Healthcare Privacy and Compliance

Overview

Healthcare providers, insurers and employer-sponsored health plan administrators, as well as the business associates with whom they do business, are particularly vulnerable to data security incidents because of the highly sensitive protected health information they maintain, including Social Security numbers, insurance information, payment records and confidential medical information. In addition, healthcare businesses must deal with the extensive state and federal regulations that are unique to the industry, including the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health Act (HITECH).

Our diverse team has wide experience in counseling health systems, physician groups, insurers and employers across the country regarding risk assessments, developing comprehensive incident response plans, and responding in a timely and accurate manner to privacy and security incidents, from lost paper files and laptops to the largest cyber incident ever reported involving medical information. We aggressively defend our healthcare clients in investigations brought by the Office for Civil Rights (OCR) and state attorneys general following privacy and security incidents. We advise healthcare industry clients on HIPAA and state law compliance regarding privacy policies and procedures, release of medical information, and access to medical records issues.

We also advise healthcare clients on best practices for leveraging emerging technologies, managing data and structuring operations in compliance with relevant laws and regulations.

We are nationally recognized for our healthcare privacy litigation experience and have served as defense counsel in several of the largest data breaches in the healthcare industry. Our class action defense team has successfully represented major insurance businesses and health systems across the country, minimizing monetary and reputational damage and negotiating with state and federal regulators.

Representative Clients
  • Health systems.
  • Academic medical centers.
  • Healthcare providers.
  • Specialty treatment centers.
  • Long-term care facilities.
  • Schools, colleges and universities.
  • Health plans (self-funded and large insurers).
  • Healthcare technology providers.
  • Medical device manufacturers.

Select Experience

  • Led the incident response for approximately 50 percent of the largest healthcare data security incidents reported to date.
  • Successfully defended more than 500 investigations commenced by the Department of Health and Human Services Office for Civil Rights (OCR).
  • Negotiated more resolution agreements and corrective action plans with the OCR arising out of data security incidents than any other firm (more than 12 agreements negotiated and finalized).
  • Defended hundreds of investigations by attorneys general, including multi-state investigations, arising out of data security incidents.
More »

Professionals

Name Title Office Email
Partner Orlando
Associate New York
Counsel Atlanta
Counsel Atlanta
Associate Chicago
Partner Atlanta
Partner Los Angeles
Associate Atlanta
Associate Philadelphia
Associate Houston
Partner Cincinnati
Partner Columbus
Staff Attorney Columbus
Partner Cleveland
Partner New York
Partner Los Angeles
Partner Atlanta
Associate Chicago
Associate Los Angeles
Partner Cleveland
Partner Cleveland
Associate Houston
Partner Philadelphia
Associate Atlanta
Partner Houston
Counsel Chicago
Associate Atlanta
Partner Houston
Partner Atlanta

