On May 3, 2022, the European Commission published a proposed regulation (the “EHDS Proposal”) for the establishment of a European Health Data Space (or “EHDS”). This is the first proposal for establishing domain-specific common European data spaces following the European strategy for data and an important step in building a European “Health Union”.
In short, the
Please join Crowell & Moring’s Jodi Daniel and Elliot Golding on January 31, 2017 for an ABA webinar called Evolving HIPAA Issues: Cloud, Mobile Apps, Access, and More
This in-person panel discussion (with simultaneous webinar broadcast) will provide perspectives from the HHS Office for Civil Rights (OCR), the former director of the HHS Office of
Illinois State Court Issues First Settlement under Biometric Law
On December 1, 2016, the Cook County Circuit Court in Illinois approved what is being reported as the first settlement under the state’s Biometric Information Privacy Act, 740 ILCS 14/1 (BIPA or the Act). BIPA provides a private right of action against companies that fail to
Guidance on HIPAA & cloud computing; Senators question FTC enforcement standards
HHS publishes guidance on HIPAA’s impact on cloud computing
This week, the Department of Health and Human Services issued guidance for HIPAA-covered entities and business associates regarding cloud computing. When a covered entity seeks to use cloud services in connection with the use
HHS Jumps on the Cybersecurity Information Sharing Bandwagon; Third Circuit on Economic Loss as a basis for Negligence Claim; FTC workshop on Ransomware; German draft implementing law for GDPR revealed.
HHS Jumps on the Cybersecurity Information Sharing Bandwagon
Because of recent news reports confirming that cyberattacks against healthcare agencies have increased 125 % in the past five years, HHS is encouraging HIPAA Covered Entities and Business Associates to share information to combat future attacks.
HHS, based on authority from Executive Order 13591 and the Cybersecurity Information Security Act (CISA), is urging Covered Entities and Business Associates to join Information Sharing and Analysis Organizations (ISAOs) to share security threat and vulnerability information related to electronic protected health information (ePHI).
Ideally, ISAOs will provide a mechanism for sharing information bi-directionally “between HHS and the Health Care and Public Health (HPH) sector regarding cyber threats and will also provide outreach and education to the HPH sector.” This press release from HHS follows a similar measure by the Department of Homeland Security, which also encourages information sharing to mitigate the risk of cyberattacks.
In developing ISAOs in the health care sector, it is critical to consider three things:
Crowell & Moring is a leading expert in the creation of ISAOs and HIPAA compliance and can help stakeholders that seek to comply with HHS’s call to action to consider the intersection of these various legal frameworksContinue Reading Privacy & Cybersecurity Weekly News Update – Week of September 12
Last month, the Office of the National Coordinator for Health Information Technology (“ONC”) sent a report to Congress highlighting the absence of adequate privacy and security safeguards for health data collected by entities not regulated by HIPAA. For a discussion regarding the next steps to address these privacy and security gaps, please see our recent
The National Telecommunications and Information Administration (NTIA) has published a request for comment on federal policy related to the Internet of Things (IoT). For more information, please refer to our post on C&M Health Law. Crowell & Moring is available to assist in preparing comments in advance of the May 23,2016 filing deadline.
On Tuesday, the FTC simultaneously released a “Mobile Health App Interactive Tool” and “Best Practices,” to help mobile health app developers navigate the maze of federal regulation, including data privacy regulation. The tool walks developers through a series of high level questions about the nature of their app, and uses the
The day before Thanksgiving, the HHS Office of Civil Rights (OCR) announced its first settlement involving a reported data breach implicating security of medical devices used in the hospital setting. OCR’s $850,000 settlement and resolution agreement with Lahey Hospital and Medical Center (LHMC) stem from the theft of a laptop workstation used to operate and produce images from a portable CT scanner from an unlocked treatment room on August 11, 2011.
Consistent with OCR’s past practice, OCR launched in-depth investigations that uncovered additional alleged HIPAA Security Rule violations following LHMC’s required breach reports to OCR. As part of its resolution agreement, LHMC agreed to update its security policies and procedures and comply with extensive training and reporting requirements conditions of a corrective action plan for two years.
The LHMC resolution is especially noteworthy for several reasons. At the outset, it is the first OCR resolution specifically involving a medical device in a hospital setting, as opposed to ePHI that hospitals store in EMRs/EHRs. Second, the number of individuals affected was relatively low compared to other incidents with comparably large settlements (only 600 people), which shows OCR is focused equally on large and small incidents.Continue Reading HHS-OCR Announces First Settlement Involving Medical Device Security Issues