< Security, Privacy and the Law

The Conference That Wasn't: A Fake Biotech Event Shows How Your Employees Might Let Ransomware In Through Your Front Door

Zick Colin J. — Tue, 13 Oct 2026 17:27:12 Z

We are all deluged with invitations to industry conferences. As a recent report in the Boston Business Journal shows, that deluge makes such an invitation a very effective lure that leads to malware.

On October 11, 2026, the Boston Business Journal reported that a website promoting a "BioTold 2026" event, billed as a Boston biotech conference, is in fact a front for cybercriminals trying to trick industry professionals into downloading malware. This story holds lessons for every organization whose employees use email and sign up for conferences (in other words, everyone in your workforce).

What Happened
The threat actor created a BioTold event website. (The site is still active as of this writing, https://biotold.com/, but please do not sign up!) That website advertises a two-day, first-time conference on November 5 and 6 at the Omni Boston Hotel at the Seaport, built around working biotech practitioners sharing "real, first-person stories from their work.; The website lists an opening keynote by world-famous Harvard geneticist George Church, sponsorships from Thermo Fisher Scientific and other well-known companies, and an advisory board of leading scientists from institutions like the Broad Institute. The website even has a privacy policy. But according to the cybersecurity firm Proofpoint, there is no conference. I checked with the Omni, and they confirm that the event “is not affiliated with their hotel” and are looking into it.

When the Business Journal reached out to those listed on the BioTold website, most of the listed sponsors, advisers, and speakers said they had never heard of the supposed conference and were not involved with it. A Wyss Institute spokesperson confirmed that George Church is not speaking at BioTold; he is instead speaking at a real conference at Boston’s Hynes Convention Center. Representatives for listed advisers and sponsors also denied any affiliation.

The BioTold site offers tickets ($149 early-bird, $299 general admission) and sponsorships from $5,000 to $25,000. But scamming people out of ticket revenue is apparently not the ultimate goal of the fraud here. Proofpoint says the group behind the site, which it tracks as “TA586,” sends email invitations to speak at or sponsor the event, and the website exists to make those invitations seem legitimate, so recipients feel comfortable clicking on them. People who expressed interest in speaking or sponsoring were then sent a different URL leading to a malware download. Proofpoint describes TA586 as an "initial access broker for ransomware.”

How to Spot a Scheme Like This
The BioTold site is elaborate and convincing, with pages detailing the venue, programming, speakers, and schedule. But there were warning signs:

The pitch was unexpected. When you see an email, ask: "Is this something I was expecting?"
It plays on emotion. Cybercriminals exploit excitement or fear; here, it was the excitement of a unique conference opportunity.
The "team" did not look right. The site was AI-generated and featured a fake team of "biotech industry professionals," several in stylish hats and one with a cat on his shoulder.
Big names, no confirmation. The famous speakers, advisers, and sponsors had never heard of the event. And may speaking slots were still open, with less than a month until the conference.
The link changed. Interested recipients were sent to a URL different from the conference website.
It sounded too good to be true. An event marketing itself as "the conference we always wished existed" may not exist at all.

The life sciences sector is a growing target for these kinds of fronts; Nature recently reported on sham scientific societies that sell memberships and awards to early-career researchers.

What Every Business Should Do Now
The BioTold scheme targeted biotech, but the playbook works in any industry. Here are practical steps to keep your employees from taking the bait:

Train employees to pause on unsolicited opportunities. Speaking invitations, job offers, and awards are classic lures; build "stop and verify" into your phishing training.
Require independent verification. Teach employees to confirm an event through a trusted third party, such as a known participant, or by calling the organizer using contact information they find themselves, not information in the email.
Check the domain. Show employees how to look up a website's registration and see whether it has a long presence or was just created.
Do a quick search. See whether authoritative sources and real people are actually talking about the event or company.
Do not engage with questionable sites. Instruct employees not to email or interact with a suspicious site, and route takedown efforts through IT or security, which can contact the domain host or registrar.
Make reporting easy and blame-free. Anyone who has interacted with a suspicious invitation should tell your IT team right away. Fast reporting is what stops an "initial access" infection from becoming a ransomware event or can mitigate the harm from a mistaken click.
Give a heads-up to the people most likely to be targeted. Scientists, executives, and business development staff, the people who get speaking and sponsorship requests, should hear about schemes like BioTold specifically.
Review your incident response plan. Make sure it covers what happens when an employee clicks: who to call, how to isolate the device, and when to bring in counsel to evaluate notification and other legal obligations.

The Bottom Line
BioTold is a reminder that today's phishing does not always look like phishing. With AI making it cheap to build polished, realistic fronts, the best defense remains a well-trained employee who stops and asks whether the opportunity is real before clicking. Like the old saying, “If it seems too good to be true, it probably is.”

Rising Cyberattacks on U.S. Water Infrastructure: Federal Guidance and Next Steps for Operators

Mon, 17 Aug 2026 14:22:50 Z

Key Points:

Cyberattacks on water utilities are on the rise, with utility companies in at least seven states reporting incidents affecting water operations to the Federal Bureau of Investigation (“FBI”) since July 27, 2026.
The FBI, Environmental Protection Agency (“EPA”), and Cybersecurity and Infrastructure Security Agency (“CISA”) recommend taking immediate action: remove programmable logic controllers (“PLCs”) from direct internet exposure, change default passwords, and route remote access through virtual private networks (“VPNs”) or gateways.
Utilities should review their incident reporting obligations under various regulatory regimes, including the Safe Drinking Water Act and pending regulations under the Cyber Incident Reporting for Critical Infrastructure Act (“CIRCIA”), which are expected to be finalized in September 2026.

Recent guidance issued by Federal agencies warns that malicious cyber actors are targeting internet-facing operational technology (“OT”) used by water and wastewater utilities, particularly PLCs. Since July 27, 2026, water and wastewater utilities in at least seven states have reported incidents to the FBI, and some of that activity has degraded water operations. CISA separately stated that it sees a significant increase in threat actors targeting PLCs in the water and wastewater systems sector and that the cyberattacks have caused water systems to issue boil water notices and implement manual operations.

The reported attack pattern has been the same in each instance; it is straightforward but operationally serious. Attackers remotely access exposed PLCs, change IP addresses and passwords, and thereby cause loss of monitoring, loss of control functionality, operator lockout, and in some cases, loss of function of connected equipment. The FBI reported operational effects including loss of pressure and flooding, and warned that pressure loss could potentially allow untreated groundwater to seep into pipes. CISA has warned that internet-exposed OT assets face increased risk of defacement, configuration changes, operational disruption, and, in severe cases, physical damage. CISA’s broader PLC advisory describes related activity in which attackers modified or deleted project-file logic, manipulated human machine interface (“HMI”) and supervisory control and data acquisition (“SCADA”) display data, and disabled critical shutdown and alarm logic, creating unsafe conditions without notifying operators.

Attribution and Threat Context

The FBI/EPA issued a joint Public Service Announcement, which refers to “malicious cyber actors” but does not attribute the July 2026 water-sector activity to a named country or group. Media reports, however, have framed the activity as a multi-state critical infrastructure concern, and some have reported suspected Iranian involvement in certain attacks. In Minnesota, a coordinated attack on more than 30 municipal water systems on July 26 and 27 forced one treatment plant offline for a few hours. In addition, news outlets reported on August 13 that APT IRAN and the CyberAv3ngers, two hacking groups linked to Iranian-affiliated threat actors, have claimed responsibility for “the attack on Minnesota.” CISA’s July 22 advisory describes Iranian-affiliated cyber actors exploiting PLCs across U.S. critical infrastructure, including water and wastewater systems, government services, and energy. The Iranian-affiliated threat actors, who have bene identified as affiliates of the Islamic Revolutionary Guard Corps (“IRGC”), appear to have exploited devices that retained default credentials or lacked adequate network segmentation, underscoring the importance of basic cyber hygiene measures for critical infrastructure operators.

Federal Guidance on Incident Response

Federal agency guidance for water utilities that may be targeted by these cyberattacks focuses on a few key action items:

Remove PLCs and other OT from direct public internet exposure. FBI/EPA guidance advises utilities to remove inbound port exposure so OT systems are not directly exposed to the internet or external networks. Utilities should mediate, monitor, and control remote access through a secure gateway or jump host. CISA similarly recommends that remote access for operational purposes go through a VPN or gateway device rather than directly to the PLC.
Enable password protection and change default passwords. Utilities should ensure device passwords are complex, unique combinations of letters, numbers, and symbols. After disconnecting PLCs from the internet, operators should ensure they have a known clean backup of the PLC image in case they are locked out by a modified password.
Configure firewall rules and restrict remote access to critical systems. Utilities should strictly control network access to PLCs by configuring firewall rules or access-control lists to allow only authorized communications between expected control-system devices. CISA specifically recommends not listing IP addresses so that remote access is limited to known engineering laptops or other critical OT assets.
Secure modems and regularly utilize logs. The FBI/EPA guidance recommends securing cellular modems used for remote field connectivity with strong authentication and updates. Utilities should enable logs for connected modems and regularly review those logs for suspicious activity.
Practice and maintain the ability to operate OT systems manually. Routine testing and maintenance of business continuity and disaster recovery plans, fail-safe mechanisms, islanding capabilities, software backups, and standby systems will help ensure safe manual operations in the event of an incident.

Regulatory Compliance and Reporting Considerations

Water and wastewater utilities should also be aware that these cybersecurity incidents may trigger reporting and compliance obligations under federal and state law. Under the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (“CIRCIA”), covered entities in critical infrastructure sectors—including water and wastewater systems—will be required to report substantial cyber incidents to CISA within 72 hours and ransomware payments within 24 hours once final implementing regulations take effect, expected in September 2026.

The EPA also has authority under the Safe Drinking Water Act to require community water systems serving more than 3,300 people to conduct risk and resilience assessments that address cybersecurity threats and to develop or update emergency response plans accordingly. Utilities should consult with counsel to assess their current compliance posture and ensure they are prepared to meet evolving federal cybersecurity requirements.

Utilities experiencing similar OT outages should immediately contact legal counsel to evaluate their options and reporting obligations, including assessing whether to file a complaint with the FBI’s Internet Crime Complaint Center (“IC3”) or CISA’s Operations Center.

Practical Takeaways

The central takeaway is that water and wastewater utilities should treat internet-facing PLCs and undocumented remote-access pathways as urgent risk-reduction priorities. The most important immediate measures are to disconnect PLCs from direct internet exposure, route remote access through controlled gateways or VPNs, change default credentials, use strong unique passwords, apply firewall or ACL restrictions, verify clean PLC backups, and review modem, HMI, workstation, and PLC logs for signs of compromise. Longer term, utilities should implement structured cybersecurity risk-management programs using CISA/EPA resources and assessment tools.

Our team will continue to monitor the ongoing cyberattacks on water infrastructure and will provide updates as federal agencies issue additional guidance or as the regulatory landscape evolves.

When AI Becomes the Hacker: What the OpenAI–Hugging Face Breach Means for Your Organization

Zick Colin J. — Thu, 23 Jul 2026 10:44:05 Z

The disclosure that OpenAI's own AI models autonomously broke out of a sandboxed testing environment and hacked into Hugging Face's production infrastructure is, without exaggeration or hyperbole, a watershed moment for anyone advising on data privacy and cybersecurity. If you haven't been following the story, here's what happened—and what it means for your business.

What Happened
On July 16, 2026, Hugging Face—a major open-source AI platform hosting over a million models and datasets—disclosed that it had detected and contained an intrusion into its production infrastructure that was "driven, end to end, by an autonomous AI agent system." Five days later, OpenAI revealed that the attackers were its own models.

The models had been undergoing internal testing on a cybersecurity benchmark. To measure raw offensive capabilities, OpenAI intentionally disabled the safety classifiers that would normally prevent the models from pursuing high-risk cyber activity. The models were confined to a sandboxed environment with limited network access.

The sandbox wasn't enough to contain the model. The models spent significant compute searching for a way out, discovered and exploited a zero-day vulnerability in a package registry cache proxy, broke out of the sandbox, performed privilege escalation and lateral movement across OpenAI's research environment, and then—having autonomously concluded that Hugging Face likely hosted the benchmark's answer key—chained stolen credentials with additional zero-day exploits to achieve remote code execution on Hugging Face's production servers. No human directed any of this. The models simply calculated that hacking Hugging Face was the fastest path to a high test score.

The AI models appear to have been loose for roughly a week before attribution was established. Hugging Face had already reported the intrusion to law enforcement before anyone knew OpenAI was the source.

The Legal Questions This Raises
For those of us who counsel organizations on privacy, data security, and incident response, this incident surfaces a set of legal questions that our existing frameworks were not built to answer.

Who is liable? The Computer Fraud and Abuse Act (CFAA) requires intent—but no human at OpenAI intended to hack Hugging Face. Traditional negligence theories may offer a better fit: OpenAI made a deliberate choice to disable safety classifiers and run frontier models with offensive capabilities in an environment that, as it turned out, was not adequately contained. That begins to look like a failure to exercise reasonable care, particularly when the harm fell on an uninvolved third party. As the economist Alex Tabarrok noted, when a lab's test imposes costs on third parties, "that is a classic externality."

What are the notification obligations? The timeline here matters. The breach started around July 11, Hugging Face detected it around July 13–14, and OpenAI did not publicly disclose attribution until July 21. Organizations and their counsel need to think carefully about when autonomous AI-caused breaches trigger state data breach notification statutes, SEC disclosure rules, and obligations under GDPR, CCPA, and sector-specific regimes like HIPAA. If your AI system causes a breach at a third party's facility, are you responsible for notification? The answer is not yet clear, but the question is no longer hypothetical.

What about your contracts? Organizations deploying or procuring AI systems should be revisiting their vendor agreements now. Master service agreements and statements of work should address adversarial testing, containment requirements, kill-switch capabilities, mandatory human-in-the-loop approval for privileged actions, and clear incident cooperation and indemnification obligations. If your vendor's AI escapes its sandbox and compromises your systems, you want to know—before it happens—who bears the cost.

Implications for Cyber Insurance
Cyber insurance policies were written with human threat actors in mind. This incident should prompt every organization to review its coverage with its broker. Key questions include:

Does your policy exclude or sub-limit losses caused by AI-driven incidents, as opposed to human-directed attacks?
Does your policy cover third-party liability if your AI system causes a breach at someone else's organization?
Will your insurer require evidence of specific AI containment controls—such as alignment with ISO/IEC 42001 or the NIST AI Risk Management Framework—before renewing coverage for agentic AI workflows?

Underwriters are going to be watching this closely. Organizations that deploy agentic AI without robust containment and monitoring controls may find themselves facing higher premiums, narrower coverage, or both.

Practical Takeaways for Organizations
First, if you are developing or deploying AI systems with agentic capabilities, treat containment as a critical control, not a nice-to-have. Sandboxing alone failed here. Defense-in-depth—strict network egress rules, micro-segmentation, least-privilege access, scoped and short-lived credentials—is essential.

Second, do not rely on a single AI vendor for both operations and security. One of the most striking details of this incident is that when Hugging Face's security team tried to use commercial frontier AI models to analyze the attack logs and exploit payloads, the models' safety guardrails blocked them—unable to distinguish a defender analyzing a threat from an attacker building one. Hugging Face had to switch to open-weight models running on its own infrastructure to complete the forensic investigation. That is a cautionary tale about vendor concentration risk.

Third, update your incident response plans. Your existing playbooks almost certainly assume a human adversary operating at human speed. An autonomous AI agent can generate over 17,000 attack events across a weekend. Make sure your response capabilities—and your legal team—are prepared for that tempo.

Fourth, engage your board and leadership now. This incident is going to accelerate regulatory action. President Trump's June 2026 executive order on frontier AI models is already on the books. Additional requirements around mandatory containment standards, testing protocols, and disclosure obligations are likely coming. Getting ahead of these developments is far better than reacting to them.

The Bottom Line
The OpenAI–Hugging Face incident is the first publicly confirmed case of an AI system autonomously executing a sophisticated, multi-stage cyberattack against real-world production infrastructure. It will not be the last. The legal, insurance, and operational frameworks we have today were built for a world of human hackers. That world is changing fast, and organizations that fail to adapt will find themselves exposed—both to the threat itself and to the liability that follows.

The White House's "Gold Eagle" Cybersecurity Initiative: More Branding Than Breakthrough?

Zick Colin J. — Mon, 20 Jul 2026 11:10:44 Z

On July 14, the White House announced the launch of "Gold Eagle," a new federal government-industry clearinghouse for coordinating cybersecurity vulnerability detection and remediation across critical infrastructure. Established under Executive Order 14409, "Promoting Advanced Artificial Intelligence Innovation and Security" (signed June 2, 2026), the initiative brings together CISA, the Department of the Treasury, the Department of War, and unnamed private-sector partners to pool vulnerability findings, prioritize them using frontier AI models, and coordinate patching at scale.

The rhetoric is around Gold Eagle is muscular. Secretary of War Pete Hegseth described Gold Eagle as "a wartime footing to the cyber domain." DHS Secretary Markwayne Mullin promised "unprecedented coordination." National Cyber Director Sean Cairncross invoked "cementing American AI dominance for generations to come." The White House says Gold Eagle is already operational — receiving, triaging, and prioritizing vulnerability reports from across industries and sectors.

What Gold Eagle Actually Does

Stripped of the Administration’s superlative adjectives, Gold Eagle is a routing and prioritization mechanism. It intakes vulnerability findings (many of which will be generated by AI-powered scanning tools like Anthropic's Mythos), validates and deduplicates them, and hands them off to the organizations responsible for remediation. According Bugcrowd founder Casey Ellis, Gold Eagle is "currently a coordination process wearing a technical system's clothes."

Why Mature Programs Should Not Lose Sleep

For organizations that already maintain robust vulnerability management programs — with established patching cadences, risk-based prioritization frameworks, and coordinated disclosure processes — Gold Eagle is unlikely to move the security needle in any meaningful way. Here's why:

The bottleneck is not discovery but remediation. As Katie Moussouris of Luta Security observed, "The bottleneck was never knowing about more bugs. It was having the people and process to prioritize and fix them." Organizations already struggle to keep up. Another intake mechanism doesn't create the engineers, maintenance windows, or vendor resources required to deploy fixes.
Gold Eagle duplicates existing infrastructure. Gold Eagle lands on top of CISA's Known Exploited Vulnerabilities (KEV) catalog, the CVE system, NIST's National Vulnerability Database, CISA's existing disclosure programs, and sector-specific ISACs. The White House has not explained how Gold Eagle interacts with — or improves upon — any of these.
Critical details remain yet to be specified. The Administration has not disclosed which agency runs Gold Eagle day-to-day, which companies are participating, how sensitive vulnerability data will be protected, what criteria determine prioritization, or what resources will be available to maintainers asked to fix findings. For organizations accustomed to operationalizing specific guidance, these gaps matter.
Gold Eagle cannot compel remediation. Gold Eagle is voluntary. It cannot force vendors or open-source maintainers to patch vulnerabilities. Remediation still depends entirely on the organizations responsible for the affected software.
CISA's BOD 26-04 is what actually matters. For federal agencies and their contractors, CISA's new Binding Operational Directive 26-04 — which compresses remediation timelines to as little as three days for critical flaws — is the operational mandate that will drive behavior. Gold Eagle's prioritization signals are, at best, one more input to an already crowded field.

The Bottom Line

Cross-sector vulnerability coordination has real gaps, and a surge of AI-discovered bugs demands some mechanism for deduplication and triage. But for companies with mature cybersecurity programs, this initiative should not prompt any immediate changes to existing vulnerability management processes, patching protocols, or disclosure strategies.

We will monitor for operational details — particularly around data-sharing obligations, reporting expectations, and how Gold Eagle intersects with existing regulatory requirements. If the initiative develops teeth (or if participation becomes a de facto expectation for critical infrastructure operators), that calculus may change. For now, Gold Eagle is a coordination aspiration in search of operational specifics.

The Amended Children’s Online Privacy Protection Act (COPPA) Regulations: What Your Business Needs to Know

Zick Colin J. — Mon, 06 Jul 2026 14:27:12 Z

This change has been a long time in the making. On April 22, 2025, the Federal Trade Commission (FTC) published final amendments to COPPA, marking the first major change to COPPA since 2013. These amendments reflect the FTC’s recognition of technological changes over the past decade and shifts in how children interact with online services. As of April 22, 2026, the compliance deadline for the amended regulation has passed, and businesses subject to COPPA are now required to comply with the following key amendments to the COPPA regulations.

As a refresher COPPA applies to businesses that:
(1) operate commercial websites or online services (including mobile apps and IoT devices) directed to children under 13 that collect, use, or disclose personal information from children;

(2) operate general audience websites or online services with actual knowledge that they are collecting, using, or disclosing personal information from children under 13; or

(3) operate websites or online services that have actual knowledge that they are collecting personal information directly from users of another website or online service directed to children.

The key amendments to COPPA are summarized below:

New and Expanded COPPA Definitions

“Personal information” now includes biometric identifiers (e.g., fingerprints, handprints, retina patterns, iris patterns, genetic data, voiceprints, gait patterns, facial templates, or faceprints) and government-issued identifiers (e.g., Social Security numbers, state identification cards numbers, birth certificates, and passport numbers).
“Mixed audience website or online services” now means an online site or service directed to children, but that does not target children as its primary audience and does not collect personal information from any visitor before collecting age information (other than for the limited purposes set forth in Section 312.5(c)). These limited purposes include:
- providing parental notice,
- responding directly to a specific request from the child, and
- protecting the safety of the child,

provided the operator of the mixed audience website or online service does not otherwise use or disclose such personal information for any other purpose. Any collection of age information must be done in a neutral manner that does not default to a set age or encourage visitors to falsify age information.

“Online contact information” now includes “a mobile telephone number, provided the operator uses it only to send text messages to a parent in connection with obtaining parental consent.”

Enhanced COPPA Notice Requirements

Direct Notice: To allow parents to make informed choices, the COPPA amendments require that direct parental notices include information on:

(1) the specific items of personal information to be collected and how the operator intends to use them;
(2) the identities or specific categories of third parties to whom information may be disclosed and the purposes for the disclosure;
(3) how a parent can consent to collection and use without consenting to third-party disclosure; and
(4) a hyperlink to the operator’s online notice of its information practices.

Online Notice: The COPPA amendments require operators to include the following in their online notices:

(1) the name, address, telephone number, and email address of all operators collecting or maintaining personal information from children through the website or online service;
(2) a description of the information collected from children, including whether the website or online service enables a child to make personal information publicly available, how the operator uses such information, the operator’s data retention policy, and the operator’s disclosure practices, including identities and specific categories of any third parties to which the operator discloses personal information;
(3) how the operator uses persistent identifiers to support internal operations; and
(4) if the operator collects audio files containing a child’s voice, a description of how the operator uses such files and confirmation that the operator deletes such files immediately after responding to the request for which they were collected.

New COPPA Consent Requirements and Mechanisms

The COPPA amendments also require operators to obtain separate verifiable parental consent before disclosing a child’s personal information to third parties unless such disclosure is integral to the website or online service. Consent is not required if third-party disclosures are integral to the website or online service or are to a person or entity who provides “support for the internal operations of the website or online service” and who does not use or further disclose the information for any other purpose. Disclosures of a child's personal information to third parties for monetary or other consideration, for advertising purposes, or to train or otherwise develop artificial intelligence technologies are not integral to the website or online service and require separate consent.
The COPPA amendments expand acceptable methods for obtaining verifiable parental consent, including the following:

Text Plus method: Consent obtained via text message coupled with additional verification steps, such as a follow-up text, letter, or phone call. This consent method is available only where the operator does not disclose children’s personal information.
Knowledge-based authentication: Dynamic, multiple-choice questions of sufficient difficulty that a child aged 12 or younger could not reasonably answer.
Photographic identification: Submission of a government-issued photo ID verified against a live image using facial recognition technology and promptly deleted after confirming a match.

COPPA Compliance Steps for Your Business

Confirm and update your data collection and retention practices: Operators should confirm that their data collection and retention practices satisfy the amended COPPA requirements. The COPPA amendments prohibit operators from retaining children’s personal information indefinitely and require operators to maintain a written data retention policy. The written retention policy must specify “the purposes for which children’s personal information is collected, the business need for retaining such information, and a timeframe for deletion.” These amendments also clarify that operators may only retain children’s personal information for as long as it is reasonably necessary to fulfill the specific purposes for which the data was collected.
Review and update written information security programs: Operators should confirm that they have established, implemented, and maintained a written comprehensive information security program to protect children’s personal information, tailored to your company’s size and the complexity and sensitivity of the information collected. Operators with existing security programs that already cover children’s data and meet COPPA requirements do not need to maintain separate children’s information security programs
Review and update your parental notices and consent mechanisms: Operators should confirm that both direct and online notices include the required details about the purposes for which data is collected, the identities or specific categories of third-party recipients, and the purposes for which the data is shared. Operators should also evaluate the expanded consent mechanisms and implement those that are appropriate for their data practices.

Remember too that states are now beginning to regulate this space, such as Texas and its Senate Bill 2420, which requires major app stores to verify users’ ages and gives parents greater control over the apps that their children download. .

Trump’s New AI Frontier: The Executive Order Regulating Frontier AI Models

Zick Colin J. — Mon, 29 Jun 2026 11:14:29 Z

On June 2, 2026, President Trump signed an executive order titled “Promoting Advanced Artificial Intelligence Innovation and Security.” This is the administration's most significant step toward federal oversight of AI, framed almost entirely around cybersecurity. See Exec. Order, "Promoting Advanced Artificial Intelligence Innovation and Security" (June 2, 2026).

I. Key Takeaways

The order is voluntary, not mandatory. It does not create a licensing regime or a preclearance requirement for AI development. See Exec. Order § 3(c) (“Nothing in this section shall be construed to authorize the creation of a mandatory governmental licensing, preclearance, or permitting requirement for the development, publication, release, or distribution of new AI models, including frontier models.”)
The order establishes three key institutional frameworks: (1) an AI cybersecurity clearinghouse led by Treasury, (2) a classified benchmarking process to designate "covered frontier models," and (3) a voluntary 30-day prerelease review window for frontier AI models. See Exec. Order §§ 2(d), 3(a)–(b).
The order does not mention privacy, data protection, or data subject rights.
For organizations outside the AI development space, the more immediate question is whether and how these changes will affect your data privacy posture, your vendors, and your regulatory exposure.

