Breach Response and Notification

Managing and responding to a health information breach incident can be a complicated endeavor, especially when the breach is associated with a crisis for the client. It requires expertise in both federal and state laws—whether general breach notification laws or those specific to the health care industry—as well as in incident management and response. Alston & Bird’s HIPAA/Health Information Privacy, Security & Breach Response Team and its Cybersecurity Preparedness & Response Team bring a unique combination of skills—knowledge of the laws governing health information breaches and security incident/crisis management and response experience—to assist clients in managing and responding to a health information breach. Our team has a command of analyzing privacy and security incidents, especially the likely perspective of HHS, the agency that issues and enforces HIPAA regulations.

Alston & Bird advises clients when there is an inadvertent or malicious breach of health information, including identifying immediate, proactive steps to mitigate potential harm. We recognize that no breach is the same, and we tailor our advice to the size and scope of the incident and its potential impact on our client. From physician group practices and small hospital providers to large for-profit companies, and from covered entities to business associates, we have navigated companies through the various federal and state laws on privacy and security breaches of health and financial data. 

Not all incidents are reportable under federal and state laws, and legal expertise is crucial in making that determination. If the breach is reportable under federal or state law, Alston & Bird can assist clients with notifying government agencies and individuals as required and notifying/interacting with the media. And if a breach leads to a government investigation or civil or criminal litigation, Alston & Bird’s government investigations and litigation team has significant experience with health information breaches and can assist clients in resolving such matters as expeditiously and favorably as possible.

Regulatory Compliance

The HIPAA rules (and their state-level equivalents) are complicated, and the potential penalties for mistakes can be steep. Alston & Bird’s strength in the area enables clients to navigate these complexities.

We have developed HIPAA privacy and security compliance plans for clients and work with client personnel in legal, compliance, and IT/technical capacities to educate on HIPAA requirements and ensure that compliance plans are consistent with our client’s culture and fully integrated into their existing information security program.

We have devised comprehensive HIPAA training programs, as well as programs narrowly tailored to meet the training needs of specific employees with limited health-care-related functions—and various iterations in between.

Transaction Due Diligence

Alston & Bird’s corporate transactions lawyers routinely draw on the knowledge of our health information privacy and security lawyers to conduct HIPAA and HITECH Act due diligence and support client transactions involving health care entities or service providers. Working in tandem with our health information privacy and security lawyers, we are able to assess and contain risk associated with transactions involving HIPAA-covered entities, business associates, technology companies, and other entities that hold private and secure health information.

Government Investigations & Litigation

Alston & Bird has decades of experience supporting national and international clients on health information technology and privacy litigation, including significant data breach investigations. Our health information privacy and security lawyers advise and represent clients responding to OCR investigations and administrative enforcement proceedings involving the Privacy, Security, and Breach Notification Rules. Our government and investigations lawyers regularly advise health information technology companies, hospitals, physicians, payers, and other HIPAA-covered entities protecting the health information privacy of patients and customers, including in response to subpoenas, requests for production, search warrants, and motions to compel. We utilize Alston & Bird’s background in HIPAA, federal alcohol and drug abuse confidentiality regulations, and various state laws that protect certain diagnoses (e.g., HIV, AIDS, mental health, alcohol/drug treatment, genetic testing, developmental disabilities), as well as state laws that protect certain communications (e.g., privileges for psychiatrists, psychologists, social workers, and therapists). Our lawyers also represent clients in criminal investigations conducted by the U.S. Department of Justice (DOJ) concerning alleged HIPAA violations. 

• Developed comprehensive HIPAA privacy and security compliance programs for state hospital associations and various health care providers and health plans, including the preparation of forms, compliance manuals that contain all required policies and procedures, Internet-based training programs, monthly teleconference presentations, and staffing a HIPAA compliance hotline. Also developed comprehensive HIPAA privacy and security compliance programs for other clients, including several financial institutions and a transportation/package shipping company that ships medical products and devices.
• Advising national health care clearinghouses and a physician practice billing and management company on their compliance with HIPAA Privacy, Security, and Transactions and Code Set Rules. Advising health insurance companies, including a national health insurer and many other health care entities, on compliance with HIPAA rules.
• Advised clients, including a medical device manufacturer/distributor, a health plan, and a pharmacy benefits manager, on compliance with the HIPAA Privacy Rule requirements and limitations on marketing, including possible solutions and strategies. Also advised a client on the marketing and sale of health information scenarios under HIPAA and the laws of several states.
• Advised a client on options for organizational structures for related companies (business associate, organized health care arrangement, and affiliated covered entity) to maximize client flexibility in complying with HIPAA Privacy and Security Rules.
• Advised clients, including a national package carrier, on compliance with privacy requirements through agreements with customers that are subject to the HIPAA rules.

Government Investigations & Litigation

• Advising a health care system on responding to a grand jury subpoena from the Department of Justice (DOJ) and U.S. Attorney’s Office regarding a data privacy breach and on conducting analysis of potential reporting obligations under state law and HIPAA. Assisted with identification, assessment, and handling of an insider threat in the internal investigation.
• Represented a large plan sponsor in a review by the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) and DOJ into whether the benefits personnel at the plan sponsor impermissibly listened to calls by health coaches and used that information in employment decisions for the sponsor’s employees. The investigation was formally dropped as a result of Alston & Bird’s efforts.
• Represented a large hospital in Georgia in a voluntary self-disclosure regarding medical records that were inadvertently published to the Internet by the company’s medical transcription vendor, mitigating follow-on litigation liability.
• Represented a large pharmacy in a class action complaint alleging that the pharmacy’s transfer of its customers’ prescription records to another pharmacy violated their right to privacy.
• Represented a hospital in response to a complaint submitted to HHS alleging noncompliance with the HIPAA Privacy Rule. The HHS investigation was resolved without sanctions.
• Represented a physician group in response to a privacy complaint alleging improper disclosure of sensitive lab test results. As a result of new facts discovered during our investigation, the patient withdrew her complaint.
• Represented a large health insurer during an HHS investigation to a stolen laptop that was resolved without any corrective actions or sanctions.