Data Privacy

Subscribe to Data Privacy

On January 14, 2021, the U.S. Court of Appeals for the Fifth Circuit overturned a $4.348 million penalty for alleged HIPAA violations assessed by the U.S. Department of Health & Human Services (HHS) against the University of Texas M.D. Anderson Cancer Center (Hospital). The case arises from an enforcement action undertaken by HHS following the Hospital’s self-disclosure of three separate instances of lost or stolen portable devices containing electronic protected health information (ePHI). The government’s investigation determined that the devices were not encrypted, and that the Hospital’s failure to encrypt the devices to protect the ePHI contained therein constituted a violation of HIPAA’s Privacy and Security Rules. After HHS imposed the penalty in 2017, the Hospital appealed the penalty first to an Administrative Law Judge, and then to HHS’s Departmental Appeals Board before petitioning the Fifth Circuit for review in 2019 (see our prior analyses of this case here).
Continue Reading Fifth Circuit Overturns “Arbitrary and Capricious” $4.3 Million HIPAA Penalty Against Hospital

Just before the new year, the Department of Health and Human Resources (HHS) released voluntary cybersecurity practices for health care organizations, which consists of a main document, two technical volumes, and resources and templates that were compiled by more than 150 cybersecurity and health care experts.
Continue Reading HHS Issues Cybersecurity Practices for Health Care Industry

On January 24, 2016, the U.S. Court of Appeals for the Second Circuit denied the Department of Justice’s request for an en banc rehearing in In the Matter of a Warrant to Search a Certain Email Account Controlled and Maintained by Microsoft Corp. a/k/a Microsoft Corp. v. United States (No. 14-2985). The denial leaves in place a controversial decision by a three judge panel that quashed a warrant obtained by the DOJ under the Stored Communications Act (SCA) seeking the contents of a Microsoft customer’s emails. The majority panel unanimously held on July 14, 2016 that the DOJ’s attempt to procure the contents of the emails via an SCA warrant constituted an impermissible extraterritorial application of the SCA because the server on which the emails were stored is located in Ireland.
Continue Reading Second Circuit Denies En Banc Rehearing in Microsoft Email Case