II. Key Definitions

The order creates a new label called the “covered frontier model” for the most powerful AI systems. See Exec. Order § 3(a). The EO does not itself define the term substantively; rather, it directs officials to develop a classified benchmarking process to “assess the advanced cyber capabilities of AI models and determine the threshold at which an AI model should be designated a 'covered frontier model.” It seems though that a covered frontier model is an AI system that is so capable it could pose serious cybersecurity risks, such as finding and exploiting weaknesses in software on its own. The NSA will run a classified process to decide which models qualify, in consultation with the National Cyber Director, the Assistant to the President for Science and Technology (APST), the Director of CISA, and other representatives of the Department of War, as appropriate. Exec. Order § 3(a). If a model gets that designation, its developer can voluntarily submit it for government review before releasing it.

III. What the Order Actually Does

The order moves fast, as nearly every directive has a 30- or 60-day deadline. It does four main things.

Directs CISA to strengthen federal cyber defenses and share AI-powered security tools with state and local governments and critical infrastructure operators. See Exec. Order §§ 2(c)(i)–(iii);
Tasks Treasury with creating an "AI cybersecurity clearinghouse" to coordinate finding and patching software vulnerabilities in partnership with AI companies and infrastructure operators. See Exec. Order § 2(d);
Establishes a voluntary 30-day window for AI developers to submit their most powerful models for government cybersecurity review before release. See Exec. Order § 3(b)(ii);
Directs the Attorney General to prioritize criminal enforcement against anyone who uses AI to hack into systems or steal data. See Exec. Order § 4.

IV.   Why This Matters for Data Privacy Even Though it Does not Say “Privacy”

The Executive Order does not mention algorithmic bias, AI's impact on jobs, transparency, or data subject rights. This order focuses only on national and cyber security. The Trump Administration appears to have changed direction on AI after Anthropic's Claude Mythos Preview model, announced in April, demonstrated that it could autonomously identify and exploit hidden vulnerabilities in widely used software. [Note: The causal link between the Mythos announcement and this EO is an inference based on timing; no official source has confirmed this connection.

These “covered frontier models” which are systems that can find security holes in software can also reach the personal data that software is supposed to protect. Every vulnerability is a potential doorway to personal information. When the order talks about “hardening systems” and “patching vulnerabilities,” it is really talking about protecting the personal data inside those systems, too.

V.   What Isn’t Changing. Well, at Least Not Yet.

Right now, it does not create any new privacy rights, data protection rules, or consent requirements for AI. Questions about training data, opt-out rights, and disclosure obligations remain governed by the existing patchwork of state privacy laws, HIPAA, the GLBA, and FTC enforcement. The order is also entirely voluntary, meaning that open-source and open-weight models, which researchers have shown can replicate frontier-level hacking capabilities, are not captured, and may end up in your supply chain without any government review. And while the clearinghouse will help find vulnerabilities faster, the hard part has always been getting organizations to actually patch them — a challenge that is especially acute for data-rich organizations without well-resourced security teams. Finally, the order is silent on AI-specific privacy threats like prompt injection, model inversion, and data poisoning — attacks where a security flaw directly exposes personal data.

VI.   What You Should Do Now

Even though this order is voluntary and does not directly regulate privacy, it signals where federal attention is heading. Organizations — especially those that handle significant volumes of personal data — should take the following steps now:

Audit your AI vendor contracts. Determine whether any of your vendors develop or deploy models that could be designated “covered frontier models.” Update your vendor agreements to require notification if a model receives that designation and to specify whether the vendor will participate in the voluntary government review process.
Pressure-test your patch management program. The new clearinghouse will accelerate vulnerability discovery, which means more patches, faster. If your organization already struggles with patching cadence, now is the time to close that gap — before the clearinghouse starts producing findings that affect your systems.
Map your exposure to open-source and open-weight AI models. The Executive Order’s voluntary framework does not cover open-source or open-weight models, even when they replicate frontier-level capabilities. Review your software supply chain to identify where these models appear and assess the associated risk — particularly if they interact with systems that store or process personal data.
Evaluate your defenses against AI-specific privacy attacks. The Executive Order is silent on prompt injection, model inversion, and data poisoning. Do not wait for federal guidance. If you use AI systems that process personal data, assess whether your current security controls address these threat vectors and whether your incident response plans account for them.
Monitor the 30- and 60-day deadlines. The Executive Order’s implementation timeline is aggressive. Key deliverables — including the clearinghouse framework and the classified benchmarking criteria — are due within one to two months. These outputs will shape what “covered frontier model” actually means in practice and could affect procurement decisions, vendor relationships, and compliance planning.

One Step Closer to a Massachusetts Data Privacy Law: Comparing the Current House and Senate Bills

Wed, 17 Jun 2026 10:24:42 Z

Massachusetts lawmakers are working to pass a long-awaited comprehensive data privacy law in the current legislative session. After years of debating and tabling different versions of Massachusetts-specific data privacy legislation, debates that we previously covered in 2025, the Commonwealth now appears poised to join the twenty other U.S. states with comprehensive consumer privacy laws.

The Massachusetts House of Representatives unanimously passed its privacy bill, H.5479, on June 4, 2026. This bill is an amended version of the proposed bill advanced by the Senate last year (S.2619, An Act establishing the Massachusetts Data Privacy Act). Over the remainder of the legislative session, the House and Senate will work to reconcile the differences between these two versions.

H.5479 differs from the earlier S.2619 in several key respects:

Enforcement and Private Right of Action:
- S.2619 provided for exclusive enforcement by the Attorney General, with no private right of action
- H.5479 creates a new “large data holder” category (entities processing data of 2+ million consumers or sensitive data of 200,000+ consumers) that would be subject to private lawsuits alleging violations of the Act and enforcement actions by the Attorney General.
Cure Period:
- S.2619 included a 60-day cure period for violations to provide some leeway as companies come into compliance. This right to cure would sunset in June 2027.
- H.5479 eliminates the right to cure entirely.
Sensitive Data Sales:
- S.2619 included an outright ban on the sale of all sensitive data
- H.5479 allows the sale of sensitive data (except precise geolocation data) with affirmative consumer consent.

Below is a side-by-side comparison of the key features of (and differences between) the House and Senate bills:

Provision	H.5479 (June 2026)	S.2619 (September 2025)
Applicability	Persons conducting business in Massachusetts and producing products/providing services targeting Massachusetts residents that in the year prior: Collected/processed data of ≥100,000 consumers; Derived gross revenue of ≥$100,000 from personal data sales; Collected/processed any sensitive data	Persons that in the prior year: Collected/processed data of ≥60,000 consumers; Collected/processed personal data of ≥20,000 and derived 20% gross revenue from personal data sales; Collected/processed/transferred reproductive/sexual health data
Private Right of Action	Private right of action against large data holders via 93A; no private right of action for non-large data holders (exclusive AG enforcement) “Large data holder” is defined as a controller or processor that in the most recent calendar year collected, processed, or sold: (1) personal data of more than two million consumers (excluding personal data collected and processed solely for billing); or (2) sensitive data of more than 200,000 consumers.	No private right of action —only AG has enforcement powers
Data Minimization	Collection of personal data should be “reasonably necessary and proportionate … consistent with the reasonable expectation of the consumer,” evaluated by a four-factor balancing test.	Collection of personal data should be “reasonably necessary to provide or maintain a specific product or service.”
Sensitive Data — Definition	Data revealing certain types of information about a consumer (including race, nationality, immigration status, religious beliefs, sex life, sexual orientation, status as transgender/non-binary, union membership, status as crime victim, veteran status) Data revealing certain health data (including gender-affirming, reproductive, or sexual health data) “Consumer health and wellness data” Genetic, neural, and biometric data; personal data of a minor; precise geolocation data; government-issued ID; account names, passwords, and usernames that are not publicly available	Data revealing certain types of information about a consumer (including race, color, ethnicity, national origin, citizenship or immigration status, religion, sex life, sexual orientation, status as transgender or non-binary, status as a crime victim) (unlike H.5479, does not include union membership or veteran status) Data revealing certain health data (including gender-affirming, reproductive or sexual health data) “Data collected by wellness devices” Precise geolocation, account or device log-in credentials or access codes; personal data of a known minor; government-issued ID
Sensitive Data — Sale	Total ban on sale of precise geolocation data; other sensitive data requires affirmative consent	Total ban on all sensitive data sales
Sensitive Data — Processing	Requires affirmative consent	“Strictly necessary” standard. Processing must be essential (not optional), strictly tied to a specific purpose, and targeted and limited in scope.
Consent Framework	“Affirmative consent” = clear, freely given, specific, informed, and unambiguous. Exceptions: Same as S.2619, with the addition of: Agreement obtained through false, fraudulent, or materially misleading statements or representations.	“Affirmative consent” = clear, freely given, specific, informed, and unambiguous, in response to a specific request from a controller. Exceptions: Acceptance of broad terms of use or similar documents with personal data processing descriptions with other, unrelated information; Hovering over, muting, pausing, or closing content; Agreement obtained using dark patterns.
AG Rulemaking	Mandatory (“shall”) with six enumerated areas: Technical standards for sufficiently de-identified data; Reasonable data security practices; A non-exclusive list of dark patterns; A non-exclusive list of unfair or deceptive practices in trade or commerce; The frequency for reviewing and updating data protection assessments; and Privacy notice requirements. The AG’s rules would be due to be published by May 1, 2027.	Permissive (“may”) — open-ended scope.
Data Protection Assessments	Conduct and document assessments for controller processing activities that present heightened risk of consumer harm. To be disclosed to AG upon request when relevant to an AG investigation. Compliance deferred: shall not be requested by the AG before July 1, 2028.	Conduct and document assessments for controller processing activities that present heightened risk of consumer harm. To be disclosed to AG upon request. Data protection assessments obtained by the AG are confidential and exempt from the MA Public Records Law.
Non-Resident Jurisdiction	Ban on sale of precise geolocation data collected or processes within Massachusetts (regardless of residency)	Ban on sale of precise geolocation data collected within Massachusetts (regardless of residency)
Entity Exemptions	Government entities, insurance fraud detection and prevention nonprofits, registered national securities and futures associations, banks/credit unions, educational nonprofits, blood banks, broker-dealers/investment advisers, HIPAA covered entities or business associates	Government entities, insurance fraud detection and prevention nonprofits, registered national securities and futures associations, banks/credit unions, broker-dealers/investment advisers; HIPAA covered entities or business associates that processed the data of ≤60,000 consumers
M&A Notice Requirements	Controller transferring personal data as part of a merger, acquisition, bankruptcy, or similar transaction must provide notice to consumers in a reasonable time prior to the disclosure/transfer. Affected consumers must be given a reasonable opportunity to withdraw affirmative consent. Opportunity to withdraw must be no less than 60 days for genetic, neural, or biometric data.	Controller acquiring personal data as part of a merger, acquisition, bankruptcy, or similar transaction must provide notice to consumers following the acquisition.
Consumer Rights Appeal Process	A controller must establish a conspicuously available process for a consumer to appeal following a refusal to act on a consumer rights request. Upon an appeal, the controller must provide a written response to the consumer within 60 days.	A controller must establish a conspicuously available process for a consumer to appeal following a refusal to act on a consumer rights request. Upon an appeal, the controller must provide a written response to the consumer within 60 days.
Data Broker Report Requirement	Directs the Office of Consumer Affairs and Business Regulation to conduct a study and issue a report on how best to regulate data brokers in Massachusetts. Report and any proposed legislation due not later than July 1, 2027.	None
Civil Penalties	Up to $5,000 per violation	Up to $5,000 per violation
Effective Date	July 1, 2027	January 1, 2027 (applicability thresholds under §2 take effect June 1, 2027)

Next Steps:

The legislature has appointed a six-member House-Senate conference committee. If the conference committee can work out these differences, the compromise legislation will be sent to both branches for final approval before moving to Governor Healey.

Though significant work remains before these bills become law, businesses should begin to prepare now by taking the following steps:

Determine whether your business meets the applicability thresholds under either proposed bill:
1. Determine the number of Massachusetts consumers whose data you collect or process (excluding data used solely for completing payment transactions);
2. Evaluate revenue derived from the sale of personal data; and
3. Identify whether you collect or process sensitive data as defined by the bills.
Review or implement data minimization practices.
Establish at least two secure and reliable means for consumers to submit rights requests, as well as a consumer appeal process. Both bills require a written response to the consumer within sixty days of receiving an appeal of a refusal to act on a consumer rights request.

Our Privacy & Data Security team will continue monitoring these bills as they progress through the legislative process.

Why AI Is Forcing Privacy and Security Teams Back Together — And What That Means for Your Organization

Zick Colin J. — Thu, 14 May 2026 12:03:38 Z

One of the most consequential structural decisions facing organizations today is whether to continue operating privacy and security as separate functions or to begin integrating them in anticipation of the AI-driven regulatory and operational landscape that is rapidly taking shape. Having spent years advising clients on both HIPAA-era compliance frameworks and the new generation of AI governance requirements, I want to share some thoughts on why this question has become urgent and what the answer likely means for your org chart, your budgets, and your risk exposure.

The HIPAA Precedent: We Used to Get This Right

It is worth remembering that when HIPAA was enacted in the late 1990s and its implementing regulations rolled out in the early 2000s, the framework treated privacy and security as two sides of the same coin. The Privacy Rule and the Security Rule were distinct but deeply intertwined, reflecting an understanding that you cannot have one without the other. For a time, that integrated thinking influenced how organizations built their compliance programs.

But somewhere along the way, privacy and security drifted apart in many organizations, becoming separate teams, separate budgets, separate reporting lines, and separate regulatory conversations. Artificial intelligence is now forcing a reckoning with that drift, and the organizations that get ahead of the reintegration curve will be better positioned — legally, operationally, and reputationally — than those that do not.

AI Systems Collapse the Privacy-Security Boundary

Traditional data governance drew a relatively clean line: security protected the perimeter and the infrastructure, while privacy governed what you did with the data once it was inside. AI systems obliterate that distinction. A large language model trained on sensitive data does not merely store that data; it internalizes it in ways that make extraction, inference, and reconstruction possible even without a traditional "breach." The security of the model is the privacy of the individuals whose data it consumed. These are no longer separable concerns.
For clients evaluating their internal structures, this means that any team responsible for AI model governance needs fluency in both domains. A privacy professional who does not understand model architecture, and a security engineer who does not understand data subject rights, will each see only half the picture.

The Threat Model Has Changed

When we wrote security policies a decade ago, we were primarily worried about unauthorized external access and insider threats involving discrete data sets. In an AI world, the threat model expands dramatically. Prompt injection, model inversion attacks, membership inference, and data poisoning all represent novel vectors where a security vulnerability directly produces a privacy harm. Privacy teams need to understand these threats, and security teams need to understand why they matter from a rights and regulatory perspective.

If your current organizational structure routes these issues through separate channels with separate escalation paths, you are creating latency in your response capabilities at the exact moment when speed matters most.

Regulatory Convergence Is Coming Whether You Are Ready or Not

Look at the EU AI Act, the draft updates to the NIST AI Risk Management Framework, and the state-level AI legislation proliferating across the United States. These regimes do not respect the organizational silos we have built. They impose requirements that sound like security obligations — robustness, integrity, monitoring — but are motivated by privacy and civil rights concerns. If your privacy team and your security team are learning about these rules separately and building separate compliance responses, you are doubling your work and creating gaps.

From a practical standpoint, this means that regulatory mapping exercises, gap analyses, and compliance roadmaps for AI governance should be joint undertakings from the outset. Clients who stand up separate AI compliance workstreams within their privacy and security functions are almost certainly going to discover redundancies and inconsistencies down the road — and those inconsistencies are precisely the kind of thing regulators and plaintiffs' counsel look for.

Data Minimization Now Requires Security Architecture Decisions

Privacy professionals have long championed data minimization, but in an AI context, minimization is not merely a policy choice — it is an engineering and security architecture decision. Techniques like federated learning, differential privacy, synthetic data generation, and on-device processing are simultaneously privacy-enhancing technologies and security design patterns. Neither team can implement these alone. The CISO and the CPO need a shared vocabulary and a shared roadmap.

For organizations evaluating how to structure their teams, this is perhaps the strongest argument for integrated reporting lines or, at minimum, formalized joint governance mechanisms. The technology decisions that will define your privacy posture over the next five years are being made by engineers, and those engineers need coordinated guidance from both functions.

Incident Response No Longer Fits Neatly into One Lane

When an AI system hallucinates personal information, or when a fine-tuned model is found to be memorizing and regurgitating training data, is that a security incident or a privacy incident? The answer is both, and organizations that run separate playbooks for breach response and privacy complaints will find themselves flat-footed. You need unified incident taxonomies, unified escalation paths, and unified communication strategies.

This is an area where we are actively advising clients to revisit their incident response plans. The 72-hour notification windows under GDPR, the evolving state breach notification requirements, and the emerging AI-specific incident reporting obligations under frameworks like the EU AI Act all demand a coordinated response that draws on both privacy expertise and security forensics simultaneously.

What Should You Do Now?

The organizations that will navigate the next wave of AI regulation most effectively are those that begin integrating their privacy and security functions now — not necessarily by merging them into a single team, but by creating shared governance structures, joint reporting to senior leadership, unified risk registers, and cross-trained personnel. The era of clean separation between these disciplines is ending, and the sooner your organizational structure reflects that reality, the better positioned you will be.

This post is adapted from a recent presentation by Colin Zick.

Business Email Compromises: Current Legal Trends and Key Strategies

Bard Yoni — Fri, 03 Apr 2026 10:47:54 Z

Businesses have for years suffered from a sophisticated, targeted cybercrime that exploits trust, human relationships, and our reliance on digital communication: the business email compromise (BEC). Sometimes referred to as “man-in-the-middle attacks,” BECs are among the most financially damaging cyber-attacks. Not only do they lead companies to misdirect large wire transfers to criminal actors, these scams also leave behind a messy and costly fallout, including compromised data, onerous breach notification obligations, broken business relationships, and legal disputes with no quick or predictable resolution.

In this post, we cover the following topics:

An overview of BECs, including an example of a typical BEC scenario and recent trends and statistics;
The growing use of artificial intelligence (AI) to carry out these attacks with increased effectiveness;
Legal frameworks used by courts to adjudicate disputes arising from BECs and allocate damages between parties;
Steps companies should take after a BEC; and
Best practices to prevent BECs from occurring in the first place.

Overview of Business Email Compromises

A typical BEC starts quietly but ends with a bang. Many of them look like this fictionalized scenario:

One morning in March, a senior accountant at Seller of Stuff, Inc. clicked on what appeared to be a routine email and attachment from a customer. The attachment would not open – a brief error message flashed. She deleted the message and moved on, unaware that malicious code had been installed on the company’s network.

For four months, an intruder watched, studying the company’s communications and paying attention to one counterparty in particular: Buyer of Things, Inc., a longstanding customer that regularly wired large payments. The intruder noted that the controller handled payment coordination. Then the intruder made a move.

Buyer of Things had a $2.4 million payment to Seller of Stuff coming due. Three days before the payment would be made, a clerk in accounts payable at Buyer of Things received an email appearing to come from the controller at Seller of Stuff, explaining that Seller of Stuff had transitioned to a new bank and providing updated wire instructions. The new Seller of Stuff account was at a bank the clerk had not heard of located in a different state, but the clerk did not think about it too much, given that the email had come from the controller. The clerk processed the $2.4 million payment.

Two days later, Buyer of Things’ funds were wired to an account opened under a fictitious name, not to Seller of Stuff. By the time Seller of Stuff called about the overdue payment, the funds were gone. Seller of Stuff insisted it never sent updated wiring instructions and demanded payment from Buyer of Things. Buyer of Things countered that it had paid in good faith and blamed Seller of Stuff’s compromised email system.

The financial losses from schemes like this are staggering, both individually and collectively. According to the FBI’s Internet Crime Complaint Center (IC3) 2024 Annual Report, the most recent data from IC3, business email compromises resulted in over 21,000 complaints and were the second most costly crime reported to IC3, with close to $2.8 billion in losses. According to the 2025 Association for Financial Professionals (AFP) Payments Fraud and Control Survey, 63% of surveyed treasury practitioners cited BECs as the number one avenue for payment fraud attempts. IC3 has also reported that between October 2013 and December 2023, business email compromise scams caused over $55 billion in domestic and international losses, with U.S. victims reporting over $20 billion in losses. In particular, the IC3 has seen increased BEC reports involving funds sent directly to financial institutions that hold accounts for third-party payment processors, peer-to-peer payment processors, and cryptocurrency exchanges.

In 2026, cyber attackers are leveraging generative AI tools to improve the effectiveness of their schemes. Threat actors can now use generative AI to efficiently scour the internet for personal information relevant to a target and draft highly credible phishing emails, with technically perfect prose, at a scale and speed previously unachievable by humans. IBM’s Cost of a Data Breach Report 2025 reported that 16% of all data breaches in 2025 (including BECs) involved attackers using AI, with 37% of those attacks involving AI-generated phishing or other communications. Those percentages are likely to increase throughout 2026 as cybercriminals use generative AI tools to maximize cyberattacks—like BECs— that depend on social engineering.

Who Bears the Loss of a BEC?

BECs often result in lawsuits to determine who should bear the losses these attacks leave behind—typically, a payor’s misdirected wire transfer and a payee’s unpaid invoice. Cases involving BECs are often fact-intensive and generally not decided before trial ⁱ. The case law stemming from BECs has evolved over the past decade, with courts largely taking two different approaches to allocating these losses when multiple parties have been harmed by a BEC: applying the so-called “imposter rule,” and thereby asking who was in the best position to prevent the loss, or employing a straightforward (and less forgiving) breach of contract analysis.

The Imposter Rule

Victims of BEC scams often bring lawsuits involving negligence and/or breach of contract claims against other involved parties, including third-party institutions or business partners who may have unwittingly played a role in the fraud (especially where a breach in a party’s IT system allowed the threat actor to impersonate that party in external communications). The imposter rule comes from Section 3-404 of the Uniform Commercial Code and gets its name from scenarios where a fraudster impersonates someone to induce a counterparty to make a payment. This rule has emerged as the prevailing legal theory for addressing BEC-related lawsuits.

Courts following the imposter rule will assign liability to the party that, under the circumstances, is determined to have been in the best position to discover and prevent the fraud.ⁱⁱ Though the analysis is highly fact-specific, application of the rule often results in liability for payors that fail to verify suspicious payment instructions, even if the attack originated with a compromise of the payee’s computer system.

In Erie Ins. Co. v. WAWGD, Inc., Civil Action No. EA-22-1783, 2024 U.S. Dist. LEXIS 77140 (D. Md. Apr. 29, 2024), the U.S. District Court for the District of Maryland applied an imposter rule analysis to assign responsibility for the loss associated with a BEC scam. The case arose from a threat actor’s successful impersonation of counsel for the plaintiff Erie Insurance Company during an email exchange between the parties’ attorneys regarding a settlement agreement. The threat actor emailed fraudulent wiring instructions to the defendant company, WAWGD, Inc., resulting in WAWGD inadvertently wiring payments associated with the settlement agreement directly to the threat actor. When the plaintiff Erie brought a subrogation action to seek recovery from WAWGD, WAWGD argued that because plaintiff counsel’s email system was the source of the compromise and resulted in the threat actor fraudulently intercepting the settlement proceeds, WAWGD was not responsible for issuing another check to Erie. Conversely, Erie argued that WAWGD could not be excused from performance under the settlement agreement and that WAWGD’s sole remedy for its loss was to seek recovery from the unidentified threat actor.

Invoking Section 3-404 of the Uniform Commercial Code and prior cases applying the imposter rule analysis, the court determined that the defendant WAWGD was still responsible for paying the plaintiff Erie the previously agreed upon amount. Critically, the court determined that WAWGD was “in the best position to prevent the fraud” and “failed to exercise reasonable care,” given that no earnest effort was made to verify payment instructions over the course of 50 emails involving the threat actor, many of which presented multiple indicia of fraud. For example, the imposter’s email address did not match Erie’s counsel, communications regarding payment conflicted with prior instructions and altered names, addresses, and methods of payment, and the emails “contained typographical errors and did not reflect a sophisticated understanding of how settlement payments are executed.” Although WAWGD had already suffered a loss from paying the wrong party, the court concluded that WAWGD was still obligated to pay Erie the previously agreed upon amount.

Breach of Contract

Other courts have applied a straightforward breach-of-contract analysis without regard to the relative fault of the parties involved in a BEC. Under this approach, courts enforce the payment terms of an agreement even where a payor acted reasonably in unwittingly sending payment to a threat actor instead of the intended payee. Courts applying this analysis will typically find failure to pay the proper payee to be dispositive regardless of the payor’s intent or the sophistication of the BEC. ⁱⁱⁱ

In Barrett v. Daly, 743 F. Supp. 3d 672 (D. Md. 2024), the U.S. District Court for the District of Maryland declined to apply the imposter rule and instead considered only two questions: whether a settlement agreement between the parties was enforceable, and whether the defendant had made the required settlement payment to the plaintiff. The court answered both questions in the affirmative, concluding that the defendant was liable for the nonpayment despite his intention to make the payment and relative lack of fault for the misdirected payment (it was the defendant’s insurer, though counsel, that had fallen victim to the fraudulent email scheme). The court acknowledged that the defendant may have had a claim against the insurer’s counsel for failing to prevent the fraud but determined that “none of those causes of actions [had] been asserted” and entered judgment against the defendant. Barrett illustrates that a binding agreement can be outcome determinative in a dispute arising from a BEC.

How Should Your Company Respond to a Business Email Compromise?