Experience

  • Led the incident response for approximately 50 percent of the largest healthcare data security incidents reported to date.
  • Successfully defended more than 500 investigations commenced by the Department of Health and Human Services Office for Civil Rights (OCR).
  • Negotiated more resolution agreements and corrective action plans with the OCR arising out of data security incidents than any other firm (more than 12 agreements negotiated and finalized).
  • Defended hundreds of investigations by attorneys general, including multi-state investigations, arising out of data security incidents.
  • Negotiated numerous consent judgements and settlements with attorneys general, including some of the largest on record.
  • Defending a large public health system in a multi-state attorney general investigation. The matter arises out of a nation-state sponsored data security incident.
  • Advise health systems, physician groups, academic medical centers and long-term care facilities regarding all aspects of general privacy matters, including HIPAA compliance, the EU’s General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA) and other state privacy laws. Our team provides guidance on the HIPAA Privacy and Security Program, state law requirements, breach analysis, regulatory reporting, policies and procedures, and general privacy advice, including best practices for safeguarding individuals’ protected health information and other personally identifiable information,
  • Because of our privacy and regulatory expertise, clients often look to us to conduct privacy assessments. We conduct gap analyses; review policies and procedures to assess HIPAA compliance, state law compliance, policy and procedure comprehensiveness; provide training and education on privacy matters, privacy awareness and readiness within the organization; and review processes in business agreements, breach notification protocols and investigation procedures, among other privacy issues.
  • We represent healthcare clients in connection with HIPAA audits conducted by federal regulators. Since 2016, we have helped several diverse healthcare entities prepare for audits across the privacy, security and breach notification rules under HIPAA in anticipation that they would be chosen for an audit. When the audits were sent later that year, we worked with selected entities to respond to the HIPAA audits and OCR findings. Because of this experience, in June 2018 we began working with large health system in the Midwest in preparation for an expected onsite OCR audit. Our work in this area represents our strong command of HIPAA laws, policies and procedures, a practical understand of healthcare operations, as well as our strong working relationship with the OCR, which allows us to guide the client’s response in such a way that it demonstrates compliance while advocating for a practical approach to HIPAA at healthcare organizations.
  • We advise medical device manufacturers on their obligations as business associates and data owners on general privacy matters, including HIPAA compliance, GDPR, CCPA and state privacy laws. Our team provides guidance on the HIPAA Privacy and Security Program, state law requirements, breach analysis, regulatory reporting, policies and procedures, and general privacy advice, including best practices for safeguarding individuals’ protected health and other personally identifiable information. A recent secondment of our attorneys at a device manufacturer presented the team with a real-time look into the complex and volume of privacy issues that these entities face, and we were able to successfully support the client through these issues.
  • As privacy and data protection issues have moved into the boardroom, we find our team of attorneys being requested to attend board meetings at healthcare organizations to explain the regulatory and risk environment and to provide real-time advice on responding to high-stakes cybersecurity incidents. These presentations range from tabletop exercises and breach workshops, risk assessment advice and compliance strategy to crisis management and strategy during a large data breach. Our clients include some of the United States’ largest and most well-respected healthcare providers and health insurers.

Recognition

  • Chambers Global: Privacy & Data Protection (USA) (2014 to 2019)
  • Chambers USA: Nationwide Privacy & Data Security (2013 to 2019)
    • Chambers USA Privacy and Data Security - Healthcare Spotlight Table (2018 to 2019)
    • Chambers USA Award: “Privacy & Data Security Team of the Year” finalist (2015, 2017)
  • Chambers Fintech: Legal – USA (2018 to 2019)
  • The Legal 500 United States (2016 to 2019)
    • Media, Technology and Telecoms: Data Privacy and Data Protection, Tier 1
    • Media, Technology and Telecoms: Cyber Law, Tier 2
  • Law360: Privacy "Practice Group of the Year" (2013 to 2015, 2018)
  • Recognized as one of the top law firms for client service, BakerHostetler was named to the 2020 BTI Client Service 30 for the sixth consecutive year.

News

News

Press Releases

Publications

Key Contacts

Blog

In The Blogs

Previous Next
Data Privacy Monitor
Powerful Protection: The Healthcare Privacy and Compliance Team
February 13, 2020
The following story is one in a six-part series devoted to the pioneering teams that comprise the firm’s new Digital Asset and Data Management Practice Group. A prime example of BakerHostetler’s preeminence in the legal industry is on...
Read More ->
Data Privacy Monitor
The Privacy Governance and Technology Transactions Team
By Janine Anthony Bowen, Melinda L. McLellan
February 7, 2020
The following story is one in a six-part series devoted to the pioneering teams that comprise the firm’s new Digital Assets and Data Management Practice Group. A prime example of BakerHostetler’s preeminence in the legal industry is on...
Read More ->
Data Privacy Monitor
Version of Proposed CCPA Regulations Available
By Alan L. Friel
February 7, 2020
On February 7, 2020 the California Attorney General published a second version of the proposed regulations to implement the California Consumer Protection Act available here. A redline against the first draft is available here. A new...
Read More ->
Data Privacy Monitor
Federal Court Invalidates 2013 HIPAA Omnibus Rule Regulations and HHS Guidance on Fees for Copies of Medical Records
By Sara M. Goldstein, Alexandra Royal, Aleksandra Vold
January 31, 2020
In what is being seen as a strong rebuke to years of regulatory overreach, the United States District Court for the District of Columbia entered an order on January 23, 2020 that invalidates provisions of the 2013 Omnibus Rule to the...
Read More ->
Data Privacy Monitor
Departments of Education and HHS Release Joint Guidance on the Relationship Between FERPA and HIPAA
By Kathryn Carey, Benjamin P. Wells
January 31, 2020
At the end of 2019, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) and U.S. Department of Education Student Privacy Policy Office (ED) issued an update to their joint guidance on the relationship...
Read More ->