HIPAA/Health Information Privacy, Security & Breach Response

Health care providers, clearinghouses, health plans, and their business associates face rigorous requirements under federal and state laws to protect health information. You need practical advice on how to manage not only the compliance, risk management, and litigation issues involved in PHI but also security incidents and breach events when they occur. Through it all, we are at your side.

Alston & Bird sits at the forefront of national law firms advising clients on health information privacy, security, and breach notification issues under federal and state laws. We have decades of experience advising our clients on Health Insurance Portability and Accountability Act (HIPAA) health information privacy, as well as security and breach issues, and developed HIPAA compliance plans. We have significant experience under HIPAA, the Health Information Technology for Economic and Clinical Health (HITECH) Act, and state health privacy laws, advising and representing clients in U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) investigations and compliance reviews, civil and criminal enforcement actions, and private litigation involving health information. We help you navigate these difficult issues, including identifying real strategies to achieve compliance and helping manage and resolve a breach crisis if one occurs.

Alston & Bird is there when you face an inadvertent or malicious breach of health information, including identifying immediate, proactive steps to mitigate potential harm. We recognize that no breach is the same, and we tailor our advice to the size and scope of the incident and its potential impact on you. Not all incidents are reportable under federal and state laws, and legal expertise is crucial in making that determination. If the breach is reportable under federal or state law, Alston & Bird can assist you with notifying government agencies and individuals as required and notifying/interacting with the media.

The HIPAA rules (and their state-level equivalents) are complicated, and the potential penalties for mistakes can be steep. Alston & Bird’s strength in HIPAA compliance enables you to navigate these complexities. We have developed HIPAA privacy and security compliance plans and work with your personnel in legal, compliance, and IT/technical capacities to educate on HIPAA requirements and ensure that compliance plans are consistent with your culture and fully integrated into your existing information security program.

You need a firm with a command of the issues and the capability to guide you through a crisis and the labyrinth of laws you’ll face: the federal HIPAA, Genetic Information Nondiscrimination Act (GINA), and HITECH Act and state laws such as California’s Confidentiality of Medical Information Act (CMIA) and Consumer Privacy Act (CCPA). Our team brings a unique combination of skills—knowledge of the laws governing health information breaches and security incident/crisis management and response experience—to assist you in managing and responding to a health information breach. With Alston & Bird, you have the right partner by your side.

Breach Response and Notification

Advised health care providers on COVID-19-related events, including breach analysis, interaction with media, and responding to individuals claiming to work with public health authorities.
Assisted financial services companies, health care providers, and insurance companies in their incident response efforts and follow-on regulatory inquiries on federal and state levels, including some of the largest HIPAA data breaches.
Advising clients on a hacking/IT incident experienced by a major health insurance company that served as the third-party administrator of their employer-sponsored group health plans.
Representing an academic medical center in connection with a breach arising from the loss of electronic media.
Advised a hospital on breach response issues in connection with a third party’s sophisticated hacking incident that went undetected for a time.
Advised clients, including a hospital, health care service provider, employer/group health plan sponsor, and insurer, on incidents and breaches arising from lost or stolen laptop computers and other mobile devices.
Advised a physician group on addressing a potential breach arising from misdirected faxes and several business-associate clients on potential breaches arising from packages lost, damaged, or misdirected during shipment.
Advised a hospital, as well as other clients, on incidents involving inappropriate access of the medical records of celebrity patients and the posting of pictures containing protected health information (PHI) to social media outlets.
Advised a hospital on an attempt by a business associate’s employee to sell PHI.

Regulatory Compliance

Assisted health care providers, employers, and other businesses with COVID-19-related privacy matters.
Assisted a health care system with conducting a HIPAA and state-law analysis assessing potential reporting obligations following an extensive cyber intrusion involving large amounts of data. When reporting obligations were identified, assisted with wording and transmittal of required notices, plus FAQs to be used by the health care system’s call center.
Counseled a for-profit corporation on compliance with HIPAA and state health and financial data security laws in 48 states after the potential theft of 50,000 patient records. Represented the client in the corresponding government investigation.
Developed comprehensive HIPAA privacy and security compliance programs for state hospital associations and various health care providers and health plans, including the preparation of forms, compliance manuals that contain all required policies and procedures, Internet-based training programs, monthly teleconference presentations, and staffing a HIPAA compliance hotline. Also developed comprehensive HIPAA privacy and security compliance programs for other clients, including several financial institutions and a transportation/package shipping company that ships medical products and devices.

Advising national health care clearinghouses and a physician practice billing and management company on their compliance with HIPAA Privacy, Security, and Transactions and Code Set Rules.
Advising health insurance companies, including a national health insurer and many other health care entities, on compliance with HIPAA rules.
Advised a medical device manufacturer/distributor, health plan, and pharmacy benefits manager on compliance with the HIPAA Privacy Rule requirements and limitations on marketing, including possible solutions and strategies. Also advised on the marketing and sale of health information scenarios under HIPAA and the laws of several states.
Advised on options for organizational structures for related companies (business associate, organized health care arrangement, and affiliated covered entity) to maximize client flexibility in complying with HIPAA Privacy and Security Rules.
Advised a national package carrier on compliance with privacy requirements through agreements with customers that are subject to HIPAA rules.

Government Investigations & Litigation

Advising a health care system on responding to a grand jury subpoena from the Department of Justice (DOJ) and U.S. Attorney’s Office regarding a data privacy breach and on conducting analysis of potential reporting obligations under state law and HIPAA. Assisted with identification, assessment, and handling of an insider threat in the internal investigation.
Represented a large plan sponsor in a review by HHS, OCR, and DOJ into whether the benefits personnel at the plan sponsor impermissibly listened to calls by health coaches and used that information in employment decisions for the sponsor’s employees. The investigation was formally dropped as a result of Alston & Bird’s efforts.
Represented a large hospital in Georgia in a voluntary self-disclosure involving medical records that were inadvertently published to the Internet by the company’s medical transcription vendor, mitigating follow-on litigation liability.
Represented a large pharmacy in a class action complaint alleging that the pharmacy’s transfer of its customers’ prescription records to another pharmacy violated their right to privacy.
Represented a hospital in response to a complaint submitted to HHS alleging noncompliance with the HIPAA Privacy Rule. The HHS investigation was resolved without sanctions.
Represented a physician group in response to a privacy complaint alleging improper disclosure of sensitive lab test results. As a result of new facts discovered during our investigation, the patient withdrew her complaint.
Represented a large health insurer during an HHS investigation into a stolen laptop that was resolved without any corrective actions or sanctions.
Represented health care providers in HIPAA complaints filed with OCR by disgruntled former employees, including with simultaneously filed EEOC complaints.

Contacts

Kimberly Kiefer Peretti

Partner

Washington, D.C.

Phone: +1 202 239 3720

Email: kimberly.peretti@alston.com

Dawnmarie R. Matlock

Partner

Atlanta

Phone: +1 404 881 4253

Email: dawnmarie.matlock@alston.com

Angela T. Burnette

Counsel

Atlanta

Phone: +1 404 881 7665

Email: angie.burnette@alston.com

Highlights

                            Press Release
                                                    June 6, 2024
                        Alston & Bird Adds Privacy, Cyber & Data Strategy Partner Jennifer Everett
                    
                                Alston & Bird has further enhanced its Privacy, Cyber & Data Strategy Team with the addition of partner Jennifer Everett to the firm’s Washington, D.C. office. With a focus on health care and emerging technologies, Jennifer advises clients on data privacy and complex cybersecurity.
                            

Highlights

Digital Transformation of Health Care