monitor blog. The Office of the National Coordinator for Health Information Technology (ONC) released a Security Risk Assessment Tool (SRA Tool) on March 28. ...
Read More ->
Data Privacy Monitor
Iowa Breach Notification Law Now Requires AG Notification, Applies to Paper Records
April 16, 2014
Iowa recently joined an increasing number of states that require notification of state regulatory authorities following a breach, as well as a handful of states in which paper records can trigger notification obligations.  On April 3...
Read More ->
Data Privacy Monitor
With OpenSSL Compromised by Heartbleed, an Opportunity for Companies to Diversify Cyber Security Efforts
April 14, 2014
The recent discovery of the “Heartbleed” online bug has sent shockwaves through the internet, causing companies and individuals alike to question very basic assumptions about cyber security. The bug has allegedly existed for the past two...
Read More ->
Data Privacy Monitor
Kentucky Enacts Data Breach Notification Statute
April 14, 2014
On April 10, 2014, Kentucky Governor Steve Beshear signed H.B. 232 into law, making Kentucky the 47th state to enact data breach notification legislation.  Prior to H.B. 232, Kentucky was one of only four states—including Alabama, New...
Read More ->
Health Law Update
Will Camp Tax Plan Impact Charitable Giving and Tax-exempt Organizations?
April 11, 2014
Editor’s Note: The following article was originally published to BakerHostetler’s WealthDirector blog. In late February 2014, House Ways and Means Committee Chairman Dave Camp (R-Mich.) released a nearly 1,000 page discussion draft...
Read More ->