When a company discovers it has been involved in a business email compromise, it should move quickly and pursue multiple avenues of potential recovery. The following are key steps to take in the aftermath of such an attack, although in all cases you should consult with legal counsel to consider whether, when, and how these steps should be taken in any specific case:

Notify the payor’s bank. As soon as possible following the discovery of a business email compromise, an impacted party—either the payor or payee—should notify the payor’s bank and instruct the bank to recall the payment and contact the receiving institution to freeze the funds. Time is of the essence for this step, as every minute that passes following the wire request reduces the likelihood of a full or even partial recovery of the funds.
File a complaint with the FBI. Submit an online complaint with the FBI’s Internet Crime Complaint Center (IC3), also as soon as possible. The FBI has had some success in clawing back wire transfers that were misdirected because of fraud. It is critically important, however, to have counsel involved in both the decision to notify and in the kinds of communications that should be sent.
Conduct an incident review to understand the nature and scope of the attack. If a company believes that its IT system was or may have been compromised in connection with a BEC, it should—through legal counsel—engage a forensic vendor to conduct a privileged investigation into whether there was a compromise, and if so, which systems and files were impacted.
Review insurance policies and notify insurers. Identify any potentially applicable insurance policies to determine whether coverage is included for a BEC and what notification may be required to the insurer and/or other parties, especially if your company maintains business fraud or cyber fraud insurance designed to protect against financial losses from fraudulent activity. Cyber fraud insurance commonly covers incidents involving fraudulent misdirection of funds, in addition to coverage for other forms of cybercrime (including cyber extortion, ransomware attacks, and identity theft). In some cases, cyber insurance policies may also include an obligation by the insurance company to work with law enforcement and financial institutions to attempt to replace or claw back lost funds.
Provide other required notifications. A company harmed by a business email compromise should, consistent with applicable legal requirements, notify any customers or other individuals whose personal information was compromised during the attack. Breach notification requirements are largely established by state law, and the process of determining whose information has been accessed, where those individuals reside, and what, if any, notification they must receive is complex and time-consuming. Consult with legal counsel to determine whether consumer notification is necessary, what form of notification is required, and whether your company has contractual obligations to notify business partners or other organizations in the event of a BEC.
Engage with other parties involved. BECs leave behind a trail of damage. There is often a payor that misdirected funds and now faces the prospect of making that same payment again, this time to the correct counterparty. That counterparty will want the payment to which it was entitled in the first place but never received. Sometimes payment intermediaries or other parties arguably have some responsibility for the loss. These multi-party disputes must be handled strategically and with careful attention to any applicable contractual terms, including dispute resolution provisions that may mandate mediation, arbitration, or litigation in an inconvenient forum.
Implement improvements. Being involved in a BEC is a painful but potent learning experience for any organization. There should be cybersecurity enhancements, changes to payment protocols, education, training, and other measures taken to reduce the risk of similar cyberattacks in the future.

Reducing the Risk of Business Email Compromises

Though BEC attacks have increased in sophistication and frequency, organizations can take the following measures to reduce the likelihood of such attacks or mitigate their impact:

1. Establish strong IT security and email/password management protocols. Regular review of an organization’s IT protocols is crucial to detecting a BEC and preventing a threat actor from entering and staying in the organization’s systems.

   Establish robust password complexity minimums (i.e., using a range of letters, numbers, and special characters)
   Implement multifactor authentication (MFA) requirements that require additional verification methods beyond the use of a password before providing access to an email account or financial information.
   Clearly flag emails from senders outside the organization. An automatically populated header signaling when an email originates externally can place employees on higher alert and increase the likelihood that they detect an attempted intrusion.
   Implement notifications to detect the creation of automatic forwarding rules in email accounts, which are often used by threat actors to hide evidence of a fraudulent transaction; or consider eliminating auto-forwarding entirely.
   Regularly review audit logs. Ensure that IT teams review audit logs on a regular basis, which could reveal unauthorized access by a threat actor. Failure to implement appropriate security measures, like audit log reviews, could be used following a BEC as evidence that the organization was the party in the best position to prevent a financial loss.

2. Sensitize personnel to be alert for red flags. Employees and officers of an organization should be trained to recognize common red flags in phishing emails, including typos, typeface irregularities or inconsistencies, grammatical mistakes, and unsolicited links or attachments. These red flags are unfortunately appearing less frequently, and making it harder to detect fraudulent requests, as generative AI enables threat actors from foreign countries to realistically replicate fluency in any major language and eliminate awkward turns of phrase that have historically been somewhat reliable indicators of foul play.

 Be on the lookout for emails that describe atypical circumstances (e.g., an apparently urgent need to complete a transaction or use an alternate bank account, especially where there are sudden or numerous changes to regularly used bank account information).
 Be alert when receiving an email sent from an atypical party, such as someone claiming to have authority but who is not an established point of contact for a particular transaction, which is a common indicator of a BEC.

3. Follow independent verification protocols. Members of an organization should be taught to not only recognize the indicators of a BEC attack, but also to consistently follow established best practices for conducting business transactions.

 Employees involved in the processing of wire transfers and financial transactions should insist on multiple methods of verification (i.e., verbal and/or visual confirmation through trusted verification channels as to the amount and destination of a particular wire transfer) before authorizing a transaction, particularly when circumstances are time-sensitive or unusual. As shown in cases that apply the imposter rule, whether a payor verified the authenticity of unusual instructions via telephone or another contact method is a key fact in determining fault for any resulting losses.
 Over the past several years, the rise of “deepfakes” and AI-powered audio and video tools has made it increasingly easy and effective for fraudsters to convincingly impersonate real voices, images, and people. Be hyper-vigilant for unusual circumstances or behavior when verifying financial transactions. Consider establishing specific verification protocols that are difficult to replicate (i.e., predetermined security codes or in-person verification) and ensure that you use secure, verified communication channels whenever possible.

4. Secure appropriate insurance coverage. Coverage for losses flowing from successful attacks may be provided in first-party cyber-incident insurance policies or commercial crime insurance policies under provisions regarding fraudulent transfers of funds or social engineering fraud.

 Consult with an insurance broker and legal counsel to identify the appropriate types and levels of coverage.

i Beau Townsend Ford Lincoln, Inc. v. Don Hinds Ford, Inc., 759 Fed. Appx. 348 (6th Cir. 2018) (question of which party was in the best position to prevent the fraud is a factual dispute that should not be resolved at summary judgment stage); but see Forde v. Krantz, No. 21-cv-80603-RKA, 2023 U.S. Dist. LEXIS 192940 (S.D. Fla. Oct. 26, 2023) (summary judgment granted because facts, even when viewed in the light most favorable to plaintiff, were sufficient to find that plaintiff buyer had materially breached his obligations to defendant seller, where buyer clearly failed to exercise reasonable care to verify fraudulent wiring instructions).
ii See, e.g., Thomas v. Corbyn Restaurant Development Corp., 111 Cal. App. 5th 439 (2025) (risk of loss from an imposter’s fraudulent diversion of a wire transfer shall be borne by the party in the best position to prevent the fraud); Ostrich Int’l Co., LTD v. Michael A. Edwards Grp. Int’l Inc., No. 2:21-cv-00639-JVS(ASx), 2023 U.S. Dist. LEXIS 105828 (C.D. Cal. May 18, 2023) (party that failed to carefully evaluate email addresses and telephone opposing counsel to confirm wiring instructions in the face of multiple, conflicting instructions could have more easily avoided the loss); Jetcrete N. Am. LP v. Austin Truck & Equip., Ltd., 484 F. Supp. 3d. 915 (D. Nev. 2020) (buyer was in the best position to prevent the loss by taking the reasonable precaution of verifying the wiring instructions by phone; while the email account hack created the scenario for the loss, the seller had taken reasonable security steps, including hiring an IT consultant and installing virus scanning software on its systems).
iii See, e.g., Barrett v. Daly (discussed above); Erie Ins. Co. v. WAWGD, Inc. (D. Md. Apr. 29, 2024) (under either imposter rule or contractual analysis, payor was obligated to perform under terms of settlement agreement despite BEC scam; threat actor’s actions only affected performance of the agreement, not its formation, and did not render the settlement agreement void); Peeples v. Carolina Container, LLC, No. 4:19-CV-21-MLB, 2021 U.S. Dist. LEXIS 176076 (N.D. Ga. Sept. 16, 2021) (finding breach of contract where payment was unknowingly remitted to third-party fraudster).

Robotics and Health Information - Privacy and Security Issues You Need to Know

Zick Colin J. — Thu, 05 Mar 2026 14:13:28 Z

On March 5, 2026, Colin Zick presented to the MassRobotics Healthcare Catalyst Program on the topic, "Robotics and Health Information: Navigating Clinical Deployments in Light of Current Trends in Health Information Privacy and Security." As robotics companies increasingly deploy solutions in clinical environments, they face a complex overlay of federal, state, and international privacy and security laws—enforced not only by government agencies but also by individuals through private rights of action.

Key Takeaways:

HIPAA is only a floor. Other state and federal laws—including California's CCPA/CPRA, Illinois' BIPA, and the EU's GDPR and AI Act—often apply to healthcare-adjacent data or reach beyond traditional Covered Entities and Business Associates.
Robotics applications pose unique health information risks. Collecting large volumes of data creates legal and security exposure, and automatic captures of biometric information can trigger strict consent requirements.
Learn from the iRobot bankruptcy. When Shenzhen Picea Robotics sought to acquire iRobot and its trove of home mapping and visual data, it triggered CFIUS review and bipartisan congressional scrutiny—a cautionary tale about cross-border data risks.
Build compliance into design. Implement privacy by design, encryption, transparent data policies, and regular third-party security audits. Treat AI as a regulated space—even absent specific statutes, regulators will use consumer protection and privacy laws to enforce accountability.

Colin's presentation materials can be found here.

42 C.F.R. Part 2 Civil Enforcement Is Here: What Substance Use Disorder Providers Need to Know

Zick Colin J. — Tue, 17 Feb 2026 14:14:57 Z

February 16, 2026 marks a significant milestone for substance use disorder (SUD) treatment providers across the country. The HHS Office for Civil Rights (OCR) has announced that, effective on February 16, 2026, it will begin civil enforcement of the federal regulations protecting the confidentiality of substance use disorder patient records under 42 CFR Part 2.

We discussed the recent updates to the provisions of 42 C.F.R. Part 2 in as post back in November 2025. Consistent with those updates, now there is updated guidance regarding the civil enforcement mechanisms to back up those protections.

What This Means for Your Organization
If you operate a federally-assisted SUD treatment program, you are subject to civil enforcement for violations of Part 2's confidentiality requirements. OCR's enforcement toolkit mirrors what we have seen under HIPAA for years: investigations, resolution agreements, monetary settlements, corrective action plans, and civil money penalties. The penalties themselves align with those available under HIPAA, which means potential fines ranging from thousands to millions of dollars depending on the nature and severity of the violation.

OCR will now accept complaints from individuals alleging Part 2 violations and will also receive breach notifications involving SUD patient records. If you have not already updated your compliance programs to reflect these new regulations, the time to act is now.

The Bigger Picture
This enforcement program implements the SUD confidentiality provisions of Section 3221 of the CARES Act, which Congress passed in 2020 to better align Part 2 with HIPAA, while maintaining important additional protections for SUD records. The final rule implementing these changes was published in February 2024, yet it has taken two years for OCR to get to enforcing the new rules.

The alignment with HIPAA is intended to serve dual purposes. On one hand, it should reduce some of the administrative complexity that has long plagued providers trying to navigate two separate, often contradictory privacy regimes. On the other hand, it brings the enforcement teeth that Part 2 has historically lacked.
OCR’s announcement emphasized that its enforcement is ultimately aimed at encouraging patients to seek treatment by instilling confidence that their treatment records will be protected. This is consistent with Part 2's original purpose: ensuring that any stigma associated with substance use disorder should not deter individuals from obtaining the treatment they need.

Action Items for SUD Providers
There are several steps you should take immediately if you have not done so already:

First, review your current Part 2 compliance program and ensure it reflects the updated regulatory requirements.
Second, update your Notice of Privacy Practices. OCR has released model notices that you can use as templates.
Third, educate and train your workforce on the new enforcement landscape and ensure they understand the consequences of noncompliance.
Fourth, review your breach notification procedures to ensure you can appropriately notify OCR of breaches involving SUD patient records.
Finally, assess your business associate agreements and qualified service organization agreements to ensure they contain appropriate Part 2 provisions.

Looking Ahead
This OCR announcement ties into the broader "Great American Recovery Initiative" announced by the current administration earlier this year, signaling that SUD treatment and privacy will remain areas of enforcement focus. We expect OCR to begin investigating complaints and potential violations promptly, and anticipate that we will see enforcement actions in the coming months as OCR establishes this new initiative.
For SUD treatment providers, the message is clear: Part 2 compliance is no longer just a best practice—it is an enforcement priority with real consequences. If you have questions about how these changes affect your organization, please do not hesitate to reach out.

The Supreme Court Enters the Discussion about Meta Pixel and Google Analytics: How to Define What Is a “Consumer” Under the Video Privacy Protection Act?

Sousa Dalton — Tue, 17 Feb 2026 00:00:00 Z

Key Takeaways

The Supreme Court’s agreeing to hear the appeal in Salazar v. Paramount Global will affect how your business can use website tracking tools: A broad interpretation of who is a “consumer” could create new legal risk for companies using standard analytics or ad pixels.
The Supreme Court will decide who qualifies as a consumer who can bring claims under the Video Privacy Protection Act (VPPA): The key question: is signing up for a free newsletter create a “consumer” who can bring a claim?
VPPA exposure for businesses is high, and claims based on tracking technology are trending upward: Many websites use Meta Pixel, ¹ Google Analytics, and other trackers and many companies do not know these trackers are in their websites.
VPPA cases are on the rise: Class action lawsuits argue that websites with embedded tracking tools like Meta Pixel result in unlawful disclosure of video viewing.
VPPA damages are steep: Statutory damages of $2,500 per violation plus attorneys’ fees.
For now, your company’s VPPA exposure may depend on where you or your customers are, but the Supreme Court’s decision will create one standard. Some courts require plaintiffs to subscribe to video content to qualify as a “consumer,” while others say any subscription qualifies.

* * *

In January 2026, the U.S. Supreme Court granted certiorari in Salazar v. Paramount Glob., 133 F.4th 642 (6th Cir. 2025), to resolve a split among courts as to who qualifies as a “consumer” under the Video Privacy Protection Act. The Supreme Court’s decision is set to clarify whether free, non-video subscriptions such as email newsletters create a VPPA “consumer” relationship when a publisher also provides video content on the publisher’s sites.

What is the Video Privacy Protection Act?

The VPPA ² is a federal law enacted nearly 40 years ago (in 1988): it prohibits video providers from knowingly sharing a consumer’s personally identifiable information (PII) without consent. Although the video rentals that the VPPA sought to regulate are largely a relic of the past, the VPPA recently has become a frequent basis for privacy class action lawsuits. VPPA plaintiffs are now bringing class actions arguing that the use of tracking tools on websites that have embedded videos result in unlawful disclosure of viewing activity. ³

The VPPA protects “consumers,” who are defined as “any renter, purchaser, or subscriber of goods or services from a video tape service provider.” ⁴ To bring a case under the VPPA, a “consumer” must prove that a video provider knowingly disclosed to a third party a consumer’s PII. The definition of “consumer” is often central in VPPA cases: defendants have argued that people who are merely site visitors are not subscribers, while plaintiffs contend that creating an account, signing up for newsletters, or using free streaming features can suffice for the VPPA to apply to them as “consumers.”

Recent Trends in VPPA Litigation

Nationwide class actions have been brought against companies with websites that use tracking technologies like Meta Pixel and Google Analytics; these technologies track consumer actions within websites. Plaintiffs typically allege that these tools transmit data tied to user IDs, cookies, and login or account identifiers to third parties who can match the data to individuals.⁵ Common disputes include whether the defendant with a website qualifies as a “video tape service provider,” whether any disclosure of information was “knowing,” and whether any statutory exceptions apply.

Violations of the VPPA result in statutory damages of $2,500 per violation, plus potential awards of attorneys’ fees, and injunctive relief to halt use of tracking tools. Plaintiffs frequently pursue nationwide class actions to maximize their potential damage claims and scare companies into settling. Unless the interpretation of the VPPA changes, plaintiffs are likely to keep pursuing cases based on tracking technologies, newsletter sign-ups, account registration, and the integration of analytics and advertising tools within video players.

The Sixth Circuit’s Decision in Salazar v. Paramount Global

Because the VPPA is now being applied to technologies that did not exist when the statute was drafted, there have been a variety of disputes about its application. In one of these cases, the Sixth Circuit affirmed dismissal of a proposed class claims against Paramount Global. This case arose from a sports website’s use of Meta Pixel. The plaintiff alleged that Paramount Global installed Meta Pixel on 247Sports.com, a website owned by Paramount Global. The plaintiff also alleges that the 247Sports.com website used Meta Pixel to track and disclose his video viewing history, which was linked to his Facebook ID, to Meta Platforms, and that this was done without his consent.

The plaintiff alleged that signing up for a 247Sports e-newsletter qualified him as a “consumer” under the VPPA because he became a 247Sports.com subscriber (and thus a VPPA “subscriber”) when he signed up for an online newsletter. The district court granted Paramount Global’s motion to dismiss the plaintiff’s complaint for failure to state a claim under the VPPA, concluding that the plaintiff was not a “consumer” under the VPPA and that to qualify as a “consumer,” a “plaintiff must be a subscriber of goods and services in the nature of audio-video content.”⁶

On appeal, the Sixth Circuit considered whether the term “goods or services” under the VPPA is limited to audio-visual content or extends to any products or services a provider could offer. The Sixth Circuit ultimately affirmed dismissal of plaintiff’s complaint, applying a textual analysis to conclude that the plaintiff was not a “consumer” under the VPPA. The court emphasized that it does not “scrutinize a statute atomistically—chopping it up and giving each word the broadest possible meaning” and reasoned that “[t]he statutory phrase ‘goods or services’ cannot be construed in a vacuum[.]” ⁷The court concluded that the term “goods and services” is limited to audio-visual content because that term is linked to the goods and services provided by a company when it is acting as a “video tape service provider” (namely, audio-visual materials). Because the plaintiff subscribed only to a free email newsletter rather than to an audio-visual service, the Sixth Circuit affirmed the district court’s holding that he was not a “consumer.”

Supreme Court to Resolve Different Interpretations of the VPPA

The Sixth Circuit’s narrow interpretation of the VPPA in Salazar diverges from decisions in other appeals courts that have read “consumer” more broadly. The District of Columbia Circuit has aligned with the Sixth Circuit’s narrow view, emphasizing the statute’s focus on “video” and the protection of video rental and sale records. ⁸

The Second Circuit has construed “consumer” more expansively, finding that an individual is a “consumer” if they rent, purchase, or subscribe to any goods or services from a provider that offers video, not limiting “consumers” to those who subscribe to audio-visual offers. ⁹The Seventh Circuit aligned with the Second Circuit’s reading of “consumer” in Gardner v. Me-Tv Nat’l Ltd. P’ship, explaining that the text of the VPPA does not require a person to subscribe specifically to video services and instead only requires that the services are provided and that the person is a subscriber. ¹⁰ Under the Second and Seventh Circuits' broader readings, free newsletter subscriptions can establish a subscription relationship sufficient to qualify as a 'consumer' under the VPPA.

The Supreme Court’s review in Salazar v. Paramount Global presents an opportunity for it to resolve the competing interpretations amongst the circuits and to clarify how the VPPA’s “goods or services” language interacts with the VPPA’s focus on audio-visual materials. The decision – which should come later in 2026 or in 2027 – may have wide-reaching implications for how the VPPA is applied in the modern era to newer technologies like pixels and other tracking technologies.

1 Meta Pixel is a tracking tool that collects user data for advertising purposes.
2 18 U.S.C. § 2710 et seq.
3 Examples of VPPA litigation include Solomon v. Flipps Media, Inc., 136 F.4th 41, 48 (2d Cir. 2025) (holding that a digital streaming service's disclosure of a subscriber's digital identifiers via “Facebook Pixel” did not violate the VPPA because an ordinary person could not use the disclosed computer code and digital identifiers to identify an individual's video-watching habits) and Archer v. NBCUniversal Media, LLC, 794 F. Supp. 3d 716, 723 (C.D. Cal. 2025) (denying motion to dismiss VPPA claim where video retailer allegedly used Meta Pixel to transmit consumers’ Facebook IDs and video request information to Meta without consent, holding that plaintiffs qualified as “consumers” even before they completed a purchase).
4 18 U.S.C. § 2710(a)(1).
5 See Solomon at 46–47; Archer at 19.
6Salazar v. Paramount Glob., 133 F.4th 642, 645 (6th Cir. 2025).
7 Salazar at 649-50.
8 See Pileggi v. Wash. Newspaper Publ’g Co., LLC, 146 F.4th 1219 (D.C. Cir. 2024).
9 See Salazar v. Nat’l Basketball Ass’n, 118 F.4th 533 (2d Cir. 2024). Note that the complaint filed in this case was “virtually indistinguishable” from the complaint considered in the Sixth Circuit’s decision in Salazar v. Paramount Glob., filed by the same plaintiff, Michael Salazar. See Salazar v. Paramount Glob., 133 F.4th 642, 651 (6th Cir. 2025).
10 See Gardner v. Me-Tv Nat'l Ltd. P'ship, 132 F.4th 1022 (7th Cir. 2025).

HIPAA Enforcement: A Look Ahead at 2026 Informed by 2025's Inflection Points

Zick Colin J. — Tue, 10 Feb 2026 00:00:00 Z

The healthcare ecosystem has closed the book on a volatile 2025, and HIPAA enforcement has moved into 2026 with sharper edges, wider apertures, and higher stakes. Regulators spent 2025 refining the tools they use, broadening the set of entities they scrutinize, and tightening expectations around cybersecurity hygiene, vendor oversight, and the responsible use of digital technologies. At the same time, parallel enforcement—from the Department of Justice, the Federal Trade Commission, and state attorneys general—has reinforced the reality that data protection failures are not just a compliance problem; they are an enterprise risk with civil, criminal, and reputational dimensions.

What 2025 Signaled—And Why It Matters

In 2025, the Office for Civil Rights maintained its steady cadence on HIPAA Right of Access cases, but increasingly linked access failures to broader issues—training, audit controls, and vendor performance—resulting in corrective action plans that are deeper, more prescriptive, and longer in duration. Ransomware, extortion, and third-party compromise incidents dominated the breach landscape, and OCR acted when it observed encryption "in name only," lagging patch management, and incomplete network segmentation. These deficiencies drew scrutiny not as isolated misses, but as indicators of a security program that had failed to keep pace with anticipated threats.

Regulators also signaled less tolerance for ambiguity around tracking technologies and analytics. OCR's focus on pixel and SDK deployments continued, with an emphasis on whether regulated entities know where data flows, what identifiers are transmitted, and whether disclosures fall within HIPAA's framework or require authorization and business associate agreements. The takeaway from 2025 was that undocumented assumptions, untested vendor claims, and incomplete data mapping are no longer defensible regarding pixels.

Finally, 2025 underscored an expansion in the enforcement perimeter. The FTC's Health Breach Notification Rule enforcement and state health privacy statutes operated in the space where HIPAA does not reach—consumer-facing health apps, digital tools, and non-covered intermediaries—creating a layered enforcement environment. Covered entities and business associates increasingly found themselves accountable not only for their own controls, but for the practical downstream realities of their digital ecosystem.

The 2026 Enforcement Outlook: Five Themes to Plan Around

1) Expect continued rigor on the basics.
Encryption at rest and in transit, privileged access management, multifactor authentication, vulnerability remediation timelines, and incident response playbooks remain fundamentals. For documentation, you need logs that prove controls are enabled and effective, metrics showing patching intervals and exception management, and board-level reporting that demonstrates oversight of security performance, not just policy adoption.

2) Vendor risk management will be judged, and the metric will be outcomes.
OCR and parallel enforcers will look past contract clauses to confirm that providers know which vendors touch protected health information, that security representations have been validated, and that terminations, substitutions, and subcontractor changes are traceable. A living, risk-based inventory, periodic testing of vendor controls, and clear escalation paths for vendor incidents will be essential.

3) Digital health and tracking technologies will remain enforcement priorities.
Can you prove your pixels do not disclose PHI without authorization? Anticipate diligence records on data elements captured, IP address treatment, unique identifiers, and any fingerprinting, with corresponding legal rationales and BAAs where appropriate. Where consent is implicated, regulators will assess whether the consent is specific, informed, and technically enforced.

4) The line between HIPAA enforcement and white-collar risk will continue to blur.
Expect increased coordination between OCR, DOJ, and state authorities when breach investigations uncover wire fraud, identity theft, kickbacks facilitated by data misuse, or false statements to regulators and patients. When cyber incidents intersect with claims data, utilization records, or patient enrollment information, healthcare organizations should assume that criminal exposure for individuals—not only corporate liability—will be assessed.

5) Artificial intelligence will move into everything.
As health systems implement AI for scheduling, documentation, triage, and revenue cycle, regulators will probe training data provenance, access to PHI within model workflows, and the adequacy of role-based controls and human oversight. Documentation of purpose limitations, output monitoring, and error handling will be necessary to demonstrate compliance with HIPAA's minimum necessary standard and safeguards.

Rulemaking and Guidance: What to Watch

On the policy front, organizations should watch for continued alignment of health privacy frameworks where HIPAA intersects with other federal and state regimes. Expect additional clarity around reproductive health-related disclosures, the ongoing harmonization of 42 C.F.R. Part 2 confidentiality rules with HIPAA's structure, and further articulation of cybersecurity expectations through HHS performance goals and sector-specific guidance.

Parallel Enforcement: FTC, State AGs, and Litigation Pressures

The FTC will continue to treat undisclosed data flows and misleading privacy claims as deceptive practices, particularly in the non-covered app and device ecosystem, while state attorneys general leverage state health privacy and general UDAP laws.

At the same time, class actions will track regulatory theories, with plaintiffs emphasizing allegedly inadequate security controls, misrepresentations in privacy notices, and harms tied to identity abuse and out-of-pocket mitigation costs.

The practical result is concurrent exposure: a single incident can trigger OCR inquiry, consumer litigation, FTC examination, and state AG scrutiny.

Practical Steps for 2026 Readiness

The organizations best positioned for 2026 will treat HIPAA not as a statutory minimum, but as a floor within a broader risk framework. This starts with disciplined governance: board-level dashboards that quantify security performance, regular briefings that tie threat intelligence to control health, and clear accountability for vendor oversight, data mapping, and product review.

This effort continues with operational excellence: tested incident response across ransomware and extortion scenarios, tabletop exercises that include legal, communications, clinical operations, and revenue cycle, and documented learning loops that convert findings into budgeted remediation.

Organizations also need principled product design: formal reviews for any new data-collecting technology—pixels, SDKs, AI tools, connected devices—before deployment, with monitoring to confirm that configurations remain compliant as vendors update code.

Finally, entities should prepare for investigations as though they are inevitable: preserve logs and artifacts, maintain chronologies and decision records contemporaneously, and ensure counsel can demonstrate why the chosen safeguards are reasonable and appropriate for the organization's risk profile.

