Lynn Sessions

She | Her | Hers

Partner

Houston
T +1.713.646.1352
F +1.713.751.1717

“[Lynn] is extremely approachable and puts clients at ease with a thorough command of HIPAA and the attendant regulatory landscape.”

— Chambers USA 2022

Overview

Lynn Sessions leads the Healthcare Privacy and Compliance team in the Digital Assets and Data Management Practice Group and serves as national co-lead of the Healthcare Industry Team, demonstrating a career of advising healthcare industry clients in various areas of the law. She focuses her practice now on healthcare privacy and data security, breach response, regulatory defense and Health Insurance Portability and Accountability Act (HIPAA) compliance. Having previously served as in-house counsel and director of several departments at Texas Children’s Hospital, Lynn collaborates closely with healthcare clients and approaches her legal representation from a client’s perspective.

Lynn also regularly advises universities, medical schools and other higher educational institutions on breach preparedness, incident response and regulatory defense, and proactive compliance.

Lynn is a frequent speaker and writer on a range of topics affecting healthcare industry and university clients, including HIPAA compliance, data breach response, Office for Civil Rights investigations, Department of Education investigation, cyberliability and enterprise risk management.

Select Experience

Privacy and Data Security 
  • Has handled more than 800 healthcare data breaches and ransomware attacks, including several of the largest breaches reported to date. In her representation, Lynn provides counsel to healthcare providers and other covered entities on breach analysis; breach response; crisis management with patients, media and employees; and regulatory notification obligations to the Office for Civil Rights (OCR) and state attorneys general.
  • Has responded to more than 500 post-breach and HIPAA investigations from the OCR and state attorneys general arising from large and small data breaches reported by covered entities, patient complaints and health information access issues, and has successfully defended healthcare organizations in these investigations.
  • Has advised more than 100 educational institutions in breach response, breach preparedness and regulatory defense, and proactive compliance.
More »

Experience

Privacy and Data Security 
  • Has handled more than 800 healthcare data breaches and ransomware attacks, including several of the largest breaches reported to date. In her representation, Lynn provides counsel to healthcare providers and other covered entities on breach analysis; breach response; crisis management with patients, media and employees; and regulatory notification obligations to the Office for Civil Rights (OCR) and state attorneys general.
  • Has responded to more than 500 post-breach and HIPAA investigations from the OCR and state attorneys general arising from large and small data breaches reported by covered entities, patient complaints and health information access issues, and has successfully defended healthcare organizations in these investigations.
  • Has advised more than 100 educational institutions in breach response, breach preparedness and regulatory defense, and proactive compliance.
  • Advises clients on HIPAA and other privacy compliance, including preparation of policies and procedures, notice of privacy practices, business associate agreements, and incident response plans. Works with healthcare organizations post-data breach to strengthen safeguards under HIPAA and implement corrective action plans.
  • Works with large non-healthcare employers on HIPAA and other privacy issues for their self-insured health plans and with on-site provider clinics on HIPAA compliance, including policies and procedures, business associate arrangements, privacy issues arising from Covid-19 testing and vaccines, and sharing of employee information.

Recognitions and Memberships

Recognitions

  • BTI Client Service All-Star (2022)
  • Chambers Global
    • Privacy & Data Security: Healthcare (USA) (2020 to 2022) – Band 2; (2018, 2019) – Band 3
  • Chambers USA
    • Nationwide Privacy & Data Security: Healthcare – Band 2 (2019 to 2022); Band 3 (2017 to 2018)
    • Texas: Healthcare: Band 2 (2020-2022); Band 3 (2014 to 2019) 
  • The Legal 500 United States (2019 to 2022)
    • Recommended in Cyber Law (including data privacy and data protection) (2021 to 2022)
    • Recommended in Industry Focus - Healthcare: service providers (2019 to 2021)
  • Cybersecurity Docket "Incident Response 40" (2021 to 2022)
  • National Diversity Council, Healthcare Diversity Council: Top 25 Women in Healthcare, Houston (2019)
  • National Law Journal ”Cybersecurity Trailblazer” (2016)
  • Burton Award: Distinguished Writing Award for “Anatomy of Healthcare Data Breach” (2013)
  • American Leadership Forum: Senior Fellow
  • Texas Super Lawyers
    • Super Lawyer (2021)
    • “Rising Star” (2005)
  • Rice University, Jesse H. Jones School of Management Executive Education: Executive Education in Medical and Healthcare Management Certification
  • Texas Children’s Hospital: Advanced Quality Improvement and Patient Safety Certification
  • Development Dimensions International: Strategic Leadership

Memberships

  • American Health Law Association
  • Risk and Insurance Management Society
  • American Bar Association
  • Houston Bar Association

News

News

Press Releases

Events

Community

  • Texas Center for Missing: Board of Directors (2019 to present)
  • Children at Risk: Board of Directors (2009 to 2018)
  • Immunization Partnership: Board of Directors (2013 to 2018)
  • Greater Houston HealthConnect: Board of Directors (2017 to 2019)

Emerging Issues

Prior Positions

  • Texas Children's Hospital: Director and In-House Counsel (2004 to 2011)

Admissions

  • Texas

Education

  • J.D., Baylor University School of Law, 1993, Order of Barristers
  • B.A., Texas A&M University, 1989

Blog

In The Blogs

Previous Next
Data Counsel
California's AB 587: What You Need to Know About Social Media Content Moderation
By Jiwon (Jamie) Kim, Jeewon K. Serrato
November 21, 2022
On Sept. 13, California Gov. Gavin Newsom signed into law AB 587, which requires social media companies to publicly post their content moderation policies and semiannually report data on their enforcement of the policies to the attorney...
Read More ->
Data Counsel
New York Department of Financial Services Publishes Proposed Second Amendment to Its Cybersecurity Regulation
By Elise R. Elam, Patrick H. Haggerty, Vaughn Stupart
November 17, 2022
On Nov. 9, 2022, the New York State Department of Financial Services (NYDFS) published a proposed second amendment to its cybersecurity regulation. This follows its pre-proposed amendment that was published on July 29. Our prior analysis...
Read More ->
Data Counsel
OCR releases YouTube Addressing "Recognized Security Practices" in HIPAA Enforcement Context
By Adam I. Cohen, Kimberly C. Gordy, Craig A. Robinson
November 14, 2022
As a Halloween treat for HIPAA-covered entities and business associates, on October 31, the Department of Health and Human Services Office for Civil Rights (OCR) released a new video on its YouTube channel, in which senior OCR...
Read More ->
Data Counsel
Could Careless Coders Face False Claims Liability?
By Brian Craig, Stephen E. Ruscus
October 28, 2022
New Software Development Security Attestation and Related False Claims Act Liability for Commercial and Noncommercial Software Developers and Suppliers Key takeaway Software producers at all levels in the federal supply chain should...
Read More ->
Data Counsel
Court Finds HHS Had No Lawful Basis Under HIPAA for a $4.3 Million Civil Money Penalty: What Does This Mean for Future HHS Enforcement Actions?
By Sara M. Goldstein, Lynn Sessions
January 27, 2021
The United States Court of Appeals for the Fifth Circuit recently found that the United States Department of Health and Human Services (HHS) lacked a lawful basis for a $4.3 million civil money penalty order that it issued to a healthcare...
Read More ->