Digital Health & Technology

Expert Analysis

• New Ariz. Cyberattack Info Sharing May Be Worth The Burden

  

  A recent amendment to Arizona’s data breach notification law, and similar state and federal cyber incident reporting rules, significantly burden companies that are attacked, but increased information sharing could help prevent and mitigate the damage from future data security incidents, say Christine Czuprynski and Kate Jarrett at McDonald Hopkins.

• Ransomware Risks For Health Cos. And How To Avoid Them

  Excerpt from Practical Guidance

  

  As the health care industry is a particularly valuable and vulnerable target of ransomware attacks, it's important for companies to understand possible attack methodologies and best steps for mitigating risks, says Nathan Kottkamp at Williams Mullen.

• What FDA Expects From Medical Device Cybersecurity Efforts

  

  The U.S. Food and Drug Administration's latest draft guidance on cybersecurity for medical devices highlights the distinction between safeguards that are "built in" rather than "bolted on," emphasizing the importance of robust design controls, say Jae Kim and Raymond Williams at DLA Piper.

• As Cyber Risks Surge, Remember Attorneys' Ethical Duties

  

  The prevalence of remote work and a greater threat of Russian cyberattacks should serve as a stark reminder of a lawyer's professional obligations to guard against unauthorized disclosure of client information and to protect client interests in the event of a cyberattack, says Alvin Mathews at Ulmer & Berne.

• Seeking Clarity On Medical Privacy In Fla. Class Actions

  

  When class actions are filed in Florida courts against medical service providers, even over issues other than medical treatment, and plaintiffs seek the names of other possible class members, the federal health privacy law and Florida's right to privacy are implicated — but the issue has yet to receive sufficient attention from the courts, says Aaron Weiss at Carlton Fields.

• Navigating Ambiguities In New Cyber Reporting Law

  

  The recently passed Cyber Incident Reporting for Critical Infrastructure Act requires increased cybersecurity defense and response disclosures, but owners and operators should take the law's lack of clarity on certain parameters into account as they prepare to comply, say attorneys at Holland & Knight.

• Preparing For New Mandatory Cyber Reporting Rules

  

  The requirements of a new federal law mandating cyber incident reporting for critical infrastructure will not become operational for several months, but affected companies should begin assessing whether their response plans incorporate critical policies and procedures to ensure compliance, say Steven Stransky at Thompson Hine and Lacy Rex at Oswald Companies.

• 5 Steps For Counsel Managing Health Care Data Breaches

  

  Considering the growing threat of data breaches and particular risks to health care providers and related companies, it is critical for counsel to take adequate steps to mitigate harm to patients, protect critical data, improve systems and navigate government investigations in the aftermath of a data security incident, say attorneys at K&L Gates.

• Addressing Patient Requests For Unauthorized Treatment

  

  Recent controversy over patient requests for ivermectin as COVID-19 treatment highlights the complex conversations and tricky compliance challenges that health providers must sometimes navigate when patients request nonstandard treatments, say John Dow, Kathleen Hogan and Catherine Adams at St. Peter’s Health Partners.

• Navigating Risks In FDA's New Digital Health Tech Guidance

  

  The U.S. Food and Drug Administration’s recent guidance highlights several key benefits and risks regarding the use of digital health technologies to collect data in remote clinical trials, so practitioners will need to address the legal ramifications, including potential liability and data privacy concerns, says Janice Sperow at Sperow ADR.

• Anti-Kickback Safe Harbors May Be Less Safe After Medtronic

  

  A California federal court's recent order denying dismissal in U.S. v. Medtronic improperly acknowledges intent as a liability factor in a suit alleging violations of the Anti-Kickback Statute, which is likely to erode certainty in statutory AKS safe harbor protections, says Scott Landau at Abell Eskew.

• How Health Care Cos. Can Prepare For DOJ's Cyberfraud Push

  

  Enforcement of the U.S. Department of Justice’s new cyberfraud initiative will initially occur largely through civil investigations that broadly apply the False Claims Act, so health care organizations should ensure that their practices can withstand hacks, whistleblowers and government scrutiny, say Katie McDermott and Mark Krotoski at Morgan Lewis.

• How Investors Can Navigate A Vibrant Digital Health Market

  

  With investment activity surging across the digital health care industry, investors must balance their interest in transformative technologies with the inherent risks of platforms and models that have yet to be fully proven, says Brian Gordon at McDermott.