System Hardening, HIPAA, and the Practical Path to Protecting ePHI

Zick Colin J. — Mon, 12 Jan 2026 11:12:44 Z

The January 2026 OCR Cybersecurity Newsletter is the U.S. Department of Health and Human Services Office for Civil Rights’ latest installment in its periodic series translating HIPAA Security Rule expectations into practical, operational guidance. This issue focuses on “System Hardening and Protecting ePHI.” It matters because OCR is the regulator that enforces HIPAA; its newsletters signal how the agency thinks about reasonable and appropriate safeguards. Following this guidance helps covered entities and business associates reduce breach risk, align controls to the Security Rule, and demonstrate a defensible compliance posture.

System Hardening, HIPAA, and the Practical Path to Protecting ePHI

There’s nothing glamorous about system hardening. It’s the blocking and tackling of cybersecurity: patch the holes, remove what you don’t need, and configure what you do need to reduce risk. But in healthcare, where the confidentiality, integrity, and availability of electronic protected health information (ePHI) are legal requirements, hardening isn’t optional—it’s foundational. In its January 2026 Cybersecurity Newsletter, the HHS Office for Civil Rights (OCR)—which publishes practical cybersecurity guidance for HIPAA covered entities and business associates—spotlights “system hardening” as a core strategy to protect ePHI and explains concrete steps to do it well. The newsletter offers a roadmap that organizations can adopt and tailor through their HIPAA risk analysis and risk management programs.

What is the January 2026 OCR Cybersecurity Newsletter?

OCR’s Cybersecurity Newsletter is a periodic guidance series issued by the HHS Office for Civil Rights to translate HIPAA Security Rule expectations into actionable practices. The January 2026 issue focuses on “System Hardening and Protecting ePHI,” synthesizing technical steps with compliance obligations so that covered entities and business associates can reduce risk in a defensible, documented way.

Who it’s for: HIPAA covered entities and business associates seeking practical direction to protect ePHI.
What it covers: Hardening methods across operating systems, applications, firmware, and medical devices; vulnerability and patch management; removing unnecessary software/services; and configuring security controls.
How it ties to HIPAA: Aligns with risk analysis and risk management, access controls, encryption, audit controls, and authentication requirements under the Security Rule.
What it is (and isn’t): Informational guidance to support compliance and risk reduction; organizations should tailor recommendations based on their own risk analysis.

What the newsletter says: key takeaways

Hardening is continuous, not episodic. Define, apply, test, and regularly re-evaluate controls as threats and technologies evolve.
Patching is foundational. Include OS, applications, and firmware; maintain a current asset inventory; and prioritize based on risk.
When you can’t patch, compensate. Use segmentation, allow‑listing, privilege reduction, and enhanced monitoring to keep residual risk reasonable and appropriate.
Remove what you don’t need. Uninstall unused software, disable unnecessary services, and eliminate default/generic accounts and orphaned credentials.
Configure and monitor. Enable access controls, encryption, audit logging, and strong authentication; use EDR and SIEM where appropriate.
Standardize with security baselines. Leverage and tailor baselines (e.g., NIST SP 800‑53 concepts, vendor baselines, STIGs) and deploy them consistently.
Include medical devices. Use manufacturer labeling and security guidance; plan lifecycle controls where patching is constrained.
Document and prove it. Tie decisions to the risk analysis and risk management plan; test changes and preserve evidence of effectiveness.

Why Hardening Matters Under the Security Rule

The HIPAA Security Rule requires regulated entities to safeguard all ePHI they create, receive, maintain, or transmit. System hardening directly supports that mandate by reducing the attack surface across servers, endpoints, mobile devices, and network infrastructure. The most effective programs are not once-and-done projects; they are continuous processes embedded in asset management, vulnerability management, change control, and security monitoring. OCR is clear: as threats evolve, so must your security measures. Periodic review and modification of safeguards is a requirement, not a suggestion.

Start with Patching—But Don’t Stop There

Patching known vulnerabilities remains the first and often most impactful step. That means operating systems, applications, and firmware—routers, firewalls, and other embedded systems included. A current IT asset inventory is critical; you can’t patch what you don’t know you have, and you can’t accurately assess risk without understanding your environment. Your risk analysis should explicitly account for unpatched software and firmware risks and flow into your risk management plan, including timelines and criteria for mitigation.

Patch broadly and deeply: Include operating systems, third‑party applications, and firmware on network and endpoint devices.
Know your environment: Maintain a real‑time asset inventory to drive scoping, prioritization, and verification.
Use authoritative intelligence: Monitor vendor alerts, ISAC/ISAO channels, and authoritative vulnerability sources; scan regularly for missing patches.
Set risk‑based SLAs: Establish remediation timelines that reflect exploitability and potential impact to ePHI.

Just as important is planning for cases where a patch doesn’t exist or can’t be applied, whether due to vendor timelines, compatibility constraints, or legacy systems. In those scenarios, risk-reducing compensating controls become essential.

Compensate when you can’t patch: Apply network segmentation, application allow‑listing, privilege reduction, and enhanced monitoring to keep residual risk at a reasonable and appropriate level.
Re‑evaluate often: Track vendor updates, reassess residual risk, and retire or replace legacy systems on a defined timeline.

Reduce the Attack Surface by Removing What You Don’t Need

Every unnecessary application or service is another potential pathway for attackers. Hardening should include removing unused software—especially consumer apps on endpoints—and disabling unneeded services like remote access or file transfer protocols that don’t meet your security requirements. Pay special attention to service and generic accounts created during software installation. Default credentials remain a recurring root cause in health sector incidents. Replace them with strong, unique credentials, eliminate unnecessary privileges, and remove orphaned accounts when software is decommissioned.

Cull unused software: Remove duplicative or non‑business apps from endpoints and servers.
Disable risky services: Turn off or block insecure protocols (e.g., unauthenticated RDP, telnet, ftp) unless strongly secured and justified.
Eliminate default/generic accounts: Change defaults on install; remove or disable service accounts you don’t need; enforce least privilege.
Hunt for orphans: After uninstalling software, verify that any accounts, scheduled tasks, and services have been removed.

Change control discipline matters. Before you remove or disable components, test in a development environment that realistically approximates production. After changes, reassess the impact on security, availability, and compliance and document your evaluation to meet the Security Rule’s requirements.

Configure and Enable Security Measures That Map to HIPAA

Hardening is also about turning on and tuning the controls you already have—and supplementing them where needed. Access controls, encryption, audit controls, and strong authentication should be implemented based on your risk analysis. If native capabilities fall short, fill the gaps with well-architected third-party solutions such as multi-factor authentication, endpoint detection and response, and security information and event management. The goal is to align technical controls to the risks specific to your environment and demonstrate that you’ve reduced those risks to a reasonable and appropriate level.

Implement core safeguards: Enforce role‑based access, MFA, encryption in transit and at rest where appropriate, and comprehensive audit logging.
Enhance detection and response: Deploy and tune EDR and SIEM to spot and investigate anomalous activity in systems handling ePHI.
Harden authentication: Set authenticator lifecycle policies (issuance, rotation, complexity, and revocation) and minimize shared accounts.

Security baselines help. Whether you adopt publicly available baselines or develop your own, use them to standardize secure configurations for operating systems, applications, and cloud services. Treat baselines as living documents, revisited as part of risk management and tailored to your operational realities.

Leverage recognized baselines: Use resources such as NIST SP 800‑53 concepts, vendor security baselines, and DoD STIGs as starting points.
Be specific in configuration: Enable required audit events, restrict removable media access, and lock down remote access methods.
Deploy consistently: Enforce baselines via configuration management and validate with periodic technical testing.

Don’t Overlook Medical Devices

Healthcare delivery increasingly depends on connected medical devices, and the OCR newsletter reiterates the importance of leveraging manufacturer labeling and security guidance. Device cybersecurity is not a “set and forget” function; it’s lifecycle management. Use the device labeling to inform your internal hardening standards, understand patch and update pathways, and plan compensating controls where direct hardening or patching isn’t feasible. This is also an area where coordination with clinical engineering and procurement pays dividends, from contracting through decommissioning.

What This Means for Regulated Entities

Hardening is the connective tissue between the Security Rule’s risk analysis and the day-to-day realities of IT operations. It requires visibility into assets, timely vulnerability identification, a disciplined process for remediation or mitigation, and documentation that ties decisions to risk. For many organizations, the biggest gap isn’t knowing what to do—it’s doing it consistently and proving it. The OCR guidance provides a practical frame: standardize, document, review, and refine.

Actionable Steps to Operationalize Hardening

Build and maintain a current IT asset inventory that includes hardware, software, and firmware, mapped to data flows containing ePHI. Use it to drive patching, lifecycle planning, and incident response readiness.
Formalize a vulnerability management program with risk-based SLAs for remediation, authoritative sources for vulnerability intelligence, and processes for compensating controls when patching isn’t possible.
Remove unneeded software and disable unnecessary services across endpoints and servers. Establish procedures to detect and eliminate default and orphaned accounts and to enforce least privilege.
Implement and enforce security baselines for operating systems and critical applications. Validate deployment through configuration management and periodic technical testing.
Align technical safeguards with HIPAA standards: strong authentication (including MFA), encryption where appropriate in transit and at rest, and audit logging sufficient to detect unauthorized activity.
For medical devices, incorporate manufacturer cybersecurity labeling into your hardening and change control processes, and plan compensating controls where patching is constrained.
Test before production changes, evaluate after implementation, and document decisions as part of your Security Rule compliance evidence.
Reassess regularly. As threats and business operations evolve, update your risk analysis, refresh your baselines, and adjust your controls.

System hardening is not an exotic new initiative—it’s the disciplined execution of security fundamentals, anchored in the HIPAA Security Rule. Organizations that do this well tend to be organizations that can explain, with evidence, how their controls reduce risk. In the current threat landscape and enforcement environment, that combination of substance and documentation is no longer a nice-to-have; it is the standard.

Lessons on Protecting Your Company’s Crown Jewels – Do a Better Job than the Louvre Did Protecting Its Crown Jewels

Zick Colin J. — Tue, 11 Nov 2025 15:02:12 Z

The Louvre is synonymous with cultural excellence. That’s what makes the recent heist of crown jewels—and the subsequent state audit—so jarring. This wasn’t a Hollywood caper. It was a case study in how predictable, preventable security failures accumulate over time when leadership choices systematically favor the visible over the vital.

The French state auditor’s report describes a familiar imbalance: large investments in revenue‑enhancing and prestige‑boosting initiatives, and comparatively paltry spending on the unglamorous work of security and maintenance. Between 2018 and 2024, the Louvre spent roughly €105 million acquiring artworks and only €26.7 million on maintenance and security. Of an €83 million plan for security upgrades, just €3 million had been advanced. The consequence was not theoretical. A four‑person team exploited a blind spot, rolled up in a truck‑mounted lift, used angle grinders to breach a window and display cases, and left within eight minutes with an estimated $102 million in jewels.

There are several lessons here for companies far outside the museum world. First, strategy is budget. The Louvre’s statutes direct 20% of ticket revenue to acquisitions, a structural commitment that, over time, crowded out funding for cameras, monitoring, and crisis preparedness. In corporate terms, this is what happens when customer‑facing spend is ring‑fenced but foundational risk controls are “best efforts” and endlessly deferred. Years after an earlier audit flagged major weaknesses—from insufficient entrance checks to crisis‑response gaps—large portions of the complex still lacked camera coverage. Only 134 cameras were added or replaced across multiple years, and the upgrade program lagged. Attackers needed only to find the soft spot that the organization already knew existed.

Second, adversaries optimize against your slowest control. The thieves did not deploy advanced tradecraft; they exploited latency. Low‑tech tools and a lift truck beat a fragmented surveillance footprint and an incomplete rollout. In cyber terms, think of an unpatched external system, a long‑planned but not‑yet‑deployed EDR solution, or a backlog of identity hardening tasks. If your roadmap spans years and your attackers operate in minutes, the roadmap is your exposure.

Third, culture travels from the top. Following the heist, the museum’s director reportedly offered to resign; the offer wasn’t accepted. That is a governance story as much as a staffing one. Boards and executives set priorities explicitly through budgets and implicitly through what they tolerate. If the organization’s operating truth is that “we’ll get to security next quarter,” expect attackers to get there first.

A word on passwords, because it has drawn outsized attention in public commentary: reports have circulated of a weak password such as “lourve” being used in connection with museum systems. Whether or not that specific detail is accurate, the point stands. Basic identity hygiene—strong, unique passwords; multifactor authentication; privileged access management; and continuous monitoring—is table stakes. If your controls allow a single trivial credential to unlock crown‑jewel assets, you have not designed for failure and you have not assumed breach.

For companies looking to translate these lessons into action, the path is not mysterious, but it is disciplined. Align funding with risk, not with optics. Protect your crown jewels first, then build outward. Retire structural rules that privilege prestige over resilience. Close known gaps on a defined timetable, and publish that timetable internally so slippage is visible and accountable. Instrument your environment so that blind spots do not persist; where they must exist, compensate for them with layered controls and tested response plans. Finally, measure the mean time from identified weakness to remediation. If it is measured in quarters while your adversaries move in minutes, recalibrate now.

The Louvre’s paradox—an institution with global brand power struggling with basic protective controls—should sound familiar to any enterprise with a celebrated product and a deferred security backlog. You can be world‑class in what you create and still be vulnerable in how you protect it. Attackers will choose the cheaper problem to solve. Don’t make it cheaper for them.

Changes in the Rules for Disclosure for Substance Use Disorder Treatment Records: 42 CFR Part 2: What Changed, Why It Matters, and How It Aligns with HIPAAs

Zick Colin J. — Mon, 10 Nov 2025 12:47:35 Z

42 CFR Part 2: What Changed, Why It Matters, and What to Do Now

On November, 7, 2025, I spoke to the Massachusetts Health Information Management Association about the federal government’s sweeping updates to 42 CFR Part 2—the confidentiality rules governing substance use disorder (SUD) records—to better align with HIPAA while preserving Part 2’s core patient protections. Issued in April 2024 with a two-year runway, the rule becomes enforceable on February 16, 2026. Organizations subject to Part 2 should be executing their implementation plans now to update notices, consents, contracts, workflows, and training.

At a high level, the revisions modernize consent to support integrated care; harmonize definitions, notices, enforcement, and breach obligations with HIPAA; and maintain strict limits on using SUD records against patients in legal proceedings. What follows is a concise summary of the most consequential changes and their operational implications.

Modernized Consent and Redisclosure

The most significant change is the introduction of a single, durable patient consent that authorizes future uses and disclosures of Part 2 records for treatment, payment, and health care operations. Once a HIPAA covered entity or business associate receives Part 2 records under this consent, it may use and redisclose the records in accordance with HIPAA.

A critical exception remains: redisclosures for civil, criminal, administrative, or legislative proceedings against the patient are prohibited absent patient consent or a qualifying court order. Importantly, Part 2 makes clear that recipients are not required to segregate SUD data received under a single TPO consent, although role-based controls and tagging remain prudent to avoid unnecessary exposure of highly sensitive information.

Consent form content has been updated to mirror HIPAA’s structure while retaining Part 2 specifics. Consents must identify the disclosing program and recipients, describe scope, purpose, expiration, and revocation rights, and include statements about potential HIPAA redisclosures when records are used for TPO. Consents for use or disclosure in legal proceedings cannot be combined with other consents, and each disclosure with consent must be accompanied by the consent or a clear explanation of its scope.

New Protection for SUD Counseling Notes

Part 2 now recognizes “SUD counseling notes” as a distinct, highly protected category analogous to psychotherapy notes under HIPAA. These are notes by a SUD or mental health professional documenting the contents of private, group, joint, or family SUD counseling sessions and maintained separate from the medical record. They are generally not disclosable without specific patient consent. Routine clinical information such as prescriptions, session times, modalities, test results, and summaries of diagnosis or treatment plan are excluded from this category.

Notices, Patient Rights, and HIPAA Alignment

Part 2 programs must provide a Notice of Privacy Practices that aligns with HIPAA’s framework and incorporates Part 2-specific content. The notice must describe permitted uses and disclosures (including those allowed without consent), the single TPO consent option, restrictions on legal proceedings, patient rights (such as to restrict disclosures to a health plan for self-paid services, request other reasonable restrictions, obtain an accounting of disclosures, and opt out of fundraising communications), and the right to complain to the program and directly to HHS.

Patient rights under Part 2 are expanded to align with HIPAA, including access rights, the right to an accounting of disclosures (including certain EHR-based TPO disclosures for a defined lookback), and enhanced transparency obligations for intermediaries that disclose records based on general designations.

Legal Process and Enforcement

Part 2’s foundational protections against using SUD records to initiate or substantiate criminal charges or other proceedings against patients remain intact. Disclosures pursuant to court orders continue to require rigorous justification and protective measures, and separate compulsory process (such as a subpoena) is needed to compel production.

Enforcement is now harmonized with HIPAA. HHS’s Office for Civil Rights will enforce Part 2 using the HIPAA civil and criminal penalty framework, and HIPAA’s Breach Notification Rule applies to Part 2 records held by covered entities and business associates. Programs must maintain written security policies addressing paper and electronic records and follow breach protocols. Patients can file complaints directly with HHS OCR, and programs may not retaliate or require waiver of complaint rights. A new safe harbor protects investigative agencies that exercise reasonable diligence before seeking records and take prescribed steps if Part 2 data is received without a qualifying court order.

State Law Interplay and Practical Next Steps

Part 2 does not preempt more protective state laws. Organizations must map Part 2 and HIPAA permissions against applicable state privacy, mental health, and data security requirements, ensuring breach response timelines, content, and patient rights are satisfied across legal regimes.

With the February 16, 2026 compliance date approaching, programs should update Notices of Privacy Practices; revise consent forms to enable single TPO consent and separate SUD counseling notes consent; refresh policies for redisclosure, public health and PDMP workflows, fundraising opt-outs, and legal process response; align breach response plans with HIPAA; amend BAAs, vendor agreements, and intermediary contracts to flow down Part 2 obligations; and train staff on the new requirements and court order standards. These steps will allow integrated, privacy-preserving care while safeguarding the unique protections that remain at the heart of Part 2.

Sound Judgment: Navigating the Legal Frontier of Ambient AI

Thu, 02 Oct 2025 13:48:10 Z

AI notetakers are rapidly becoming staples of corporate meetings—bringing efficiency alongside new questions about confidentiality and compliance. This tip sheet offers practical best practices to harness their benefits while safeguarding sensitive information and reducing legal, privacy, and security risks.

Access our tip sheet for best practices for using AI notetakers in sensitive meetings here.

HHS Unveils Version 3.6 of the Security Risk Assessment Tool: What Covered Entities and Business Associates Need to Know

Zick Colin J. — Fri, 12 Sep 2025 10:36:33 Z

Anyone who has wrestled with the HIPAA Security Rule’s risk‐analysis requirement knows that the government’s free Security Risk Assessment (“SRA”) Tool can be a practical starting point—particularly for resource-constrained practices that cannot justify a commercial governance-risk-and-compliance platform. Developed jointly by the Office for Civil Rights (“OCR”) and the Assistant Secretary for Technology Policy (“ASTP”), the SRA Tool walks the user through the core elements of a 45 C.F.R. § 164.308(a)(1)(ii)(A) risk analysis, prompting self-assessment questions on everything from facility access controls to encryption of data in transit. The output—customized reports that catalogue vulnerabilities, likelihoods, impacts, and recommended remediation—can be invaluable if (or, more accurately, when) OCR knocks on the door.

Today, OCR and ASTP released version 3.6. While the update is incremental, it contains several features that will make life easier for compliance teams, auditors, and, ultimately, regulators reviewing an organization’s risk‐analysis documentation:

First, Version 3.6 introduces a “reviewed-by” confirmation button. Compliance officers can now record the name of the individual who approved the assessment and the date of sign-off. Given OCR’s expectation that risk analyses be “periodic and updated as needed,” this time-stamping feature could be a lifesaver during an investigation when the agency asks for evidence of ongoing governance.
Second, the Tool now aligns its likelihood/impact taxonomy more closely with NIST by renaming the middle tier of risk from “medium” to “moderate.” The change is semantic, but it eliminates confusion for organizations that rely on NIST SP 800-30 Rev. 1 or SP 800-53A—documents that likewise use “moderate” as the midpoint on the risk continuum.
Third, the reporting engine has been fine-tuned. Section-specific details are more granular, and the disclaimers now clarify that the Tool is not a substitute for professional legal advice (music to every lawyer’s ears).
Fourth, the underlying libraries have been refreshed to address vulnerabilities in outdated components. If you ran a security scan on the prior version, chances are your software composition analysis tool flagged several CVEs; those should now be resolved.
Finally, OCR and ASTP have tightened the substance of various questions and educational pop-ups. For instance, the encryption module now references the latest FIPS 140-3 standards, and the incident-response section cross-references the 2024 addition to the HIPAA Security Rule that codifies a 72-hour breach notification window for ransomware events.

To help users acclimate, OCR and ASTP will host live demonstrations on September 15 at noon ET and September 16 at 3 p.m. ET. Expect a hands-on tour of the new features, a walkthrough of the refreshed reports, and a Q&A segment that, if history is any guide, will address the perennial question: “Does completing the SRA Tool guarantee compliance?” (Spoiler: it does not, but it is a strong piece of evidence that you are taking risk analysis seriously.)

What should covered entities and business associates do now? Download version 3.6, perform at least a delta assessment against your most recent risk analysis, and memorialize the outcome—preferably invoking that new confirmation button. Remember, OCR’s enforcement posture has not softened. In recent resolution agreements, the agency has continued to cite inadequate or outdated risk analyses as a predicate violation. The updated SRA Tool is not a silver bullet, but it is low-hanging fruit. Grab it, use it, document it, and, if questions remain, consult counsel.

As always, Foley Hoag’s Security, Privacy and the Law team is available to help you navigate these changes and integrate the new SRA Tool into a holistic HIPAA compliance program.

FTC to App Developers: Your Vendors’ COPPA Missteps Are Your Own

Zick Colin J. — Mon, 08 Sep 2025 09:23:17 Z

The Federal Trade Commission has once again reminded the mobile ecosystem that compliance obligations under the Children’s Online Privacy Protection Act (“COPPA”) do not stop at an app developer’s door. In a recent enforcement action, the Commission announced a settlement with Apitor Technology Co., Ltd., a toymaker whose companion app for robot toys allegedly allowed a third-party software development kit (“SDK”) to gather children’s geolocation data without first securing verifiable parental consent. Although the FTC focused its press release on Apitor, the message is unmistakable: when you embed someone else’s code, you inherit that party’s privacy risks—and, if children are involved, the FTC’s spotlight.

Below is a quick summary of the facts and five practical steps to keep your own house in order.

What the FTC Said

The conduct. Apitor’s coding team plugged a third-party SDK into its child-directed app. That SDK, according to the Commission, quietly collected precise location information from kids using Android devices.
The violation. Collection of geolocation data is plainly “personal information” under COPPA. That means the operator (here, Apitor) must give parents clear notice and obtain verifiable consent before any such data is gathered. Apitor allegedly did neither.
The settlement. To resolve the charges, Apitor agreed to a monetary penalty, deletion of improperly collected data, a COPPA-compliant privacy program, and ongoing reporting obligations. The order drives home that outsourcing functionality does not outsource liability.

Lessons for App Developers

Inventory Every SDK—Continuously. COPPA starts with knowing what information is collected. Maintain an up-to-date manifest of all third-party code modules, their data flows, and their default settings. Make SDK review part of every release cycle; “set-it-and-forget-it” is an invitation to an FTC complaint.
Treat Geolocation as High-Risk Data. Location data has always been sensitive, but the regulatory heat is rising. If your app is even arguably child-directed, assume geolocation collection is off-limits absent robust, tested parental consent mechanisms.
Build Vendor Diligence Into Contracts—Not Just Policies. COPPA requires operators to take “reasonable steps” to ensure service providers can protect kids’ data. Translate that into contract language: data-flow diagrams, audit rights, indemnities, prompt breach notification, and an obligation to flow down COPPA safeguards to any sub-processors.
Adopt a ‘Separate Consent’ Mindset Now. The 2025 COPPA rule revisions will demand a distinct opt-in for sharing children’s data with third parties for anything other than an “integral” purpose. should begin structuring apps to capture that additional consent track and storing granular consent records.
Do Not Rely Solely on an Age Gate. The FTC’s FAQs emphasize that a neutral age screen is helpful but not a shield. If the content, marketing, or user base skews toward kids, regulators may treat the service as child-directed regardless of an age-up prompt. Conduct a holistic “child-appeal” assessment covering app imagery, advertisements, influencer campaigns, and app-store category selections.

The Bottom Line
Apitor’s experience is a textbook example of how a line of third-party code can upend a product launch and invite years of FTC oversight. As the FTC finalizes its strengthened COPPA rule—and state attorneys general ramp up parallel enforcement—mobile developers should view privacy due diligence as an engineering requirement, not a legal afterthought.

Expanded Protections for Reproductive Health and Gender-Affirming Care: What Massachusetts Providers Need to Know

Thu, 04 Sep 2025 14:47:49 Z

On August 7, 2025, Massachusetts Governor Maura Healey signed into law an Act Strengthening Healthcare Protections in the Commonwealth (the “Act”), which amends the state’s existing “Shield Law” protections for providers of reproductive health and gender-affirming care (“Protected Care”). The Act is the latest response by Massachusetts to the Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization (2022), which eliminated the constitutional right to an abortion and returned the authority to regulate reproductive health care to the states. Dobbs has resulted in an uncertain legal landscape where numerous states restricting reproductive care (“Restrictive States”) have enacted broad laws that potentially create liability for out-of-state providers. Like similar laws passed in other states supportive of Protected Care, Massachusetts’ Shield Law intends to limit liability providers might otherwise face in connection with criminal charges, lawsuits, and other investigations originating from these Restrictive States.

This article provides an overview of the Act’s amendments to the Shield Law – itself a series of amendments to relevant statutes – including limitations on a Restrictive State’s ability to reach a Massachusetts provider; heightened confidentiality rules for data relating to Protected Care; and specific requirements for emergency treatment that implicates Protected Care. It also offers key takeaways for providers seeking to protect themselves and their patients from liability in the post-Dobbs world.

