Careers

Diversity

With 18 offices, from New York to Los Angeles and Seattle to Orlando, we live and work in communities all over the U.S., collaborating across locations, disciplines and even borders. Our experienced, highly ranked lawyers serve businesses wherever they are and wherever they want to go.

Offices

About Us

Pages

Professionals

Thought leadership: blogs, podcasts, videos, publications, events and news

Insights

Services

Pro Bono

Am Law 100 firm with practices in Business, Digital Assets and Data Management, Intellectual Property, Labor & Employment, Litigation and Tax.

Home | BakerHostetler

Kenneth Little Co-Authors Chapter for Estate Planning for Retirement Benefits, 2025 Edition

Data Counsel

DSIR Deeper Dive: Taking a Look at Privacy at the FTC – Six Months into the New Administration

Adapting to Private Practice: From ATF Director to BigLaw (Law360)

Alexander Reid Comments on Survival of Climate-Focused Nonprofits in Bloomberg.com Article

Sara has led BakerHostetler’s response to several high-profile data security incidents that involved the data of hundreds of firm clients. As the leader of these matters, she developed the strategy for the incident response process, oversaw the team of attorneys working directly with clients and created processes and protocols for the attorney team to follow.

Prior to joining BakerHostetler, Sara was the vice president and general counsel of the nation’s second-largest provider of release of information and disclosure management services, where she was responsible for overseeing all of the company’s legal and compliance-related matters. This experience gives her a depth of knowledge regarding clients’ needs, bringing a business-oriented perspective to her practice and allowing her to provide legal guidance that is realistic and practical for clients.

Sara has been quoted in numerous publications, including The Wall Street Journal, Law360, Fierce Healthcare, Becker’s Healthcare and Healthcare Info Security Podcast. She has also authored a variety of articles on privacy and data security in publications such as Westlaw Journal Computer and Internet, Journal of the American Health Information Management Association, The Group Practice Journal and Health Affairs. In addition, Sara served as an Editor-in-Chief of BakerHostetler’s annual Data Security Incident Response (DSIR) Report from 2021 to 2024. Sara has been invited to speak to organizations across the country about compliance with federal and state privacy laws and the incident response process. She also served as an adjunct professor of law at Drexel University, where she taught a course on the Health Insurance Portability and Accountability Act (HIPAA) and patient privacy.

core/freeform

J.D., Health Law, Drexel University Thomas R. Kline School of Law, 2011

B.A., Government and Italian, Smith College, 2008

<ul>
<li>Chambers USA: Privacy and Data Security: Healthcare, Nationwide
<ul>
<li>Up and Coming (2025)</li>
</ul>
</li>
<li>Law360: Cybersecurity and Privacy: Rising Star (2021)</li>
<li>The Pennsylvania Legal Intelligencer: Lawyers on the Fast Track (2021)</li>
<li>The Legal 500 United States
<ul>
<li>Media, Technology and Telecoms: Cyber Law (including data privacy and data protection) (2023 to 2025)</li>
</ul>
</li>
<li>The Best Lawyers in America®
<ul>
<li>&#8220;Ones to Watch&#8221; in Pennsylvania for Technology Law (2024 to 2025)</li>
</ul>
</li>
</ul>

Philadelphia

BakerHostetler attorneys and practice areas spotlighted in the 2025 Legal 500 annual guide

Chambers USA Guide 2025 Recognizes 171 BakerHostetler Attorneys and 73 Practice Areas

Sara Goldstein Speaks on “Fireside Chat with a Cybersecurity Defense Attorney” at GPSEC

Sara Goldstein Comments on Lessons Learned from Change Healthcare Ransomware Attack

Sara Goldstein Comments on UnitedHealth Group’s Data Breach Numbers in Healthcare Info Security Article

Sara Goldstein Comments on Proposed Revisions to HIPAA Security Rule

Sara Goldstein Comments on Healthcare Privacy Under Robert F. Kennedy, Jr.

