Aimee Jachym and Samantha A. Kopacz of Miller Canfield PLC write: New guidance issued by the U.S. Department of Health & Human Services (HHS) Office for Civil Rights (OCR) reaffirms that business associates must have proper HIPAA compliance practices, safeguards and documentation in place in order to avoid costly penalties. OCR recently released a Fact…
Category: Breach Laws
Ca: Alleged HIV/AIDS privacy breach in 2016 could become class-action suit against Positive Living Society of British Columbia
Jeremy Hainsworth reports: A Vancouver-based HIV/AIDS organization is facing a class-action suit for breach of privacy after an alleged release of email addresses of 800 of its members via a September 2016 mass email. And, said a BC Supreme Court ruling released May 1, a staff member of Positive Living BC had warned the organization…
United Arab Emirates: New law regulating data in the health sector
DLA Piper writes: The United Arab Emirates (UAE) federal government has issued Federal Law No. 2 of 2019 on the Use of Information and Communication Technology (ICT) in Health Fields (“ICT Health Law”). The objectives of this law are to: ensure the optimal use of ICT in health fields; ensure safety and security of health…
New Requirements for FTC Data Security Settlements
Katherine E. Armstrong of Drinker Biddle & Reath LLP writes: Two of the Federal Trade Commission’s (FTC’s) most recent data security settlements include new requirements that go beyond previous data security settlements. The new provisions (1) require that a senior corporate officer provide to the FTC annual certifications of compliance and (2) specifically prohibit making…
Washington AG Ferguson bill strengthening data breach laws passes Legislature
From the Washington Attorney General’s Office yesterday, a press release on an expansion of the breach notification requirements. Of special note, under the new law, a hacker acquiring a name in combination with a student ID would trigger notification obligations, but only if the information was not secured or made unusable (e.g., by encryption) AND …
Elizabeth Warren proposes holding execs criminally liable for scams and data breaches
Cory Doctorow reports: A new bill from Senator Elizabeth Warren proposes personal, criminal liability for top executives of companies turning over more than $1B/year when those companies experience data breaches and scams due to negligence (many of the recent high-profile breaches would qualify, including the Equifax giga-breach, as well as many of Wells Fargo’s string…