New Safeguards Under the Act

The Act layers new safeguards on top of the protections that already existed for providers under the Shield Law. Some of the key safeguards for providers to be aware of include the following:

Cooperation with Out-of-State Probes. Section 2 of the Act amends the Shield Law to prohibit both state and local agencies (including their officers, employees, and any other person acting on behalf of the agency) from cooperating with or providing information or assistance to any federal agency in connection with an investigation into Protected Care that is legal in Massachusetts. This prohibition expands beyond the earlier protection in the Shield Law, which applied only to investigations by other state agencies and private lawsuits.
Prescription Drug Considerations. Under Section 7 of the Act, an individual provider may now request that a pharmacist list only the name of the health care practice or facility at which the individual provider works on the label of a drug prescribed for Protected Care (in lieu of the individual provider’s own name). This option intends to help individual providers mitigate any potential risks in connection with “doxxing” practices that may be harmful to their personal reputation or safety. In line with the above prohibition on cooperation with federal agencies, Section 9 of the Act also states that details about drug prescriptions written for Protected Care now generally do not need to be reported to the state’s prescription drug monitoring program unless the Department of Public Health (“DPH”) determines the reporting is necessary for public health purposes. Section 10 of the Act further states that DPH generally may not submit disaggregated or individually identifiable data from the state’s prescription drug monitoring program to any federal agency in connection with an investigation into Protected Care that is legal in Massachusetts.
Emergency Services. In June 2025, CMS rescinded prior guidance that was issued under the Biden administration in 2022, which instructed hospitals that EMTALA preempted any conflicting state reproductive health restrictions. This prior guidance effectively required hospitals to provide emergency abortion care as needed to stabilize a patient, e.g., in connection with conditions such as ectopic pregnancies and severe preeclampsia. In the absence of this prior guidance, Section 11 of the Act now provides Massachusetts hospitals with clarity on the type of stabilizing treatment they are required to provide in an emergency. It defines “emergency medical condition” to include a variety of reproductive health conditions and “stabilizing treatment” to include “abortion when abortion is necessary to resolve the patient’s injury or emergency medical condition.”
Electronic Health Information. Section 12 of the Act requires EHR vendors that possess Protected Care data to implement new safeguards that help prevent the data from being improperly used or disclosed to an unauthorized party. Sections 3 and 19 also address certain data privacy concerns through generally prohibiting the Center for Health Information and Analysis (“CHIA”) and other state agencies from disclosing any data that “would allow the identification of a patient or provider in response to an out-of-state or federal inquiry or investigation into” Protected Care.
Technical Advisory Group. Section 25 of the Act directs DPH to create a technical advisory group that will provide support to providers and other businesses on implementing privacy protections for storing or managing electronic medical records related to Protected Care. The group’s members must include individuals with a variety of experiences from the fields of reproductive health and gender-affirming care, including representatives from Planned Parenthood League of Massachusetts and Fenway Health (which has a longstanding commitment to serving the LGBTQIA+ community), and at least two “persons with lived experience accessing abortion-related health care services or gender-affirming health care services.” The group has not been formed as of the date of this article, but it is required by statute to make its initial recommendations to a joint committee of the Massachusetts Legislature by July 1, 2026.

In addition to the above protections that largely benefit providers, the Act also notably expands other Shield Law protections that intend to limit potential liability for patients, attorneys who advise on Protected Care, insurers that provide reimbursement for Protected Care, and parents of children who seek Protected Care.

Key Takeaways for Providers

While the implementation of the Act is a strong statement that Massachusetts will continue to support Protected Care providers as a matter of public policy, the Shield Law remains untested in court. In the face of this uncertainty, providers can take the following steps to help limit any potential liability to themselves and their patients to the greatest extent possible:

Develop internal written policies for responding to subpoenas or other requests for medical records or other patient data in connection with an investigation targeting Protected Care;
Review contracts with EHR vendors to ensure they include reasonable, appropriate safeguards for protecting patient data, and prepare amendments as needed;
Review existing policies for providing care in circumstances that potentially necessitate abortion services, and amend these policies as needed to ensure patients receive high-quality urgent care in accordance with applicable law;
Monitor for enforcement actions (likely originating from Restrictive States) against other providers and guidance from Massachusetts agencies on the circumstances under which the Act’s protections should be available to providers; and
When in doubt, seek legal counsel with experience navigating Massachusetts health care and data privacy regulations.

California Finalizes New CCPA Regulations: What Businesses Need to Know

Dash Julia — Fri, 29 Aug 2025 09:20:21 Z

California continues to lead the way in data privacy standards as the latest regulatory updates from the California Privacy Protection Agency (“CPPA”) mark a significant step forward in safeguarding individual rights and data security. On July 24, 2025, the CPPA voted to approve changes to the California Consumer Privacy Act (“CCPA”) regulations that address automated decision-making technology (“ADMT”), risk assessments, and cybersecurity audits. These changes are designed to enhance consumer protections and increase organizational accountability, especially as artificial intelligence (AI) and automated systems become more prevalent in business operations. Below, we provide a high-level overview of these changes and steps that businesses can take to promote CCPA compliance.

Key Changes in the New CCPA Regulations

The newly approved regulations introduce several important requirements for businesses subject to the CCPA:

Automated Decision-Making Technology (ADMT): The regulations define ADMT broadly, covering “any technology that processes personal information and uses computation to replace human decisionmaking or substantially replace human decisionmaking.” In other words, the CCPA regulations now target uses of ADMT that lack substantial human involvement. To illustrate this point, the regulations provide an example of a business that videotapes job interviews and uses emotion-recognition technology without human involvement to assess the videos and decide who to hire.
- Businesses covered under the CCPA must now provide natural persons who are California residents (“Consumers”) with clear notices about the purposes for which ADMT is used, including the logic involved, the significance, potential consequences, and individuals’ rights related to ADMT. As with all other notices required under the CCPA, these notices must be presented at or before the point of data collection and in the manner in which the business primarily interacts with the Consumer. The regulations also grant Consumers the right to opt out of a business’s use of ADMT to make “significant decisions” concerning the Consumer. “Significant decisions” generally include decisions relating to the provision or denial of financial or lending services, housing, educational enrollment or opportunities, employment of independent contracting opportunities or compensation, or healthcare services. Further, a business must offer Consumers at least two methods of submitting requests to opt out of the business’s ADMT usage. Businesses that use ADMT prior to January 1, 2027 must comply with the ADMT requirements no later than that date.
Risk Assessments: Businesses must conduct and document regular risk assessments when engaging in activities that present a significant risk to Consumers’ privacy or security, including when using ADMT to make decisions, selling or sharing personal information, or processing sensitive personal information. These assessments must evaluate if the potential impact of data processing on Consumers, including the likelihood and severity of harm, outweighs the benefit that the business will receive from the data processing. The CCPA regulations specify the content and frequency of these assessments, and require businesses to submit them to the CPPA upon request. Additionally, assessments are required to be updated if any material change is implemented to the underlying processing activity. Risk assessments must be reviewed and updated once every three years. For risk assessments conducted in 2026 and 2027, businesses must submit an attestation to the CPPA by April 1, 2028.
Cybersecurity Audits: The regulations require annual cybersecurity audits for businesses whose processing of personal information presents significant risks. These audits must be thorough, independent, and documented, with a focus on whether the business’s security measures are effective in maintaining the privacy of personal information. They must also generally be conducted by a “qualified, objective, independent” professional (although internal auditors are permitted in certain circumstances). The regulations outline specific criteria for what constitutes an adequate audit, emphasizing the need for objectivity and comprehensive coverage. Notably, the regulations allow for a cybersecurity audit implemented for a separate purpose, such as ensuring adherence to the standards of the applicable NIST Cybersecurity Framework, to be used for this CCPA audit requirement. Businesses with annual gross revenue above $100 million in 2026 will be subject to the first deadline and must complete audits for 2027 by April 1, 2028. Smaller businesses are subject to similar requirements over the course of the following two years. All businesses meeting the general audit applicability requirements will have to complete audits for 2029 by April 1, 2030.

Recommendations for Businesses

California’s Office of Administrative Law (“OAL”) must now review and approve the proposed changes to the CCPA regulations, but industry experts generally do not expect that substantive revisions will be made before they become law. The finalization of these regulations increases the privacy compliance requirements in California for businesses subject to the CCPA. As California has often led the way amongst states with respect to the implementation of new data privacy protections, these proposed changes to the CCPA regulations may also lead to similar initiatives in other states with comprehensive data privacy laws. Businesses can prepare themselves for compliance with the regulations through the following steps:

Businesses should review the extent to which their activities are implicated under the new requirements. For example, technology and AI usage should be evaluated to determine if it constitutes ADMT, and businesses should consider if their data use or disclosure practices will require risk assessments because they involve “significant risk.”
Businesses should prepare to update their website privacy notices, internal data security policies, audit procedures, and opt-out forms as needed to reflect these updated requirements.
Based on the new requirements for risk assessments and cybersecurity audits, businesses should take a proactive approach to identifying and mitigating privacy and security risks. Documentation and readiness to demonstrate compliance will be critical, especially in the event of a CPPA inquiry. Complying with what amounts to a data governance regime will require a multidisciplinary effort and adequate internal policies for many organizations.
Businesses should continue to monitor for any minor changes that the OAL makes to the new regulations, and discuss any questions on how the new requirements will affect them with legal counsel. Businesses should also monitor for any similar initiatives in other states with comprehensive data privacy laws including, but not limited to, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia.

Conclusion

The CPPA’s new regulations under the CCPA represent a comprehensive effort to address the challenges posed by ADMT and evolving cybersecurity threats. Businesses operating in California—or processing the data of California residents—should take these changes seriously and consider the above recommendations. Businesses should begin reviewing their data processing activities, updating their risk assessment and audit procedures, and training staff on the new requirements. Early action will help ensure compliance and reduce the risk of enforcement actions.

Bipartisan Effort By State AGs Pushes Tech Companies to Take Action Against Deepfake Imagery

Thu, 28 Aug 2025 16:34:56 Z

Key Takeaways

Massachusetts AG Andrea Campbell co-led a group of 47 state AGs in calling on technology companies to increase efforts to combat generative AI “deepfake” images, including deepfake pornography.
The letters to providers of payment platforms and search engines represent a shift in approach, directly engaging with companies that may not themselves produce the AI product causing the identified harm.
While AGs push for legislative change, they may continue to lean on existing legal frameworks, including consumer protection law, to address perceived harms from AI.
Companies should evaluate their potential touchpoints with AI enterprises—including where AI firms act as business partners or consumers of services—to evaluate potential exposure to expanding state AG and regulatory inquiries into AI-related harms.

On August 26, a bipartisan group of 47 state attorneys general issued letters calling on major tech companies to increase their efforts to stop the spread of computer-generated and nonconsensual “deepfake” images, particularly including deepfake pornography. The AGs directed their calls to two groups of companies providing either search engines or payment platforms.

In the letters, the AGs requested dialogues with the companies to learn what steps payment platforms and search engines, respectively, were already undertaking to protect against dangers of deepfake pornography, and what more could be done within their existing technical limitations and terms of service. The AGs pointed to existing limitations in search engines that channel certain dangerous searches—such as “how to build a bomb” or “how to kill yourself”— towards safer results—such as government sources or suicide-prevention resources—and suggested they adopt similar guardrails for searches related to deepfake pornography. They also pointed to exemplar terms of service or acceptable-use policies in payments platforms that those companies could use to block payments intended to promote deepfake pornography.

Massachusetts AG Andrea Campbell co-led the effort with the AGs of Kentucky, New Jersey, Pennsylvania, Utah and Vermont. In a press release, AG Campbell’s office expressly connected these letters to her office’s broader efforts to address the potential dangers resulting from the emergence of artificial intelligence. These have included a recent letter to AI companies regarding AI chatbots’ ability to engage in sexual conversations with children, as well as a September 2023 letter to Congress and a first-in-kind April 2024 legal advisory to AI developers, suppliers, and users regarding obligations under existing state consumer protection, anti-discrimination, and data security laws (which we wrote about at the time, here).

Nonetheless, the August 26 letters signal a slight shift in approach by sweeping in companies—search engines and payment platforms—that are not themselves the developers of the subject AI technologies that pose the identified harm. The letters also demonstrate that while the AGs have encouraged legislative action on AI-specific protections, they will not necessarily wait for legislative reforms, and will continue to lean on existing legal frameworks and practices, including state consumer protection laws, to address perceived harms in the meantime.

The letters provide occasion for companies operating in a variety of technological spaces to evaluate their exposure to AI-related harms, including through their relationships with AI developers as business partners or consumers of services, and the manner in which their existing practices or policies could be modified to account for and mitigate such harms. Foley Hoag’s State Attorneys General and Privacy and Data Security Practices have substantial experience preempting and resolving interactions with State Attorneys General and other regulatory authorities, and can assist with navigating this increasingly scrutinized space.

23andMe Bankruptcy Update: How the Proceedings Highlight Best Practices for Handling and Transferring Genetic Data and Personal Information

Bauer Alison — Fri, 18 Jul 2025 09:53:28 Z

After Foley Hoag’s prior updates regarding the chapter 11 bankruptcy cases of 23andMe Holding Co and its affiliated debtors (collectively, “23andMe”), the United States Bankruptcy Court for the Eastern District of Missouri (the “Court”) approved the sale of 23andMe’s genetic data. On July 14, 2025, a notice of the closing of the sale was filed in bankruptcy court. This sale process informs best practices for companies and other entities handling sensitive personal information.

The Court approved the sale of 23andMe’s genetic data and personal information assets to TTAM Research Institute (“TTAM”), an entity founded by Anne Wojcicki, the former CEO and co-founder of 23andMe. TTAM was deemed the successful bidder over the bid of a leading biotechnology company, Regeneron. Although several states filed objections seeking to prohibit or condition the transfer of genetic data on customers providing explicit, informed consent, the Court determined the transaction as structured did not violate applicable privacy policies or state genetic privacy laws and approved the sale to TTAM.

States’ Concerns and Objections

A central point of contention was the transfer of genetic data without the renewed, opt-in consent of existing 23andMe customers. Several states argued that, under their specific laws, customers hold strong property or privacy rights in their genetic material and data. Those state-level statutes typically require explicit permission for any sale or transfer of genetic data. In response to these objections, 23andMe and TTAM contended that because the acquiring entity would honor the existing privacy commitments and maintain the company’s privacy policy, no separate opt-in consent was legally required. The states’ arguments reached beyond mere statutory requirements; many contended that allowing a broad bankruptcy sale would conflict with consumers’ reasonable expectations, particularly individuals who signed up before 23andMe’s language on possible bankruptcy transfers appeared in updated policies.

Outcome and Court’s Reasoning

Despite the potential for these arguments to create significant roadblocks, the Court concluded that the new ownership structure—often referred to as the “equity toggle,” whereby 23andMe’s genetic data assets are initially placed into a wholly owned subsidiary (“Newco”) before equity in that Newco is sold—did not constitute a “transfer” to a third party in a manner triggering explicit consent requirements under many of the cited state statutes and complied with 23andMe’s privacy policy. The transaction’s design, according to the Court, did not violate state law because it did not involve a direct asset transfer of data to an entirely separate corporate entity. Rather, the equity sale allowed the plaintiff-debtor to continue operating under the same data-use policies, with ownership simply shifting at the parent-company level.

Additionally, the Court emphasized the enhanced protections TTAM plans to adopt, including continued respect for customers’ ability to delete data and opt out of research uses. The Court concluded that such measures serve to mitigate privacy and security risks otherwise associated with the change in corporate ownership. California appealed the bankruptcy court's decision overruling its objection, but after a brief administrative stay, the district court denied its motion to halt the sale. Of importance, while the Court held that the Privacy Ombudsman’s suggestions were commercially unfeasible and too impractical to impose against the bankruptcy estate, the Court noted that there were several privacy concerns that could be addressed to Congress and state legislatures to evaluate.

Practical Implications for Entities Handling Genetic Data

These recent proceedings in the 23and Me bankruptcy case highlight key considerations for any organization that possesses genetic or similarly sensitive data:

Maintain Up-to-Date Privacy Policies: Courts may closely evaluate whether an organization’s privacy policies have explicitly contemplated the scenario of a sale, merger, or bankruptcy. Clear, early disclosure can help mitigate or defend against future consent objections.
Obtain Consent Aligning with State Requirements: Entities operating in multiple jurisdictions should track varying levels of consent procedures mandated by genetic privacy laws. Inconsistent or incomplete consent forms may be challenged, particularly where states have strict provisions requiring a renewed, opt-in basis.
Consider the Corporate Transaction Structure: The 23andMe case illustrates the importance of structuring a transaction so that it does not trigger more onerous or prohibitive state-law requirements. Shifts in corporate ownership may be permissible in some instances without requiring affirmative consent from data subjects—provided existing data protections remain intact.
Develop Robust Protective Measures: Even where a proposed transaction is permissible under relevant laws, regulators and consumer protection agencies will scrutinize a company’s post-transfer safeguards. Strong privacy and security commitments, as well as readily accessible data deletion or opt-out procedures, may help avert steep legal challenges.
Communicate Transparently with Consumers: Many of the objections against 23andMe and the purchaser arose from concerns that customers did not fully comprehend the possibility of data transfers in bankruptcy. Going forward, transparency and ongoing updates will help customers make informed decisions about their personal information.

Conclusion

The approval of 23andMe’s asset transfer to TTAM confirms that bankruptcy sales may proceed with minimal, if any, new consent obligations, provided existing policies and regulatory requirements are satisfied. However, the persistent objections from various state attorneys general serve as a reminder that consumer data privacy, particularly where genetic information is involved, remains a point of intense legal scrutiny. Organizations managing this type of data should review their own privacy policies, acquisition and transfer mechanisms and consumer-communication strategies in anticipation of potential regulatory or judicial challenges. If you have questions regarding best practices for structuring a transaction or handling genetic data consistent with the growing patchwork of state-specific genetic privacy regulations, our interdisciplinary team remains available to help navigate these evolving standards.

Summer associate Anna Theil contributed to this post.

DOJ’s “Bulk Sensitive Data Rule” is in Effect, and May Require Significant Compliance Obligations as Enforcement is Set to Begin

Mirenda Anthony D. — Tue, 10 Jun 2025 14:02:56 Z

Pursuant to a newly effective U.S. Department of Justice (DOJ) regulation, the transfer and storage of certain sensitive U.S. government and personal data may be prohibited or restricted, depending on the intended recipient, based on national security risk. The new Data Security Program (“DSP” or the “Rule”), identifies certain “countries of concern” (and “covered persons”—contractors or persons connected to those countries) where either government geolocation data; sensitive government-related personal data; or “bulk U.S. Sensitive Personal data” (defined to include, among other information, human ‘omic data¹ , biometric identifiers, and personal health, financial, and geolocation information) may not be transferred, or where such transfers must occur under highly restrictive conditions. Unlike HIPAA (and other similar privacy laws), the Rules apply regardless of whether the data/information is anonymized, pseudonymized, de-identified or encrypted.

The DOJ’s National Security Division (“NSD”) promulgated the rule in accordance with Biden-era Executive Order 14117 (“Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern”). It took effect on April 8, 2025; enforcement is set to occur on July 9, 2025; several compliance requirements become effective October 6, 2025. Although the Rule was issued by the Biden administration, the Trump administration has not moved to revoke it. Indeed, on April 11, 2025, NSD issued a Compliance Guide, lengthy set of FAQs, and an Implementation and Enforcement Policy, and has indicated that it takes enforcement of the Rule very seriously.

Application of the rule in any specific instance will depend on multiple factors, which can make compliance challenging and complex. Exemptions may also apply in specific circumstances. Penalties, however, could be severe, including investigations, civil enforcement (where parties could be subject to penalties of $377,700, or two times the value of a transaction per violation), and criminal enforcement (up to $1 million in criminal fines and/or 20 years imprisonment for willful violations). Companies in the life sciences, healthcare, and financial services industries, or that are engaged in activities where either large volumes of sensitive information are being processed or where there is a complex chain of downstream data sharing, should pay particular attention to the DSP.
This article provides an overview of the new regulations, with key dates and compliance considerations. Given its complexity and potential challenges in application, Foley Hoag stands ready to assist your organization as it considers how to comply with the DSP.

1. What Information Does the Rule Cover?

The DSP regulates the storage and transfer of two broad categories of data: government data and “bulk U.S. sensitive data.” The government data specified in the regulation is affected regardless of the volume at issue; bulk U.S. sensitive data, however, is regulated only when certain volume thresholds are met, measured over a rolling 12-month period. The chart below illustrates the distinction:

DATA CATEGORY	DESCRIPTION	VOLUME THRESHOLD
Government-Related Geolocation Data	Geolocation information regarding specific U.S. sensitive areas.	N/A
Government-Related Personal Data	Data on current and former U.S. government personnel.	N/A
Human genomic and biospecimen data	Data representing the sequences that constitute all or part of the subset of a human cell’s genetic instructions; or any quantity of human-derived material from which human genomic data could be derived.	100 U.S. persons
Human epigenomic data	Data derived from a systems-level analysis of human epigenetic modifications, which are changes in gene expression that do not involve alterations to the DNA sequence itself.	1,000 U.S. persons
Human proteomic data	Data derived from a systems-level analysis of proteins expressed by a human genome, cell, tissue, or organism.	1,000 U.S. persons
Human transcriptomic data	Data derived from a systems-level analysis of RNA transcripts produced by the human genome under specific conditions or in a specific cell type.	1,000 U.S. persons
Biometric identifiers	Fingerprints, voice prints, retina scans, etc.	1,000 U.S. persons
Precise geolocation data	Accurate within 1,000 meters	1,000 U.S. persons
Personal health data	Diagnostic, treatment, prescription information (not limited to protected health information, or PHI, as defined by HIPAA)	10,000 U.S. persons
Personal financial data	Banking, credit, and trading information	10,000 U.S. persons
Covered personal identifiers	Combination of the above categories linked to a specific individual	10,000 U.S. persons
Combined data	Any collection or set of data containing more than one of the above categories.	Lowest applicable number

2. Which Organizations are Affected?

The rule affects “Covered Data Transactions,” which are data transactions by a “U.S. Person” that involves “access” to that data by a “Country of Concern” or a “Covered Person.”

A “U.S. Person” is any U.S. citizen, national, lawful permanent resident, refugee, asylee, or any entity organized solely under the laws of the U.S. Also referred to herein as a “covered party(ies).”
A “Country of Concern” is one of the following specific countries: The People’s Republic of China (“PRC”) (including Hong Kong and Macau); Russia; Cuba; Venezuela; North Korea; and Iran.
A “Covered Person” is an individual or entity that falls into any one of the following five categories:
- foreign entity 50%+ owned by countries of concern or is organized under the laws of, or has its principal place of business in, a country of concern;
- foreign individual employed or contracted by a country of concern;
- foreign individual primarily residing in a country of concern;
- any person determined by the Attorney General to be owned, controlled, or acting on behalf of countries of concern or covered persons, or likely to cause violations of the DSP; and
- a foreign entity that is at least 50% owned, directly or indirectly, or in the aggregate, by one or more persons who fall into one of the four categories above.
An applicable data transaction includes any one of the following that involves either government-related data or bulk U.S. sensitive personal data:
- Data Brokerage: “the sale of data, licensing or access to data, or similar commercial transaction . . . involving the transfer of data from any person to any other person, where the recipient did not collect or process the data directly from the individuals linked or linkable to the collected or processed data”;
- Vendor Agreements: “any agreement or arrangement, other than an employment agreement, in which any person provides goods or services to another person, including cloud-computing services, in exchange for payment or other consideration”;
- Employment Agreements: “any agreement or arrangement in which an individual, other than as an independent contractor, performs work or performs job functions directly for a person in exchange for payment or other consideration, including employment on a board or committee, executive-level arrangements or services, and employment services at an operational level”; and
- Investment Agreements: “any agreement or arrangement in which any person, in exchange for payment or other consideration, obtains direct or indirect ownership interests in or rights in relation to (1) real estate located in the United States; or (2) a U.S. legal entity”.
Finally, “access” to the data at issue means logical or physical access, and includes “the ability to obtain, read, copy, decrypt, edit, divert, release, affect, alter the state of, or otherwise view or receive” such information.

3. What Transactions are Prohibited or Restricted?

Under the DPS, whether a data transaction is prohibited or restricted is a fact-specific analysis. It depends on (1) the type of data, (2) the volume of data, (3) the type of transaction, and (4) the identify of the recipient.
The DSP prohibits the following transactions:

Data brokerage transactions with Countries of Concern or Covered Persons;
Bulk human ‘omic data or biospecimen data access by Countries of Concern or Covered Persons; and
Any transaction that violates restricted transfer requirements in the Rule.

The DSP allows for the following kinds of transactions on restricted basis, provided that they comply with the Rule’s requirements and security requirements from the Cybersecurity and Infrastructure Security Agency (CISA):

Vendor Agreements;
Employment Agreements; and
Investment Agreements.

The DSP also requires that U.S. persons engaging in a data brokerage transaction with any foreign person, even if not from a Country of Concern, must include language in the data brokerage transaction contract forbidding the foreign person from providing the applicable data to Covered Persons or Countries of Concern.

Additionally, affected organizations should keep in mind that formal compliance alone may be insufficient: the government will likely expect companies to engage in some level of compliance diligence in this context, and knowledge of or willful blindness to improper data diversion could create compliance risk.

4. What Exemptions or Licenses Apply?

Certain transactions may be exempt from application of the Rule, including the following:

Official transactions of the U.S. government;
Personal communications not involving the transfer of anything of value;
Transactions that are “ordinarily incident to and part of the provision of financial services,” including banking services, the purchase and sale of goods and services, payment processing transfers, and investment-management services;
Transactions subject to a Committee on Foreign Investment in the United States (“CFIUS”) national security agreement, during the pendency of the agreement;
Corporate group transactions “ordinarily incident to and part of administrative or ancillary business operations,” including human resources, payroll, and other employee management and corporate financial activities;
Telecommunication services transactions;
Drug, biological product, and medical device operations and authorizations; and
Clinical investigations and post-marketing surveillance data.

Transactions that do not fall within an exemption may nevertheless be authorized if covered by a general or specific license granted by NSD. No general licenses have been issued to date by NSD and the practical ability of parties to obtain a specific license remains unclear.

5. How Must Companies Comply?

Covered parties engaged in covered transaction types that involve government-related or bulk U.S. sensitive personal data with countries of concern/covered persons may be directly impacted by the Final Rules. To ensure compliance, covered parties should take the following steps:

Review Current Transactions: Review current transactions that fall within the covered datasets, and evaluate whether such transactions are prohibited, restricted, or subject to new requirements.
Establish a Process to Assess Applicability of Rules to Future Transactions: When establishing agreements implicating one or more of the four covered transaction types, covered parties should confirm that (a) the contractual counterparty is not a country of concern or covered person; and (b) the transaction does not fall into a prohibited category.