6 Important Takeaways for HIPAA Covered Entities and Business Associates from 2024 NIST HHS OCR Conference

Sara Goldstein Comments on New Administration’s Impact on Health Sector Regs

BakerHostetler attorneys, practice areas stand out in The Legal 500 annual guide

DADM Practice Group Selected for Vault’s “Guide to Legal Practice Areas” for 7th Consecutive Year

Sara Goldstein Comments on Change Healthcare Breach in Wall Street Journal Article

Change Healthcare Incident: Update on ‘Impacted Data’ Analysis and Notification Plan

Sara Goldstein Discusses Significant Impact of the Change Healthcare Mega Hack on Podcast and in Several Articles

Theodore Kobus, Sara Goldstein, Lynn Sessions Weigh in On Change Healthcare’s Data Security Incident

Imminent Cybersecurity Threats to Healthcare Revenue Cycle Management

BakerHostetler Attorneys and Practice Areas Recognized in The Legal 500 2023 Guide

Pennsylvania’s Data Breach Notification Law Is Changing: What Does It Mean for Entities Doing Business in the Keystone State?

Sara Goldstein Addresses Cybersecurity for Cancer Centers Compliance Committee

Sara Goldstein Speaks at Incident Response Forum Europe 2022

Sara Goldstein Addresses CCI Healthcare Chief Legal Officer Roundtable

Sara Goldstein Presents to Tech Directors on Cybersecurity

Sounding the Alarm: New Federal Law Will Mandate the Reporting of Cybersecurity Incidents Involving Critical Infrastructure – What Companies Need to do now to be Prepared

Sara Goldstein Shares Cybersecurity Tactics with School Business Officials

Sara Goldstein Addresses Healthcare Cybersecurity on Career Series Panel

Sara Goldstein A Speaker at CCI Healthcare Chief Legal Officer Roundtable

Sara Goldstein Speaks on Cyber Threats

Sara Goldstein, Craig Hoffman Speak at American Council of Life Insurers Conference

Sara Goldstein Talks about Careers in Law and Technology

Sara Goldstein Speaks at Drexel Law School on HIPAA Law

New Director of HHS Office for Civil Rights Announced: What could Lisa J. Pino’s appointment mean for future HIPAA enforcement?

Digital Assets and Data Management

Healthcare Privacy and Compliance

Digital Risk Advisory and Cybersecurity

Industries

Healthcare

State Attorney General Enforcement, Investigations and Litigation

Enterprise Issues

Navigating the Risks of State Attorney General Enforcement Actions

<ul>
<li>Advises clients in the healthcare, energy, retail, financial, higher education, public and nonprofit sectors on responding to cybersecurity and data privacy incidents in the U.S. and abroad, ranging from phishing incidents to sophisticated, state-sponsored network intrusions.</li>
<li>Leads investigations of data security incidents, including the selection and engagement of third-party forensic investigators and interactions with law enforcement.</li>
<li>Provides clients with guidance on federal, state and international breach notification law requirements, as well as contractual notification obligations.</li>
<li>Drafts notification materials, including notification letters, press releases, website notices, internal client communications and regulatory notices.</li>
<li>Oversees the post-breach response process, including the preparation of responses to questions from notice letter recipients, employees, customers, the media and regulators.</li>
<li>Represents clients in post-breach investigations from the U.S. Department of Health and Human Services Office for Civil Rights, state insurance departments, state attorneys general (including multistate taskforce) and other regulators arising from large and small data security incidents.</li>
<li>Provides guidance on HIPAA, health information management and privacy to healthcare providers across the country.</li>
<li>Conducts data security training and tabletop exercises for companies to help them develop their incident response plans.</li>
<li>Develops comprehensive HIPAA privacy and security policies and procedures, business associate agreements, privacy notices and training materials.</li>
<li>Completed a secondment at one of the top cybersecurity insurance carriers in the world.</li>
<li>Provided on-site support and guidance to a large health insurer following the discovery of a data security incident involving the personal information of over 3 million individuals.</li>
<li>Drafted the regulatory notices for one of the largest data security incidents in history that involved the personal data of over 500 million individuals worldwide.</li>
<li>Served as vice president and general counsel for the second-largest provider of disclosure management and release of information services in the U.S.</li>
</ul>

Sara M. Goldstein

Sara M. Goldstein

Experience

Recognitions and Memberships

Insights and News

Prior Positions

Credentials

Languages

Community and Pro Bono

Areas of Focus

Enterprise Issues

Industries

Services

Featured Insights