If a covered party is currently involved in or seeks to engage in a restricted transaction, it is important to understand and pursue the appropriate steps to comply with the additional security requirements, due diligence, auditing, reporting, and record-keeping requirements as outlined in the Final Rules. Notably, the covered party must:

Comply With Additional Security Requirements: The Cybersecurity and Infrastructure Agency has published additional requirements for protecting datasets that must be complied with.
Establish Robust Data Compliance Programs: Programs must include risk-based procedures for verifying data flows, identifying transaction parties, and ensuring the end-use of data aligns with regulatory requirements.
Conduct Annual Independent Audits: Covered parties must conduct an annual, independent audit to verify compliance with security requirements and document audit findings.
Maintain Detailed Records: Information should include the types and volumes of data involved, the identities of transaction parties, and the methods of data transfer, and records must be kept for at least ten years.

Covered parties must ensure compliance with additional measures for restricted transactions no later than October 6, 2025.

Even if a covered party is not directly engaged in covered transactions, it is essential to stay prepared for potential indirect effects and updates to the Final Rules. Covered parties should consider the following:

Engagement with Affected Partners: If dealing with partners or vendors affected by the Rule, it is crucial to understand their compliance status and any potential risks associated with data transactions. Covered parties should remember that the Rule applies to U.S. Persons that “knowingly direct” covered data transactions to a foreign entity that would be prohibited or restricted if engaged by a U.S. Person; and
Monitor Regulatory Developments: The DOJ has signaled that it intends to continue to engage with companies and stakeholders, and determine, for example, whether any wind-down or other general licenses are appropriate. Staying updated on additional DOJ or other relevant agency guidance will help ensure compliance with evolving regulations that may come to affect indirect parties.

***

These new rules may pose significant compliance questions and challenges for actors in a variety of different industries: healthcare organizations, life sciences companies, and financial institutions, in particular, all should carefully consider whether these rules will affect their work going forward. Foley Hoag is ready to assist you assessing your compliance needs.

¹ Human genomic, epigenomic, proteomic, and transcriptomic information is referred to as “human ‘omic data.”

Massachusetts to Consider Adopting a Comprehensive State Consumer Privacy Law (Again)

Carlston Daniel T. — Wed, 16 Apr 2025 10:34:09 Z

After years of proposed state privacy legislation, Massachusetts lawmakers are poised to once again consider enacting a comprehensive state consumer privacy law in the Commonwealth this legislative session. At a hearing of the Joint Committee on Advanced Information Technology, Internet and Cybersecurity on April 9, 2025, Massachusetts lawmakers heard from different stakeholders on several introduced bills, including comprehensive consumer data privacy legislation. At the heart of the discussion were three variations of a comprehensive consumer privacy bill: H.78 (An Act establishing the Massachusetts consumer data privacy act); H.80/S.33 (An Act establishing the Comprehensive Massachusetts Consumer Data Privacy Act); and H.104/S.29/S.45 (An Act establishing the Massachusetts Data Privacy Act)¹.

These laws differ from each other in several key respects, as summarized below:

	H.78	H.80/S.33	H.104/S.29/S.45
Applicable entities	Persons conducting business in MA or targeting products or services to MA residents, that: (1) annually control or process the personal data of at least 25,000 consumers, excluding for the sole purpose of completing a payment transaction; or (2) derive revenue from the sale of personal data.	Persons conducting business in MA or targeting products or services to MA residents, that: (1) annually control or process the personal data of at least 100,000 consumers, excluding for the sole purpose of completing a payment transaction; or (2) control or process the personal data of not less than 25,000 consumers and derive more than 25% of their gross revenue from the sale of personal data.	Entities operating commercially in MA that: (1) exceed $20 million in revenue; or (2) collect or process personal information of at least 25,000 individuals (excluding for purposes related to billing or payment processing).
Entity-Level Exemptions	Only government entities exempt from compliance.	State government entities, or persons who have entered contracts with such entity while processing consumer health data on behalf of such entity; Higher education institutions; National securities associations; and Financial institutions subject to Title V of the Gramm-Leach-Bliley Act (GLBA).	Government agencies; Entities below certain annual gross revenue and processing thresholds who do not derive revenue from transferring covered data; National securities associations; Nonprofits established to detect and prevent insurance fraud.
Data-Level Exemptions	Thirteen enumerated categories of information. Includes data subject to or regulated by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), GLBA, Family Educational Rights and Privacy Act (FERPA), and certain credit and employment-related information.	Fifteen enumerated categories of information. Includes data subject to or regulated by HIPAA, GLBA, FERPA, and certain health, credit, emergency contact, and employment-related information.	Five enumerated categories of information. Includes information covered by HIPAA, GLBA, FERPA, and certain personal contact and employment-related information.
Data Minimization	Controllers may only collect or process personal data to the extent reasonably necessary and proportionate to purposes specifically defined in that section.	Personal data collection is limited to what is adequate, relevant, and reasonably necessary in relation to the purposes for which such data is processed, as disclosed to the consumer.	Cannot collect, process, or transfer covered data unless the collection, processing, or transfer is limited to what is reasonably necessary and proportionate to carry out one of thirteen enumerated purposes.
Definition of Sensitive Data	Generally same as H.80, as well as: Data revealing color, national origin, status as pregnant, philosophical beliefs or union membership, military service, or income level or indebtedness; Genetic or biometric data; Government-issued identifiers (including Social Security numbers, passport numbers, or driver's license numbers) that are not required by law to be publicly displayed; A consumer’s online activities “over time and across websites, online applications, or mobile applications that do not share common branding”; Account names, passwords, and related credential and account access information.	Personal data that includes: Data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation or citizenship or immigration status; Genetic or biometric data for the purpose of uniquely identifying an individual; Personal data collected from a known child; Precise geolocation data; Transgender/nonbinary status; Consumer health data, including but not limited to gender-affirming health data and reproductive or sexual health data; or Crime victim status.	Generally same as H.78 and H.80, as well as data revealing an individual’s: Sex or gender identity; Past, present or future mental or physical health condition, disability, diagnosis or treatment, including pregnancy and cosmetic treatment; Government-issued identifiers not required by law to be publicly displayed (including the same list as H.78, as well as military ID numbers and state-issued ID card numbers); Financial account number or credit or debit card number, or information describing or revealing income level/bank account balances; Certain data regarding private communications, and other information regarding the transmission of such communications; Certain types of media/information maintained for an individual's private use; or Photographs, films, video recordings, or similar mediums showing naked or undergarment-clad private areas of an individual. Specifically identifies that the use or purchase of contraceptives and birth control is included in covered data concerning an individual’s sexual orientation, sex life or reproductive health.
Collection, Processing, Transfer, or Sale of Sensitive Data	Prohibited except when strictly necessary to provide or maintain a specific product or service requested by the consumer. Ban on sale of all sensitive data.	Processing of sensitive data concerning a consumer prohibited without obtaining consumer's consent.	Transfer of sensitive data prohibited without an individual's consent. Processing of sensitive data for targeted advertising prohibited.
Enforcement	AG has enforcement and rulemaking authority. Private right of action, applicable only to entities that are not “small businesses” (below $20 million annual gross revenue + under annual limits on data collection, processing, and transfer).	AG exclusive enforcement authority. 60-day cure period for violations.	AG has enforcement and rulemaking authority. Private right of action, applicable only to “large data holder covered entities” (annual gross revenues of $200 million or more, + meeting minimum annual thresholds for data collection, processing, and transfer).
Damages	Not less than $15,000 per individual per violation.	Not defined by the Act.	$15,000 or not less than 0.15% of the covered entity’s annual global revenue, whichever is greater, per violation.
Effective Date	180 days after enactment.	July 1, 2026.	One year after enactment.

A key point of contention during the Joint Committee hearing was the growing “patchwork” of state consumer privacy laws in the absence of comprehensive federal legislation. H.80/S.33 is modeled after legislation adopted in Connecticut, Rhode Island, New Hampshire, and 15 other states, while H.78 and H.104/S.29/S.45 feature several provisions which stand out from other state privacy legislation (most notably, a private right of action for injured consumers in addition to AG enforcement).

At the hearing, advocates for the approach taken by H.80/S.33, including representatives of industries likely to be subject to the regulations, argued that passing a law that closely resembles other state laws, particularly in New England, ensures consistency and clear expectations for consumers and for businesses operating across state lines. They also argued that the private right of action found in other bills would be onerous on small businesses and lead to frivolous litigation. Conversely, supporters of H.78, including several non-profit advocacy groups and nonpartisan research centers, argued that Massachusetts consumers may have differing ideas on privacy than other neighboring states, and that small businesses would be protected from liability by the bill’s built-in carveouts.

Other key bills discussed during the Joint Committee hearing include: H.86/S.197 (focused on stopping the sale of location data); H.99 and S.47 (concerning grocery store surveillance pricing); and H.103 (protections for neural data and use of neurotechnology).

The Joint Committee will have until June 8, 2025, to decide whether to advance any of the data privacy bills discussed. Follow our Privacy & Data Security team for updates on this key legislative initiative.

¹ Another bill, S.301 (An Act advancing the economic development of the commonwealth through comprehensive data privacy), is progressing through the Senate and was referred to the Joint Committee on Economic Development and Emerging Technologies on February 27, 2025.

The FTC Addresses 23andMe's Bankruptcy

Zick Colin J. — Mon, 31 Mar 2025 14:15:19 Z

In a March 31, 2025 letter, the Chair of the FTC, Andrew Ferguson, wrote to the Acting U.S. Bankruptcy Trustee and set out the FTC’s expectations for the protection of consumer information held by 23andMe.

As we noted in our client alert last week, “The Federal Trade Commission plays a crucial role in protecting consumer privacy, especially in cases involving the sale or transfer of personal information during bankruptcy cases. The FTC has a history of intervening in such cases to ensure that consumer data is handled in accordance with privacy policies made by the original data collectors.” And so the FTC has intervened, with a letter containing a number of forceful statements about consumer expectations and privacy.

The Chair’s letter starts with a recitation of 23andMe’s stated privacy commitments, including in the event of bankruptcy:

“Importantly, 23andMe promises users that these protections (and its entire Privacy Statement) shall apply continuously to their personal information, even if the data is sold or transferred in a bankruptcy proceeding:
- ‘If we are involved in a bankruptcy, merger, acquisition, reorganization, or sale of assets, your Personal Information may be accessed, sold or transferred as part of that transaction and this Privacy Statement will apply to your Personal Information as transferred to the new entity.’”

The FTC then set out its position in this matter:

“The FTC believes that, consistent with Section 363(b)(1) of the Bankruptcy Code, thesetypes of promises to consumers must be kept. This means that any bankruptcy-related sale or transfer involving 23andMe users’ personal information and biological samples will be subject to the representations the Company has made to users about both privacy and data security, and which users relied upon in providing their sensitive data to the Company. Moreover, as promised by 23andMe, any purchaser should expressly agree to be bound by and adhere to the terms of 23andMe’s privacy policies and applicable law, including as to any changes it subsequently makes to those policies.”
“These conditions would help protect users’ interests by ensuring that their data and personal information will be used consistent with 23andMe’s promises.”

These statements come as no surprise, as they are consistent with the FTC’s position the bankruptcy case of RadioShack and of XY Magazine.

We will continue to follow the developments in this case as the sale process continues.

HHS OCR Settles HIPAA Security Rule Investigation with Health Fitness Corporation

Zick Colin J. — Mon, 24 Mar 2025 09:58:30 Z

On March 21, 2025, the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) announced a settlement of HIPAA security rule claims involving Health Fitness Corporation (Health Fitness). Health Fitness provides wellness plans to its clients across the country, and this settlement resolved a potential violation under the HIPAA Security Rule.

Health Fitness is subject to the HIPAA security rule by virtue of its status as a HIPAA business associate. The HIPAA security rule’s "risk analysis provision" requires a HIPAA business associate (or covered entity) to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI held by that organization.

The settlement marks the fifth enforcement action in OCR's Risk Analysis Initiative, and resolves OCR's investigation, which OCR initiated after receiving four reports from Health Fitness in 2018 and 2019 of breaches of unsecured protected health information. Health Fitness filed the breach reports on behalf of multiple covered entities as their business associate. Health Fitness reported that beginning approximately in August 2015, ePHI became discoverable on the internet and was exposed to automated search devices (web crawlers) resulting from a software misconfiguration on the server housing the ePHI.

Health Fitness discovered the breach on June 27, 2018. Health Fitness initially reported that approximately 4,304 individuals were affected and later estimated that the number of individuals affected may be lower. OCR's investigation determined that Health Fitness had failed to conduct an accurate and thorough risk analysis for several years (until January 19, 2024), to determine the potential risks and vulnerabilities to the ePHI held by Health Fitness. It is particularly notable just how long ago (over 6 years) the initial breaches that led to this action occurred. A less to take away is that your work is not done when you report a breach. You need to continue to understand why the breach occurred and take (and document) steps to prevent that breach and others from occurring in the future.

Under the terms of the resolution agreement, Health Fitness agreed to implement a corrective action plan that OCR will monitor for two years and it paid $227,816 to OCR. Under the corrective action plan, Health Fitness committed to take steps to ensure compliance with the HIPAA Security Rule and protect the security of ePHI, including:

Annually reviewing and updating as necessary its risk analysis to determine the potential risks and vulnerabilities to the confidentiality, integrity, and availability of its ePHI;
Developing and implementing a risk management plan to address and mitigate security risks and vulnerabilities identified in its risk analysis;
Implementing a process for evaluating environmental and operational changes that affect the security of ePHI; and
Developing, maintaining, and revising, as necessary, certain written policies and procedures to comply with the HIPAA Privacy, Security, and Breach Notification Rules.

It is never a bad time to renew your HIPAA risk assessment; there is a very useful tool that the HHS Assistant Secretary for Technology Policy (a/k/a HealthIT.gov) has created to help in that regard. In particular, OCR recommends that health care providers, health plans, health care clearinghouses, and business associates take the following steps to mitigate or prevent cyber-threats:

Review all vendor and contractor relationships to ensure business associate agreements are in place as appropriate and address breach/security incident obligations.
Integrate risk analysis and risk management into business processes.
Have audit controls are in place to record and examine information system activity.
Implement regular review of information system activity.
Use mechanisms to authenticate information to ensure only authorized users are accessing ePHI.
Encrypt ePHI to guard against unauthorized access.
Incorporate lessons learned from incidents into the overall security management process.
Provide training specific to your organization and its risks, and to individual job responsibilities on regular basis and reinforce workforce members' critical role in protecting privacy and security.

Meta’s New Advertising Rules: Key Considerations for Health and Wellness Businesses

Hoff Samuel R. — Fri, 24 Jan 2025 08:30:18 Z

Advertising on social media platforms such as Facebook and Instagram is a common marketing strategy for many businesses. Government agencies and consumer advocates have increasingly scrutinized this practice to determine if the advertisements use consumers’ personal information in a manner that implicates federal and state data privacy laws. In response to this scrutiny, Meta (the parent company of Facebook and Instagram) has implemented new rules effective January 2025. These new rules restrict advertisements that target consumers based on sensitive categories of personal information.

It is critical for health and wellness businesses and other companies that rely on Facebook and Instagram advertising to understand how the new rules work, as they have the potential to upend marketing strategies and campaigns. This blog reviews the new rules, including their specific restrictions and the types of businesses likely to be affected. It also considers how businesses might limit the impact of the new rules on their bottom line.

Why Is This Happening?
The implementation of the new rules follows a period in which online advertising policies and data collection practices have been subject to heightened scrutiny. In 2023, the Federal Trade Commission entered settlements with BetterHelp and GoodRx that resolved allegations the two companies collected their users’ personal information without consent and improperly shared it with social media platforms for advertising purposes. A series of lawsuits were then filed in 2023 and 2024 against companies that allegedly use Meta’s technology, Pixel, to monitor consumers’ online behavior and collect their personal information. Numerous states have also started to implement their own laws that create or expand on existing data privacy protections, including restrictions on a business’s ability to use personal information for marketing purposes such as online and social media advertising.

Meta states that the new rules are intended to promote a safer and more transparent social media experience for consumers. In light of the current legal and enforcement landscape, the new rules could also help Meta mitigate its levels of risk in connection with its receipt of personal information from the businesses that advertise on its social media platforms.

What Are the Changes?
Under the new rules, Meta has begun categorizing businesses based on the products they offer. A business that falls within a sensitive category (explained further below), such as health and wellness, can no longer send Meta personal information, including mid- and lower-level “funnel data,” such as whether consumers have purchased a certain product in the past or added it to their online “cart.” This personal information helps optimize social media advertisements because it allows the business to target consumers who are already close to purchasing a product directly. As a result, the new rules create a challenge from a marketing standpoint because restricting the transfer of this personal information for social media advertising purposes makes it more difficult to design an effective campaign.

The new rules may also inhibit a business’s ability to design an effective campaign through restrictions on the Conversions API (CAPI), which serves as a direct link between Meta and the real-time marketing data on the business’s servers. Access to certain Meta business tools, including Pixel, may also be blocked. Importantly, the restrictions may be full or partial depending on a particular business’s circumstances.

Who Will Be Affected?
Meta has not yet issued specific guidelines on the types of businesses that fall within each of the sensitive categories, but it has stated that the “health and wellness” category is inclusive of any business “associated with medical conditions, specific health statuses, or provider/patient relationships.” Meta has also noted that a business is more likely to be placed within the health and wellness category, where it markets its products for certain medical conditions. Based on this broad view, the health and wellness category potentially includes businesses that sell supplements or devices as a specific treatment, telehealth practices, pharmacies, fitness or dieting programs, or mental health services. By contrast, products intended to support general wellness (e.g., certain vitamins) or utilized for cosmetic purposes may be less likely to fall within the health and wellness category.

Meta will notify a business via email or through its Meta account when it has determined that the business belongs in the health and wellness category. Meta’s review process is ongoing, and there is no firm deadline by which a business should expect to receive a determination.

What Should My Business Do?

Businesses placed in Meta’s health and wellness category can take the following steps to protect their rights and limit the impact of the new rules on their advertising.

Appeal. On occasion, Meta’s broad view of the health and wellness category may accidentally lead to the misclassification of a particular business. If you believe that an error has been made, such as because your products are not associated with certain medical conditions or you do not have provider/patient relationships with consumers, you should promptly contact Meta and request instructions for submitting an appeal. Contacting Meta is necessary as a formal appeal procedure has not yet been established in connection with the new rules. However, it is unclear how Meta will respond or how long such responses will take.
Branding Changes. Some businesses may choose to proactively review their website and other public-facing language and make changes to reduce the likelihood that they will be placed in the health and wellness category. Depending on the circumstances, these changes could include broadening language related to the purposes of a particular product so that they focus on general wellness or cosmetic purposes rather than certain medical conditions.
Alternative Strategies and Forums. A business at risk of being placed in the health and wellness category may also shift its Meta advertising strategies to focus on brand awareness or campaigns that utilize non-restricted data like consumer “landing page views” or other forms of engagement. These businesses may further evaluate opportunities on social media platforms other than Facebook and Instagram that have not yet restricted advertising practices that target consumers based on certain categories of personal information, e.g., Google, TikTok (while it remains in service in the U.S.), mobile gaming applications, and paid social media influencers.
Seek Assistance. Businesses can also help protect themselves to the greatest extent possible by engaging counsel to help navigate the policies and procedures underlying Meta’s new rules, which continue to develop. In particular, counsel can help interpret and advise on the applicability of any guidelines released in the coming months that offer additional details on the types of businesses that fall within the health and wellness category.

U.S. House Report Addresses AI Concerns, Including Privacy and Data Security

Zick Colin J. — Tue, 31 Dec 2024 08:39:11 Z

On December 17, 2024, just before leaving town until the new session of Congress, the U.S. House of Representatives’ Bipartisan Artificial Intelligence Task Force issued a “Report on Artificial Intelligence," which addresses (among other things) several key aspects of privacy and data security concerning artificial intelligence. The Report is the result of a process that began in February 2024, when Speaker Mike Johnson and Democratic Leader Hakeem Jeffries announced the establishment of a bipartisan Task Force on Artificial Intelligence to explore how Congress can ensure America continues to lead the world in AI innovation while considering guardrails that may be appropriate to safeguard the nation against current and emerging threats.

Overall, the Report recognized the complex interplay between AI advancement and privacy/security concerns, advocating for a balanced approach that promotes innovation while protecting individual rights and national interests. The Report includes guiding principles and forward-looking recommendations that may be appropriate to advance America’s leadership in AI innovation responsibly.

The Report is lengthy, coming in at 273 pages; so that you do not have to read the whole report, here's a summary of the main points discussed that relate to privacy and data security:

Data Privacy
The word “privacy” is mentioned 156 times in the report. In its discussion, the Report acknowledged that AI poses significant challenges to data privacy and made several key findings and recommendations:

AI has the potential to exacerbate privacy harms.
Americans currently have limited recourse for many privacy harms.
New federal privacy laws could potentially augment existing state privacy laws.

To address these privacy concerns, the Report recommended:

Exploring mechanisms to promote access to data in privacy-enhanced ways.
Ensuring existing privacy laws are generally applicable and technology-neutral.
Improving AI system design with privacy-by-design principles and utilizing new privacy-enhancing technologies.

Data Security
While not receiving a separate discussion in the Report, the term “cybersecurity” is mentioned 74 times in the Report, and data security concerns were interwoven throughout the Report's findings and recommendations, including:

the federal government should improve system cybersecurity when it is adopting AI.
secure access to data should be part of AI adoption.
the AI cybersecurity market will reach $60.6 billion by 2028.

In making these recommendations, the Report noted ominously that: “Each year, the federal government spends over $100 billion on information technology and cybersecurity. Approximately 80% of this spending goes to operating existing legacy systems that are typically outdated and underpinned by archaic software and hardware components. These legacy systems create security and operational risks and are costly to maintain and remediate when incidents occur.”

Government Use of AI
The Report made several recommendations regarding the use of AI by government agencies, which findings and recommendations, in turn, have implications for privacy and data security:

“Irresponsible or improper use [of AI] fosters risks to individual privacy, security, and the fair and equal treatment of all citizens by their government.”
The Federal government should support and adopt AI standards to govern AI use.
There should be efforts to reduce administrative burden for AI use in government.
The Executive Branch should encourage and support data governance strategies.

National Security
The Report recognized AI as a critical component of national security, which inherently implicates data privacy and security considerations:

Continue Congressional oversight over autonomous weapon policies.
Support international cooperation on AI used in military contexts.

Sectoral Approaches
The Report advocated for a sectoral regulatory structure for AI, which would likely impact how privacy and data security are addressed across different industries.

Transparency and Human Oversight
While not exclusively applicable to privacy and security issues, the Report emphasized:

Maintaining human oversight in AI deployment.
Ensuring transparency in AI systems.

* * *

While the Report focuses more on identifying issues than solving them, there is some hope for the future from the fact that it was developed and issued by both the Republicans and Democrats in the U.S. House of Representatives. Whether this results in specific legislation that addresses privacy and data security issues in AI will be something to watch for in 2025.

HHS Office for Civil Rights Proposes Measures to Strengthen Cybersecurity in Health Care Under HIPAA

Zick Colin J. — Mon, 30 Dec 2024 08:57:46 Z

The Department of Health and Human Services (HHS) has proposed significant modifications to the HIPAA Security Rule and the HITECH Act in an attempt to strengthen cybersecurity protections for electronic protected health information (ePHI). This proposed rulemaking represents a significant update to HIPAA cybersecurity standards, aiming to address modern threats and technological advancements in healthcare. According to HHS, the proposed rule, for which HHS is accepting comments until early March, would clarify and provide more specific instruction about what entities and their business associates would have to do to protect health information. Key aspects of the proposed regulations include:

Proposed Changes

Updating Definitions: The proposal clarifies and adds new definitions for terms like "access," "authentication," "multi-factor authentication," and "vulnerability" to reflect current cybersecurity concepts.
Strengthening Administrative Safeguards: HHS aims to enhance requirements for risk analysis, risk management, and workforce security measures.
Enhancing Physical Safeguards: The proposal includes updates to physical security measures for protecting ePHI and associated systems.
Improving Technical Safeguards: New provisions focus on strengthening access controls, audit controls, and transmission security.
Organizational Requirements: The proposal updates standards for business associate contracts and group health plan requirements.

Rationale and Context

Evolving Healthcare Environment: HHS cites significant changes in healthcare delivery and technology since the Security Rule was last revised in 2013.
Increasing Cybersecurity Threats: The proposal responds to alarming growth in data breaches and cyberattacks affecting the healthcare sector.
Critical Infrastructure Protection: The changes align with the designation of healthcare as a critical infrastructure sector by the President.

A fact sheet on the HIPAA Security Rule NPRM is available at: https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/factsheet.

Holiday Cyber Security Scams: Protecting Your Business During the Festive Season Without Being a Grinch

Zick Colin J. — Wed, 27 Nov 2024 14:26:24 Z

As the holiday season is upon us, businesses must remain vigilant against the increased threat of cybersecurity hacks and scams. Cybercriminals often exploit the festive atmosphere and increased online activity to target unsuspecting companies and their employees. Organizations like the Boston Police Department’s Regional Intelligence Center are on the lookout for these scams, and we have set out below some of the most prevalent holiday cyber attacks and provide practical advice for safeguarding your business and your employees.

Online Shopping Scams: The Better Business Bureau warns shoppers against an increase in fake websites and personal sellers offering discounts this holiday season. Fake ads posted on social media may show expensive products in high demand, often at unbelievably low prices, to lure in potential victims. Scammers create bogus sites to obtain personally identifiable information and credit card numbers. Fraudsters may also send phishing texts or emails informing customers that a delivery was not completed and to follow a link or call a phone number. To protect your company, make sure employees:
- Verify the legitimacy of online retailers before making corporate purchases
- Implement strict approval processes for any significant corporate purchases or payments
- Use secure payment methods and verify wire transfers to new or unfamiliar entities
Phishing with a Holiday Twist: During the holidays, phishing attacks become more sophisticated and harder to detect. Attackers often pose as company leaders or known vendors, offering holiday bonuses or special deals. To combat this:
- Refresh your cyber security training and alerts for employees
- Implement email authentication protocols
- Establish protocols for verifying unusual requests, especially those involving financial transactions
Digital Holiday Cards: These can be a vector for malware distribution, so only use reputable e-card services for corporate communications and educate employees about the dangers of opening e-cards from unknown sources
Puppy Scams: Adding a new pet is a common occurrence during the holiday season. The internet has become the go-to place to find those furry friends, but according to the BBB, 80% of sponsored pet advertisements online may be fake.
Train Employees to Recognize AI-Generated Content and Communications: If you or your company are a victim, contact:
- Your local law enforcement officials
- Federal Trade Commission (FTC) at https://reportfraud.ftc.gov/
- FBI Internet Crime Complaint Center (IC3) at https://www.ic3.gov/
- If the scammers obtained your Social Security number, go to IdentityTheft.gov (https://www.identitytheft.gov/) to see the steps to take to protect yourself.

We all know the holiday season brings joy, but it can also bring increased cyber risks for businesses. By staying informed about the latest scams and implementing robust training and security measures, companies can protect themselves and their customers from cyber threats. Make a security list, and check it twice to ensure a safe and prosperous holiday season for your business.

Post-Election Privacy & Cybersecurity Law Developments to Watch

Mon, 11 Nov 2024 13:01:04 Z

What should privacy and cybersecurity practitioners and specialists consider after the 2025 inauguration? There are a few notable issues that may shape how businesses think about their privacy and cybersecurity programs:

A comprehensive federal privacy law is possible but unlikely. A GOP-led White House and Congress will have an opportunity to pass a federal privacy law. Historically, Republicans have taken a much more industry-friendly approach to privacy, expressing concerns that more stringent laws will stifle business innovation. (For example, the American Privacy Rights Act failed over GOP objections, even though it had been stripped of certain civil rights protections in favor of business interests.) However, a law that would preempt laws like the CCPA, is likely to run into the buzzsaw of the Senate filibuster, which Senator McConnell promised will stay intact (despite current pressure from the president-elect). Those hoping for a federal privacy law should be skeptical: despite numerous attempts, Congress has found passing such a law difficult even after finding significant legislative compromise.
Other federal initiatives in privacy will continue to be pursued. GOP congressional members have been vocal in their aim to preserve American competitive advantages in tech against Chinese competition. Curtailing Chinese efforts to mine data from the U.S. Congress has also successfully made bipartisan efforts to increase protections for children online. While a comprehensive privacy law may be difficult to achieve, Congress may continue to do what the U.S. has done best in this space: keep adding patches to the privacy patchwork.
As always, the states will likely move privacy and cybersecurity laws and enforcement forward. As of this writing, twenty states have enacted comprehensive privacy laws. While there are important differences between them, the points of convergence are important for U.S. businesses: they define personal information broadly, create more stringent protections for so-called “sensitive data” (such as biometric information), impose contractual and risk assessment requirements, and provide for individual privacy rights. They are typically enforceable only by state attorneys general, omitting private rights of action. So long as Congress remains unable or unwilling to pass comprehensive legislation, this number will increase, as will enforcement. Businesses should keep a close eye on how laws are enforced to learn state priorities and what kind of conduct is likely to lead to investigations and fines.
Federal agencies are likely to step back from rulemaking and enforcement. While the FTC does not have general rulemaking authority in the privacy realm, it has consistently been a powerful privacy enforcer. For its part, the SEC promulgated in 2023 a comprehensive set of cybersecurity rules for regulated businesses. However, the Supreme Court’s decision in Loper Bright, coupled with an incoming administration hostile to agency action, is likely to weaken both rulemaking and enforcement efforts in this space, especially if they are seen to stifle business activity.
Global privacy and cybersecurity developments will continue to impact U.S. businesses. The EU/UK GDPR continues to set the global benchmark in privacy. Since it became effective in 2018, the GDPR has been the model for privacy laws in U.S. states and countries such as China and Brazil. The EU GDPR is also well enforced (member state enforcement authorities have issued fines over the past six years of €4.2 billion). The EU is further poised to consider creating a set of procedural regulations to, among other things, impose more coherence across member states around enforcement. Changes in the GDPR and in global laws will continue to impact U.S. businesses and impact overall expectations regarding best practices, regardless of what happens in U.S. law.
AI, AI, AI. Whatever may happen with privacy law, the continued adoption of AI tools will impact much of organizational data management. These tools implicate not only privacy and cybersecurity concerns but also questions around intellectual property, data ownership, and safety. Again, even if legislation in the U.S. is anemic in this space, the EU has already passed a comprehensive regulation that will likely shape U.S. business behavior.

What does all of this mean for U.S. businesses? At a glance, businesses can likely expect more continuity than disruption in the continued development of privacy laws and practices. While agency enforcement may very well wane during the Trump administration, the fragmented global framework and global nature of business will make it nearly impossible to escape global trends converging on privacy compliance themes. Treating personal data processing as requiring strong internal governance and risk management will continue to put businesses in the best position possible to weather the current unpredictability of U.S. federal law.

FERC Issues Proposed Rules to Enhance Grid Cybersecurity Reliability Standards

Mon, 30 Sep 2024 08:26:51 Z

Cyberattacks on U.S. energy infrastructure have been on the rise in 2024. According to the 2024 Thales Data Threat Report, 42% of critical infrastructure companies, including those in the energy sector, suffered data breaches this year. Between November 2023 and April 2024, 29 cyberattacks targeting U.S. energy infrastructures' industrial control systems were reported. In July 2024, the Federal Bureau of Investigation (“FBI”) issued a Private Industry Notification highlighting the increased risk of malicious cyberattacks on the U.S. renewable energy industry, including attacks that could target solar infrastructure and microgrids.

Amid these growing concerns over the grid’s vulnerability to malicious cyberattacks, on September 19, 2024, the Federal Energy Regulatory Commission (“FERC”) issued two proposed rules that aim to enhance cybersecurity standards for the U.S. bulk-power system. In the first Notice of Proposed Rulemaking (“NOPR”) (Docket No. RM24-4-000), FERC proposes to require new or modified critical infrastructure protection (“CIP”) standards to address ongoing risks posed by malicious actors seeking to compromise the reliable operation of the bulk electrical system. This proposal directs the North American Electric Reliability Corporation (“NERC”) to submit standards requiring entities to:

identify their current supply chain risks to their grid-related cybersecurity systems at specified intervals;
assess and take steps to validate the accuracy of the information received from vendors during the procurement process; and
document, track, and respond to these risks to their systems.

FERC also directs NERC to extend the applicability of the supply chain standards to include a category of products known as protected cyber assets (“PCAs”).

The second NOPR (Docket No. RM24-7-000) proposes to approve a CIP reliability standard submitted by NERC in compliance with a prior FERC directive, which would require entities to implement internal network security monitoring within a defined electronic security perimeter. FERC also proposes to direct NERC to develop modifications to the internal network security monitoring standard to extend those protections outside the electronic security perimeter to electronic access control or monitoring systems and physical access control systems.

These two NOPRs demonstrate FERC's continued focus on cybersecurity reliability standards, building upon recent actions taken by it, other federal agencies, and NERC:

Earlier this year, we reported on the U.S. Department of Energy’s (“DOE’s”) support for the release of cybersecurity baselines for electric distribution systems and distributed energy resources (“DERs”).
In June 2024, DOE rolled out new Supply Chain Cybersecurity Principles, which establish best practices for cybersecurity throughout the energy infrastructure supply chain.
Last November, NERC conducted its biennial GridEx simulated grid attack exercise with more than 250 organizations to gauge utility responses, communications protocol, and cross-sector coordination. NERC issued a report on the exercise in April 2024 and urged greater cooperation and communication between utilities and non-federal government partners.

Both FERC NOPRs require NERC to submit responsive new or revised standards to FERC within 12 months of the effective date of a final rule. FERC seeks comments on all aspects of both proposed rules, which are due within 60 days after their forthcoming publication in the Federal Register.

The Health Sector Cybersecurity Coordination Center’s September 19 Threat Briefing on Healthcare Technology Security

Zick Colin J. — Thu, 19 Sep 2024 16:28:45 Z

As healthcare technology continues to evolve, so does the need for robust compliance strategies to safeguard patient information and ensure the integrity of medical devices. In a joint September 19, 2024 presentation, the Department of Health and Human Services’ Office of Technology and the Health Sector Cybersecurity Coordination Center (HC3) explored key concepts and definitions, examined various technologies, electronic records systems, medical devices, and AI, and discussed defense and mitigation strategies that sophisticated compliance personnel must consider. What follows are highlights from that presentation.

I. Specific Areas of Concern

Picture Archiving and Communication Systems (PACS): A medical imaging technology that provides economical storage, retrieval, management, distribution, and presentation of images. PACS systems streamline the management of medical images, allowing for efficient storage and retrieval.
Digital Imaging and Communications in Medicine (DICOM): A standard for transmitting, storing, and sharing medical imaging information, ensuring interoperability among different medical imaging devices. DICOM plays a crucial role by standardizing image formats, ensuring compatibility across different devices and software.
Electronic Health Records (EHR): Digital versions of patients' paper charts that provide real-time, patient-centered records accessible to authorized users.

But digitization comes at a price – data breaches, as these charts from the presentation bear out:

Medical Devices
- Insulin Pumps: Due to their critical role in diabetes management, these devices require stringent security measures. Vulnerabilities can lead to unauthorized access, risking patient safety. Regular updates and security patches are essential to mitigate risks.
- Pneumatic Tubes: This seemingly analog technology is still around and vulnerable to hacking. Research revealed that an unauthenticated attacker could gain full control over pneumatic tube systems connected to the Internet and then compromise a hospital's entire tube network.
- Electronic Health Records (EHR): EHRs are central to modern healthcare and contain extensive patient data. Compliance personnel must implement robust authentication processes, encryption, and regular audits to safeguard these records against breaches.
- Artificial Intelligence: AI is transforming healthcare, offering tools for predictive analytics, diagnosis, and treatment recommendations. However, as AI systems become more integrated into healthcare workflows, compliance personnel must address potential algorithm biases and ensure that patient data used in training models is anonymized and secured.

II. Defense and Mitigation Strategies

To protect against cyber threats, healthcare organizations should adopt a multi-layered security approach:

Risk Assessment: Regularly assess vulnerabilities in technology systems, focusing on potential threats and impacts.
Access Control: Implement role-based access controls to limit who can view and manipulate sensitive information.
Incident Response Plan: Establish a robust incident response plan to address and mitigate any breaches that occur quickly.
Continuous Training: Ensure that all staff are trained in security best practices and know their role in maintaining compliance.

As healthcare technology becomes increasingly sophisticated, so too must compliance strategies. Understanding the intricacies of PACS, DICOM, medical devices, EHRs, and AI ensures that patient data remains secure. By adopting comprehensive defense and mitigation strategies, compliance personnel can protect sensitive information and contribute to a culture of safety and accountability within their organizations. Embracing these technologies responsibly will ultimately enhance patient care and trust in the healthcare system.

References

The Ibero-American AI Framework – General Recommendations

Tue, 27 Aug 2024 10:18:48 Z

Partner Chris Hart authored the article, “The Ibero-American AI Framework – General Recommendations,” published recently in DataGuidance. In the article, Chris discusses the Ibero-American Personal Data Protection Network’s ten recommendations for designing AI systems to meet minimum regulatory requirements on the treatment of personal data.

Click here to read the full article.

Massachusetts Attorney General Announces Breach Resources for Consumers Impacted by Change Healthcare Breach

Zick Colin J. — Mon, 15 Jul 2024 18:14:08 Z

The Massachusetts Attorney General’s Office (AGO) issued an announcement last week to inform consumers who may have had their personal information breached in Change Healthcare’s cyberattack this past February. The AGO was joined by a bipartisan group of state attorneys general in sharing these consumer protection resources.

Change Healthcare is the nation’s biggest electronic data clearinghouse. Tens of thousands of providers, pharmacies, and insurers use its technological infrastructure to verify insurance, confirm pre-authorization of procedures or services, exchange insurance claim data, and perform other administrative tasks essential to the delivery of health care.

In April, Attorney General Andrea Campbell joined other attorneys general in sending a letter urging more meaningful action to better protect providers, pharmacies, and patients harmed by the recent breach. In particular, the AGO noted that Change Healthcare has not yet provided individual notice of the breach to consumers.

The AGO stated that given the time between the data breach and notification to those impacted, the Massachusetts Attorney General’s Office is publicizing the breach and available consumer resources, including the offer that Change Healthcare has provided to the public.

Change Healthcare is offering free credit monitoring and identity theft protections to all Massachusetts residents who believe they may have been impacted for two years. The dedicated website and call center can guide individuals through setting up free credit card monitoring and identity theft protections. Still, they will not be able to provide individuals with details about whether their data was impacted.

Because the actual number and identity of affected patients are not yet known, the AGO encouraged all consumers to be aware of and utilize the following resources:

Learn more about the cyberattack at Change Healthcare Consumer support page - UnitedHealth Group.
Enroll in free credit monitoring through IDX at Change Healthcare Consumer support page - UnitedHealth Group or by calling 1-888-846-4705
Be aware of potential warning signs that someone is using their medical information. The signs include:
- Receiving a bill from their doctor for services they did not receive;
- Errors in their Explanation of Benefits statement like services they never received or prescription medications they do not take;
- Receiving a call from a debt collector about a medical debt they do not owe;
- Medical debt collection notices on their credit report that they do not recognize;
- Receiving a notice from their health insurance company indicating they have reached their benefit limit; or
- Being denied insurance coverage because their medical records show a pre-existing condition they do not have.

AT&T/Snowflake Breach Hits Most of US - Vendor Exposure Strikes Again

Zick Colin J. — Mon, 15 Jul 2024 09:38:26 Z

AT&T Inc. announced in a July 12, 2024, SEC filing that hackers stole a cache of six months’ worth of mobile phone customer data, illegally downloading the records from a workspace account at the cloud-service provider Snowflake Inc. The information accessed in the breach included calls and text information for nearly all of its cellular customers from May 1, 2022, to October 31 of that year, and it included the numbers customers were calling and a smaller subset of location data.

As set forth in the SEC disclosure:

On April 19, 2024, AT&T Inc. (“AT&T”) learned that a threat actor claimed to have unlawfully accessed and copied AT&T call logs. AT&T immediately activated its incident response process to investigate and retained external cybersecurity experts to assist. Based on its investigation, AT&T believes that threat actors unlawfully accessed an AT&T workspace on a third-party cloud platform and, between April 14 and April 25, 2024, exfiltrated files containing AT&T records of customer call and text interactions that occurred between approximately May 1 and October 31, 2022, as well as on January 2, 2023, as described below.

The data does not contain the content of calls or texts, personal information such as Social Security numbers, dates of birth, or other personally identifiable information. Current analysis indicates that the data includes, for these periods of time, records of calls and texts of nearly all of AT&T’s wireless customers and customers of mobile virtual network operators (“MVNO”) using AT&T’s wireless network. These records identify the telephone numbers with which an AT&T or MVNO wireless number interacted during these periods, including telephone numbers of AT&T wireline customers and customers of other carriers, counts of those interactions, and aggregate call duration for a day or month. For a subset of records, one or more cell site identification number(s) are also included. While the data does not include customer names, there are often ways, using publicly available online tools, to find the name associated with a specific telephone number.

AT&T has taken additional cybersecurity measures in response to this incident including closing off the point of unlawful access. AT&T will provide notice to its current and former impacted customers.

On May 9, 2024, and again on June 5, 2024, the U.S. Department of Justice determined that, under Item 1.05(c) of Form 8-K, a delay in providing public disclosure was warranted. AT&T is now timely filing this report. AT&T is working with law enforcement in its efforts to arrest those involved in the incident. Based on information available to AT&T, it understands that at least one person has been apprehended. As of the date of this filing, AT&T does not believe that the data is publicly available.

The Federal Communications Commission is also investigating, and AT&T believes at least one person has been apprehended in connection with the breach. Snowflake has not commented publicly on the breach in over a month.

SEC Revamps and Enhances Data Protections with Amendments to Regulation S-P

Wed, 29 May 2024 09:47:06 Z

Key Takeaways:

The Securities and Exchange Commission (“SEC”) has announced the adoption of amendments to Regulation S-P (“Amendments”) to modernize and enhance the rules that govern the treatment of consumers’ nonpublic personal information by certain financial institutions (including SEC registered investment advisers (“RIA”)).
RIAs with $1.5 billion or more in assets under management will have 18 months after the date of publication in the Federal Register to comply (and others will have 24 months).
The Amendments will require the covered institutions to:
- develop and implement a written incident response program that reasonably responds to unauthorized access to or use of customer information;
- provide notice, no later than 30 days, to affected individuals in connection with incidents involving such unauthorized access or use;
- establish, maintain and enforce written policies and procedures designed to require oversight of service providers; and
- make and keep compliance records to document policies and procedures to better safeguard and dispose of customer information.
RIAs should examine their existing incident response programs (or implement a program) to ensure compliance with the Amendments. In particular, they should review and update any service provider arrangements.

Overview of the Amendments to Regulations S-P

On May 15, 2024, the SEC adopted Amendments applicable to “covered institutions” being:

investments advisers registered with the SEC (“RIA”)
broker-dealers (including funding portals)
investment companies
transfer agents

The Amendments apply solely to RIAs, and not other types of investment advisers, including state registered investment advisers and exempt reporting investment advisers. In the adopting release footnotes, it is noted that “private funds that are able to rely on 3(c)(1) and 3(c)(7) of the Investment Company Act are not subject to Regulation S-P but they may be subject to the FTC Safeguards Rule. Investment advisers registered with the Commission, including those that are advisers to private funds are covered institutions for the purposes of the final amendments.”

The Amendments will not only broaden the scope of covered institutions by Regulation S-P, but will also require the following:

Development, implementation, and maintenance of written policies and procedures for an incident response program that is reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information;
Procedures to assess the nature and scope of any incident and to take appropriate steps to contain and control the incident to prevent further unauthorized access or use;
Timely notification to affected individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization;
Establishment, maintenance and enforcement of written policies and procedures for the oversight of service providers; and
Maintenance of written records documenting compliance with the safeguards rule and the disposal rule (as defined).

Finally, the Amendments adopt an exception to the annual delivery of privacy notice requirement.

Written Incident Response Program Requirements

General

Regulation S-P, as newly amended, requires that the covered institution’s incident response program has written policies and procedures that address administrative, technical and physical safeguards for the protection of customer information.

The program must be reasonably designed to:

ensure the security and confidentiality of customer information;
protect against any anticipated threats or hazards to the security or integrity of customer information;
protect against unauthorized access to or use of customer information that could result in substantial harm or inconvenience to any customer; and
detect, respond to, and recover from unauthorized access to or use of customer information.

The program must include procedures for the covered institution to:

assess the nature and scope of any incident and identify the customer information systems and types of customer information that may have been accessed or used;
take appropriate steps to contain and control the incident to prevent further unauthorized access or use; and
notify those affected individuals whose sensitive information was, or is reasonably likely to have been accessed or used (as specified below).

The incident response program enables such covered institutions the flexibility to tailor their policies and procedures based on the size, complexity of the institution and the nature and scope of its activities.

Service Providers

In addition, the covered institution’s program should be reasonably designed to require oversight including through due diligence and monitoring of service providers to ensure that the covered institution itself notifies affected individuals. A “service provider” means any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to a covered institution. The program should be reasonably designed to ensure service providers take appropriate measures to:

Protect against unauthorized access to or use of customer information; and
Provide notification to the covered institution as soon as possible, but no later than 72 hours after becoming aware that a breach has occurred (which would then trigger the covered institution to initiate its own incident response program).

The service provider may also be permitted by written agreement with the covered institution to notify affected individuals on the covered institution’s behalf.

Notification Requirements

Covered institutions will be required to comply with quite specific notification requirements in the event an incident of unauthorized access or use occurs or is reasonably likely to have occurred of “sensitive consumer information.”

“Sensitive customer information,” for purposes of the Amendments, is any component of customer information alone or in conjunction with any other information, the compromise of which would create a reasonably likely risk of substantial harm or inconvenience to an individual identified with the information. Examples include, social security numbers, driver’s license and passport numbers, biometric records, unique electronic identification numbers or routing codes, telecommunication identifying information or access devices, or an individual’s account including the account number, name or online username in combination with authenticating information.
Notice must be provided no later than 30 days after becoming aware of the incident to individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization (subject to certain carveouts relating to delaying the notice for substantial risk to national security or public safety).
Notices must:
- describe in general terms the incident and the type of sensitive customer information that was or is reasonably believed to have been accessed or used without authorization;
- include if the information is reasonably possible at the time of notice: date of incident, estimated date of incident, or the date range within which the incident occurred;
- include contact information sufficient to permit an affected individual to contact the covered institution to inquire about the incident; (including a phone number, an email address and the name of a specific office, if applicable);
- recommend, if the individual has an account with a covered institution, to review account statements and report suspicious activity;
- explain what a fraud alert is and how an individual may place a fraud alert in their credit reports and place creditors on notice, and periodically obtain credit reports to have fraudulent transactions deleted;
- explain how the individual may obtain a free credit report, and include information about the availability of online guidance from the Federal Trade Commission (“FTC”) and usa.gov regarding how to better protect oneself from identity theft and how to report the incident to the FTC and include their website; and
- be clear and conspicuous, and provided by a means designed to ensure that each affected individual can reasonably be expected to receive it.

However, notice does not have to be given if, after a reasonable investigation of the facts and circumstances of the incident, the covered institution determines that sensitive customer information has not been or is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience. Note that the Amendments do not define the term “substantial harm or inconvenience,” rather it is a facts and circumstances test. If a covered institution determines that notice is not required, then they will be required to maintain a record of the investigation and basis for its determination.

Broadening the Scope of Information Under Regulation S-P

The Amendments update the requirements of the “safeguards” and “disposal” rules, first introduced in Regulation S-P in 2000. As a recap, the safeguards rule broadly requires broker-dealers, investment companies, and RIAs to adopt written policies and procedures to safeguard customer records and information. The disposal rule requires proper disposal of consumer report information in a manner that protects against unauthorized access to or use of such information.

The Amendments include technical amendments to:

Adopt a new definition of “customer information”. This definition provides greater specificity regarding what customer information must be protected under the safeguards rule and expands the scope of the disposal rule;
Provide customer information protected under both the safeguards and disposal rules, which includes both customer information in the possession of a covered institution and such information handled or maintained on its behalf; and
Provide that both customer and consumer information include information that pertains to individuals with whom the covered institution has a customer relationship as well as customers of other financial institutions where such information has been provided to the covered institution.

Recordkeeping

To better implement and enforce compliance over these newly adopted rules, covered institutions (other than funding portals) will be required to maintain written records documenting compliance with the amended safeguards and disposal rules (i.e., maintaining written records of policies and procedures, as well as notifications sent to affected individuals). The time periods for preserving records vary by covered institution to be consistent with existing recordkeeping rules. For RIAs, all records must be kept for five years, the first two in an easily accessible place.

Annual Delivery of Privacy Notice Exception

Currently Regulation S-P generally requires broker-dealers, investment companies and RIAs to provide customers with annual notices informing them about the institution’s privacy practices. The Amendments now provide for an exception to the annual privacy notice requirement provided certain requirements are met. To qualify for the exception, the institution (i) only provides non-public personal information to nonaffiliated third parties when an exception to third-party opt-out applies; and (ii) has not changed its policies and practices with regard to disclosing nonpublic personal information from its most recent disclosure sent to customers. The Amendments are intended to align with existing privacy notice delivery requirements of the Commodity Futures Trading Commission, the Consumer Financial Protection Bureau and the Federal Trade Commission.

When Will the Rules Become Effective?

The effective date for the Amendments will be 60 days after publication in the Federal Register, with compliance dates of 18 months for “larger entities” (including RIAs with assets under management of US$1.5 billion or more). Other covered institutions which are “smaller entities” will have 24 months after publication in the Federal Register to comply with the new rules.

The full text of the amended S-P Regulation can be found here.

In Wake of Healthcare System Cyberattack, 22 State Attorneys General Call for Further Action on Data Privacy

Mon, 06 May 2024 08:25:04 Z

On April 25, 2024, the attorneys general of 22 states issued a letter encouraging UnitedHealth Group and its subsidiary, Change Healthcare, to take additional steps to respond to a massively disruptive cyberattack. The broad, bipartisan group of signatories reflects both the scale of the attack’s impact and its implications for the priorities of state attorneys general—from healthcare regulation to data privacy, consumer protection, and even antitrust concerns.

The Cyberattack & Response to Date
As our colleagues wrote about previously, on February 21, 2024, Change Healthcare—the largest healthcare payment system in the United States—announced that it had been targeted in a ransomware attack that resulted in its systems shutting down. The attack’s impact has been widespread: The American Hospital Association (AHA) characterized it as “the most significant and consequential cyberattack on the U.S. healthcare system in American history,” with an AHA survey showing more than 90% of hospitals reporting some financial impact.

In their April 25 letter to UnitedHealth Group CEO Andrew Witty, the attorneys general described how “Change Healthcare’s platform is woven throughout the nation’s health care delivery infrastructure,” leading to what they described as the attack’s “catastrophic disruptions” to providers, pharmacies, and patients. The attorneys general also noted a suspected ransom payment of $22 million, made via Bitcoin to a digital-asset wallet associated with Russian “cybersecurity threat actor ALPHV/Blackcat.” Witty has since confirmed that UnitedHealth paid the ransom to regain access to Change Healthcare’s systems, in what he called “one of the hardest decisions I’ve ever had to make.”

The recovery process is underway. Starting on March 7, 2024, UnitedHealth has publicly announced and updated timelines to restore key Change Healthcare systems. Most recently, on April 22, 2024, the company stated that while UnitedHealth had identified some Protected Health Information (PHI) and Personally Identifiable Information (PII) among the data accessed in the attack, it had not seen any evidence of extraction of certain especially-sensitive materials, “such as doctors’ charts or full medical histories.”

Additional Actions Called For
Nonetheless, in the April 25 letter, the attorney general coalition, led by Minnesota Attorney General Keith Ellison, called for further action from UnitedHealth and Change Healthcare to address the fallout from the attack, characterizing their response to date as “inadequate.” The bipartisan group of attorneys general—including those from California, New York, Massachusetts, Nebraska, South Dakota, and Utah—requested several specific actions, including developing a dedicated complaint resolution mechanism for state agency complaints and a helpline for affected providers and pharmacies to resolve questions or affected claims. The attorneys general also called for enhanced financial support for affected entities, noting with approval that UnitedHealth had already removed certain conditions (including a waiver of claims against UnitedHealth) initially placed on its financial assistance. Finally, the attorneys general encouraged UnitedHealth and Change Healthcare to take additional steps to notify entities whose data was exposed in the breach and to shield the information of providers and pharmacies from UnitedHealth’s other corporate lines of business.

The attorneys general specifically noted that their letter did not resolve any ongoing or contemplated investigations, leaving open the possibility of future enforcement actions.

Potential Implications for Future Antitrust Actions
In a press release issued concurrently with the letter, Minnesota Attorney General Ellison, the letter’s lead signatory, highlighted that his office had previously tried to block UnitedHealth’s acquisition of Change Healthcare. In 2022, Attorney General Ellison, along with fellow letter signatory New York Attorney General Letitia James, had joined a U.S. Department of Justice lawsuit alleging that the acquisition would violate antitrust laws, an effort that proved unsuccessful when a U.S. District Court ultimately allowed the merger to proceed. In the April 25 press release, AG Ellison called out the states’ specific allegation in that 2022 suit that the acquisition would “put too much market power and data in the hands of one corporation at so many levels of the health care industry.” His press release then encouraged consumers to report concerns about anticompetitive practices via his office’s antitrust reporting site.

While AG Ellison’s press release does not draw any specific factual connection between the acquisition and the 2024 cyberattack on Change Healthcare, AG Ellison’s invocation of the challenged acquisition suggests his office is closely scrutinizing the data-privacy implications of mergers and acquisitions that would concentrate the ownership or management of consumers’ data. We can expect to hear such concerns articulated in future antitrust inquiries and enforcement actions.

Ellison is not alone in raising antitrust concerns about healthcare industry consolidation; members of Congress share this concern. At a May 1, 2024, hearing of the U.S. Senate Finance Committee at which UnitedHealth’s CEO Witty testified, committee Chairman Ron Wyden echoed this potential connection to antitrust enforcement. Sen. Wyden called the attack a warning about “the consequences of ‘too big to fail’ mega-corporations” and suggested that “anticompetitive practices likely prolonged the fallout from this hack.” When asked directly, Witty assured the committee that UnitedHealth would not “take advantage” of “destabilized provider markets” to acquire additional subsidiaries.

It remains to be seen whether the rhetoric in press releases and committee hearings ultimately translates to future actions seeking to block merger activity, but entities contemplating mergers or acquisitions should expect and plan for increased regulatory scrutiny of their data-privacy policies and protections.

FTC's Updated Health Data Breach Rule Covers Apps, Other New Tech

Zick Colin J. — Mon, 29 Apr 2024 08:30:38 Z

The FTC’s Health Breach Notification Rule (HBNR) was originally adopted in 2009 and applies to entities that handle personal health records (PHR), records that are not Protected Health Information (PHI) covered by the Health Insurance Portability and Accountability Act (HIPAA).

The FTC has updated its HBNR to clarify that the rule also restricts marketing practices involving personal health information. This update to the HBNR was announced on April 26, 2024, and follows several recent enforcement actions by the FTC regarding consumer’s online health information.

As originally drafted, the HBNR required vendors of personal health records to notify individuals and the FTC when there was a breach of personally identifiable health information.
The updated rule makes it clear that the HBNR applies to personal health information in health apps, fitness trackers, and other wearable devices, as well as applying to online services that collect health care data, and any vendors that access that data. It requires these “covered health care providers” to inform affected individuals who their data was shared with. Regarding these provisions, Sam Levine, the director of the FTC’s Bureau of Consumer Protection, said “With the increasing use of health apps and connected devices, the updated HBNR will ensure it keeps pace with changes in the health marketplace,” said Sam Levine.

Revised HBNR definitions “underscore the final rule’s application to health apps and similar technologies not covered by HIPAA,” the FTC said. These changes include a modified definition of “PHR identifiable health information” and two new definitions for “covered health care provider” and “health care services or supplies.” The final rule also expands the required information that companies must give in their notice to consumers, such as the name of third parties that acquired unsecured PHR identifiable health information through a breach of security. The updated rule also clarifies that “breach of security” includes an unauthorized acquisition of identifiable health information due to a data-security breach or unauthorized disclosure.

Under new HBNR timing requirements, covered entities must notify the FTC at the same time they send notices to affected individuals, if more than 500 individuals were affected. The covered health care provider must issue the notification “without unreasonable delay and in no case later than 60 calendar days after the discovery of a breach of security,” the FTC says.

Given these updated rules, companies using non-HIPAA consumer health information should expect close scrutiny and aggressive enforcement in the health data privacy space from the FTC in the coming months and years.

DOJ and Private Whistleblowers Pursue Marijuana-Related Businesses for Alleged Violations of COVID Relief Loan Policies

Carlston Daniel T. — Fri, 19 Apr 2024 09:16:49 Z

The U.S. Department of Justice (DOJ) is investigating cannabis and marijuana-related businesses that allegedly took COVID-19 relief loans in violation of federal rules, with third-party actors leveraging a whistleblower policy that allows them to reap a portion of settlement awards for reporting on the cannabis companies.

In 2020, when former President Trump signed the Coronavirus Aid, Relief, and Economic Security (CARES) Act into law, the federal Small Business Administration (SBA) referred to previous guidance to indicate that businesses “engaged in any illegal activity” under federal law are generally ineligible for Paycheck Protection Program (PPP) forgivable loans. The SBA further stated: “Because federal law prohibits the distribution and sale of marijuana, financial transactions involving a marijuana-related business would generally involve funds derived from illegal activity. Therefore, businesses that derive revenue from marijuana-related activities or that support the end-use of marijuana may be ineligible for SBA financial assistance.”

According to Marijuana Moment, there are now up to 100 active cases being investigated by the DOJ for possible PPP violations, including both businesses involved in the production or sale of marijuana as well as ancillary companies that are not plant-touching. Though the majority of these cases are not public, the DOJ has sent letters notifying businesses either directly or indirectly associated with the state-legal marijuana industry that they are being reviewed for possible violations of the federal False Claims Act (FCA).

The FCA is a whistleblower law that imposes criminal penalties (fines and imprisonment) as well as civil damages, disgorgement, and other remedies in situations where federal funds (such as SBA funds) are obtained by false or fraudulent means – including based on alleged false certifications of eligibility for PPP loans. Under the FCA, private third parties that report PPP violations on behalf of the government through a qui tam lawsuit may be entitled to 15 to 30 percent of the proceeds from any settlement agreement. One public example of this scenario played out this March when Docklight Brands, a Seattle-based business that develops and sells hemp-derived products and licenses certain marks for use in connection with state-licensed cannabis products, agreed to pay back double the amount of the $494,719 PPP loan it falsely certified eligibility for in September 2022.

“Those seeking vital assistance from SBA’s pandemic response programs must comply with the requirements,” Special Agent in Charge Weston King of the SBA's Office of Inspector General's Western Region said in the DOJ press release. Sidesolve LLC, a company that specializes in facilitating whistleblower complaints of alleged PPP loan fraud, filed the qui tam lawsuit against Docklight Brands and subsequently secured $148,416.70 of the settlement funds – the maximum 30 percent under the FCA.

Any business that took PPP loans and works either directly in the production or distribution of cannabis or provides services in connection with the state-legal marijuana industry faces substantial risk of a potential FCA claim. Companies facing this circumstance should consult with counsel to evaluate their individual situation. If you have any questions, please contact the Foley Hoag Cannabis Team or the White Collar Crime & Government Investigations Team for assistance.

Deadline to Comment on Proposed Rules Impacting Infrastructure as a Service Providers Approaching

Wed, 03 Apr 2024 14:27:50 Z

On January 29, 2024, BIS proposed a rule that would impose new requirements for U.S. providers of Infrastructure as a Service (“IaaS”) products and their foreign resellers. The proposed rule would require U.S. IaaS providers and their foreign resellers to implement measures to verify the identity of their customers in ways similar to financial institutions. The rule aims to deter foreign actors from using U.S. IaaS products for malicious activities.

Background
IaaS products offer customers the ability to run software and store data on servers offered for rent or lease without having to assume the direct maintenance and operating costs of those servers. BIS is concerned that malicious foreign cyber actors have been using U.S. IaaS products to steal intellectual property and sensitive data, engage in covert espionage activities, and threaten national security by targeting U.S. critical infrastructure.

Moreover, the U.S. government is concerned about the emergence of large-scale computing infrastructure to which U.S. IaaS providers and foreign resellers provide access as a service, and which malicious foreign actors could use to train large AI models that can assist or automate their malicious cyber activity. The proposed rule aims to address those threats coming from the misuse of U.S.-based IaaS products and services.

Customer Identification Program (CIP) Requirements for U.S. IaaS Providers and Their Foreign Resellers
Under the proposed rule, U.S. IaaS providers and their foreign resellers are required to maintain CIPs, perform effective customer verification, and maintain identifying information about their foreign customers. BIS proposes to require that all U.S. IaaS providers implement their own CIPs, require CIPs from their foreign resellers, and report to BIS on these CIPs.

At a minimum, BIS is proposing that the following customer data would be collected by U.S. IaaS providers and their foreign resellers:

Customer name and nationality (including all beneficial owners of an Account at its inception and any new beneficial owner added to the Account)
Address
Means and source of payment for each customer's account including: credit card number; account number; customer identifier; transaction identifier; virtual currency wallet or wallet address identifier; equivalent payment processing information, for alternative sources of payment; or any other payment sources or types used
Email address and telephone number
Internet protocol (IP) addresses used for access or administration of the user account

U.S. IaaS providers and their foreign resellers would not be required to verify the identity of customers with accounts opened by or on behalf of a U.S. person, unless a foreign beneficial owner is added to the account, or the account (, or a portion of the account), is resold to a foreign person.

The proposed rule would require that U.S. IaaS providers only initiate or continue a reseller relationship with foreign resellers that maintain and implement a CIP that meets the same requirements for CIPs of U.S. IaaS providers. U.S. IaaS providers will be allowed up to one year to implement such CIPs and notify BIS accordingly. U.S. IaaS providers would also be required to furnish a copy of any foreign reseller's CIP to BIS within ten calendar days following a request from BIS.

Under the proposed rules, all CIPs must include procedures to address circumstances where the U.S. IaaS provider or foreign reseller is unable to verify the identity of a customer. In such circumstances, CIPs should include steps that (i) prevent the customer from opening an IaaS account, (ii) grant the customer temporary and limited access while attempting to verify the customer’s identity, (iii) close the account when the customer’s identity cannot be verified, and (iv) implement measures for redress and issue management to address situations in which legitimate customers may fail identity verification or in which their information was compromised and a fraudulent account established.

Exemptions From CIP Requirements
The proposed rule allows the Secretary of the Commerce Department, in consultation with certain other department secretaries and government officials, to issue exemptions from the regulations proposed by the rule tofor U.S. IaaS providers, foreign resellers, or any specific type of account or lessee, from the regulations proposed by the rule if they are found to be compliant with security best practices to otherwise deter abuse of IaaS products. To be found compliant with security best practices, a provider must have an Abuse of IaaS Products Deterrence Program (“ADP”). There is a long list of requirements (contained in §7.306 of the proposed rule) that would need to be included in the ADP to be considered for an exemption.

Special Measures
BIS proposes regulations to implement special measures when the Secretary determines that reasonable grounds exist for concluding that a jurisdiction or person outside of the U.S. "has any significant number of foreign persons offering U.S. IaaS products that are used for malicious cyber-enabled activities or any significant number of foreign persons directly obtaining U.S. IaaS products for use in malicious cyber-enabled activities.” Upon such determination, the Secretary could impose conditions on opening or maintaining an account within a foreign jurisdiction or impose conditions on opening or maintaining accounts by certain foreign persons.

AI Reporting Requirements
Under the proposed rule, U.S. IaaS providers or foreign resellers are required to submit a report to the Secretary when they have knowledge that a foreign person transacts with the U.S. provider to train a large AI model with potential capabilities that could be used in malicious cyber-enabled activity. The report shall would include, at a minimum, the identity of the foreign person and information about the process by which the AI model learns from data using computing power (the training run).

Conclusion
The proposed IaaS rule would significantly impact U.S. IaaS providers and foreign resellers. Foreign AI companies that use U.S. IaaS products could also be affected by this rule. Those impacted by the proposed rule should strongly consider submitting comments, which must be received by April 29, 2024. Foley Hoag’s International Trade & National Security team can assist in effectively submitting those comments to BIS.

Transforming Care Strategies - Integration of AI in Healthcare

Zick Colin J. — Mon, 01 Apr 2024 15:28:34 Z

I was pleased to take part in the “Transforming Care – Strategies for Integration of Artificial Intelligence in Healthcare” discussion, hosted by the New England Healthcare Executive Network at Foley Hoag on April 1. The presentation covered the paradigm shift witnessed by the healthcare industry following the emergence of AI technologies, and the resulting revolution to patient care.

The implications to traditional privacy and data security issues were a key part of the discussion, specifically:

Health Insurance Portability and Accountability Act (HIPAA): HIPAA sets standards for the protection of sensitive patient health information, known as protected health information (PHI). Any AI applications or systems used in healthcare must comply with HIPAA regulations to ensure the privacy and security of patient data.
FTC on non-HIPAA health information and separately regulating AI
State laws on non-HIPAA health information and separately regulating AI
General Data Protection Regulation (GDPR): In regions covered by GDPR, such as the European Union, strict regulations govern the collection, processing, and storage of personal data, including health data. AI applications in healthcare must comply with GDPR requirements to protect patient privacy and obtain appropriate consent for data usage.

My PowerPoint presentation can be viewed here.

HHS-OIG Releases Cybersecurity Toolkit

Zick Colin J. — Tue, 26 Mar 2024 15:52:14 Z

On March 26, 2024, the HHS Office of Inspector General (OIG) released a cybersecurity toolkit for HHS leaders to help them plan and deploy information systems in response to disasters and public health emergencies. The toolkit provides key questions and considerations based on cybersecurity standards that the OIG has used in its work assessing HHS information systems, and many of these are equally applicable to the private sector. However, this toolkit is not intended to comprehensively cover or ensure compliance with all Federal or HHS-specific IT or cybersecurity requirements, but rather to inform and coordinate discussions within the Department and with other stakeholders.

The toolkit lays out the who, why, when, where and what questions that cybersecurity leaders should be asking themselves. It also covers two scenarios: using and modifying an existing or in-house information system, and acquiring a commercial off-the-shelf product. For each scenario, the toolkit suggests four courses of action to ensure an effective cybersecurity posture, such as developing a timeline for testing, assessing the impact on the system's risk categorization and exposure, identifying and testing existing controls, and updating contingency plans and back-up procedures. The toolkit also advises HHS leaders to consult with cybersecurity subject matter experts, such as CIOs and CISOs, and government officials (DHS CISA, and NIST). The toolkit also reminds leaders to specify in contracts that contractors must meet the applicable Federal IT security requirements and regulations.

The toolkit is a useful resource for HHS leaders who need to rapidly roll out information systems to support mission-essential activities, but it also has some limitations and challenges. First, the toolkit does not provide specific guidance or tools for conducting cybersecurity testing, assessing risk, or implementing controls, which may require additional resources and expertise from HHS or external sources. Second, the toolkit does not address how HHS leaders should monitor and evaluate the performance and security of the information systems after deployment, or how they should handle incidents or breaches that may occur. Third, the toolkit does not discuss the legal and ethical implications of collecting, processing, or maintaining sensitive data, such as personal health information, in new or modified information systems, which may raise privacy, compliance, or liability issues for HHS and its partners.

Change Healthcare Cyberattack: Actionable Next Steps for Impacted Entities

Wed, 13 Mar 2024 16:02:12 Z

Key Takeaways:

Change Healthcare, a healthcare technology company owned by UnitedHealth Group, has been impacted by a ransomware attack, so its services have been shut down.
Patients and providers have been most severely impacted by this incident—some patients are being forced to pay out of pocket for medications, and many providers have not been able to submit claims.
Entities that have been impacted by this ransomware attack can take actionable steps outlined below to avoid further disruptions.

Change Healthcare Cyberattack

On February 21, 2024, Change Healthcare—a healthcare technology company owned by UnitedHealth Group—issued a statement that it had been impacted by a ransomware attack. According to Change Healthcare, a “threat actor” gained access to its system. As a result of this cyberattack, Change Healthcare’s services have been shut down.

To provide perspective on the magnitude of this attack and its impact, Change Healthcare serves as the largest healthcare payment system in the U.S. Change Healthcare reportedly manages approximately 15 billion clinical, financial, and operational transactions per year. Specifically, it manages healthcare technology pipelines that process insurance claims and billing. For those reasons, American Hospital Association (AHA) has characterized this attack as “the most significant and consequential incident of its kind against the U.S. healthcare system in history."

Healthcare professionals depend on this system to verify insurance coverage and file claims for reimbursement. Accordingly, the effects of this cyberattack are far-reaching. Providers and patients have been most severely impacted by this incident. Some patients are being forced to pay out of pocket for medications. Further, many providers have not been able to submit claims, so a critical portion of revenue cycle processes have come to a halt.

While a specific timeline to restore the services was not provided during the initial stages of the attack, Change Healthcare has since publicly stated that electronic prescribing is now fully functional along with claim submission and payment transmission. Change Healthcare has also stated electronic payment functionality will become available on March 15, 2024. Lastly, with respect to medical claims, Change Healthcare expects to reestablish connectivity to its claim network and software on March 18, 2024.

Currently, the U.S. Department of Health and Human Services (HHS) and other entities are monitoring and assessing the impact of this cyberattack on providers and suppliers. Recently, the Centers for Medicare & Medicaid Services (CMS) announced that it will accelerate payments for Medicare Part A providers and Part B suppliers. Further, CMS has directed Medicare Administrative Contractors (MACs) to expedite actions needed for providers and suppliers to change the clearinghouse they use and accept paper claims. MACs have issued information to the public on how to submit a request for a Medicare accelerated advance payment.

This incident has exposed the fragility of the U.S. healthcare ecosystem and, more importantly, the need to strengthen the cybersecurity infrastructure of healthcare organizations.

Entities That May Be Impacted

Hospitals, physicians, pharmacists, and other healthcare providers may be impacted by this ransomware attack. Providers, such as physicians and hospitals, may not be able to submit or process insurance claims and, thereby, risk facing significant cash flow problems. Pharmacies may not be able to obtain pertinent information necessary to fill prescriptions. And patients may not be able to submit claims and fill prescriptions.

If you use the Change Healthcare platform, your organization may have been impacted either directly or indirectly. Identifying whether your organization has been impacted is the first step in taking action to avoid further disruptions.

Actionable Next Steps

Entities that have been impacted by this ransomware attack can take the following steps:

Monitor HHS, CMS, and AHA advisories for pertinent updates.
Communicate with payors to determine how to best circumvent compromised Change Healthcare applications.
Review HIPAA compliance programs and take other steps to prepare for a potential breach or regulatory investigation (such as conducting internal audits and running tabletop exercises to simulate the impact of a breach).

Foley Hoag’s Healthcare and Privacy & Data Security practices can assist you with payment challenges and security compliance or incident response matters, to allow you to navigate concerns surrounding the Change Healthcare security incident.

U.S. Department of Energy Releases Cybersecurity Baselines for Utilities and DERs

Wed, 06 Mar 2024 11:55:26 Z

As part of the Biden Administration’s efforts to align energy cybersecurity efforts across the country, the U.S. Department of Energy (“DOE”) has funded the release of a set of energy distribution cybersecurity baselines for entities participating in the nationwide grid transition.

On February 22, 2024, the DOE announced its support for the release of cybersecurity baselines for electric distribution systems and distributed energy resources (“DERs”). The initiative was funded by the DOE’s Office of Cybersecurity, Energy Security, and Emergency Response (“CESER”) in partnership with the National Association of Regulatory Utility Commissioners (“NARUC”). The baselines name minimum voluntary standards that DER operators, utilities, and other electric distribution systems should meet to help mitigate cybersecurity risk and enhance grid security. The announced baselines conclude “Phase 1” of a two-phase initiative, with “Phase 2” set to advise entities of strategies for implementing and adopting the baselines over the next year.

The National Cybersecurity Strategy, issued in 2023, identified energy cybersecurity as an area for the DOE’s attention as the grid becomes increasingly distributed and vulnerable to both physical and cyber-attacks. The current regulatory approach, which entails state-level oversight of energy cybersecurity for DER operators and utilities, puts the grid at risk due to a lack of alignment across states. Phase 1 of this initiative provides states with uniform nationwide cybersecurity baselines that they may meet to become aligned with the U.S.’ energy cybersecurity approach, rather than relying on the existing patchwork regulatory framework.

Phase 1 of this initiative is merely a singular step in what should be a nationwide effort to secure the grid as it becomes integrated with DERs, including wind and solar energy. The National Cybersecurity Strategy is expected to produce additional federal initiatives around energy cybersecurity in light of increased threats to the energy sector.

Takeaways:

Though the baselines are voluntary, states that adopt them will be in greater alignment with nationwide efforts to secure the electric grid and better positioned to collaborate across the public and private sectors.
The baselines are also best practices for entities’ individual cybersecurity efforts, including securing the supply chain, implementing strong IT practices, detecting threats, and detecting and reporting incidents.
In the near term, utilities and DER providers should review their current compliance with the announced baselines and prepare initial strategies to meet them ahead of the Phase 2 announcement in the coming year.
In the long term, such entities should focus on meeting or exceeding the baselines, bearing in mind that future DOE initiatives may enforce stronger mandates than those currently in effect.

The Federal Communications Commission Updates Its Data Breach Rules

Zick Colin J. — Tue, 26 Dec 2023 12:59:37 Z

On December 21, 2023, the Federal Communications Commission released an order updating its data breach rules. These updated rules require telecommunications providers to report breaches of customer proprietary network information, such as numbers that have been dialed and when they have been dialed, but also require reporting of personally-identifiable information (PII), such as driver’s license numbers, Social Security numbers, and credit card numbers. The new FCC rules also require companies to report accidental breaches, a significant change from the prior rules, which only required notification for intentional disclosures, such as when , when a company was tricked or bribed by a bad actor into revealing consumer information.

The FCC’s order also treats breaches as presumptively causing harm—including emotional harm and other harms not directly related to identity theft or financial fraud. This presumption can be overcome, however, if a data custodian can show there was no harm; by making such a showing, a custodian can avoid notifying consumers. Providers who are required to notify affected consumers must do so “without unreasonable delay” and to provide such notice within 30 days after reasonable determination of the occurrence of a breach.

The FCC’s new rules also contain a safe harbor for data breach reporting: no reporting is required if the breached data has been encrypted and there is definitive evidence that the encryption key was not also compromised (in other words, there is no harm that can come to consumers).

The FCC is just the latest federal agency to move forward with new breach reporting obligations, despite the Biden Administration's attempts to harmonize such requirements. The FCC’s action follows on the heels of the Securities and Exchange Commission final rule requiring businesses to report cyberattacks to the agency within four days of determining the scope of compromise and the Federal Trade Commission’s recent updates to its breach reporting rules. The FCC acknowledged that it declined to take action to harmonize with the Cyber Incident Reporting for Critical Infrastructure Act of 2022, or CIRCIA, which requires the Cybersecurity and Infrastructure Security Agency to publish a proposed rule by March 2024; as such, the burden of making sense of the regulatory maze continues to fall on those companies subject to these regulations.

FBI and CISA Issue Advisory on Scattered Spider Ransomware Attacks

Zick Colin J. — Mon, 27 Nov 2023 16:05:53 Z

Large companies holding sensitive data – including financial services, telecommunications, business process outsourcing, hospitality, and cryptocurrency firms – as well as their IT helpdesks, are increasingly being targeted by ransomware attacks. The Federal Bureau of Investigation (FBI) and Cybersecurity & Infrastructure Security Agency (CISA) have jointly released a cybersecurity advisory in response to recent activity by the threat actor group known as Scattered Spider. Scattered Spider received significant attention in September 2023 when it launched a ransomware attack against multiple casino operators, the details of which became known in securities filings following the SEC's adoption of data breach reporting rules for public companies in July 2023. Scattered Spider has re-emerged in recent days launching ransomware attacks against multiple targets in a short span of time. The main details of the advisory are summarized below, though clients should direct their IT professionals to consult the full advisory.

What techniques are Scattered Spider employing?

Scattered Spider operatives have been reported to be posing as company IT or helpdesk staff in order to obtain credentials from employees, or to direct employees to run remote access tools that permit Scattered Spider to access a company network. Because IT support is also frequently offered through the use of remote access tools, Scattered Spider has been able to successfully impersonate IT professionals on a number of occasions. Similarly, Scattered Spider has been making use of multi-factor authentication tools (again utilizing tools that are familiar to employees who frequently utilize tech support) to prompt employees to share passwords and/or run remote access tools.

What can be done to mitigate the threat?

The FBI and CISA recommend the use of the following measures:

Address the threat of remote access tools:
- This includes auditing remote access tools on a company network, reviewing logs for execution of remote access software, and requiring only authorized remote access solutions to be used only from within a company network.
Implementing application controls that manage and control execution of software. The use of “allow-listing” (that is, only allowing pre-defined software to be executed) can block un-listed application execution, including execution of malicious files that are compressed, encrypted, or otherwise obfuscated.
Implementing multi-factor authentication based on public key infrastructure, which is known to resist the tactics utilized by Scattered Spider.
Strictly limiting the use of remote desktop protocols and, when using, taking extra precautions such as locking out accounts after a specified number of attempts and logging in remote desktop logins.

In addition, the FBI and CISA reinforce the continued importance of basic cybersecurity best practices:

Implementing recovery plans and retaining multiple copies of sensitive data that could be targeted in a ransomware attack, including maintaining offline backups.
Requiring all accounts with passwords to comply with NIST password standards.
Requiring phishing-resistant multi-factor authentication for all services to the extent possible.
Keeping operating systems, software, and firmware up to date.
Segmenting networks to prevent the spread of ransomware.
Monitoring networks for abnormal activity.
Installing and regularly updating antivirus software.
Disabling unused ports and protocols.
Ensuring that backup data is encrypted, that it cannot be altered, and that it covers the entire organization's infrastructure.

Additionally, the FBI and CISA are actively soliciting reporting on the Scattered Spider group actors, and urge individuals or entities suffering from ransomware attacks or that obtain information about Scattered Spider to contact a local FBI field office or CISA operations center.

CISA Publishes Mitigation Guide to Combat Cyber Threats in the Healthcare and Public Health Sectors

Zick Colin J. — Fri, 24 Nov 2023 10:49:08 Z

If you need a little intellectual stimulation after hours of Thanksgiving turkey and football, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has just the thing — the new CISA Mitigation Guide for the Healthcare and Public Health Sectors. This somewhat technical guide is a little dry, but it offers solid recommendations and sugested best practices to combat the pervasive cyber threats affecting the Healthcare and Public Health (HPH) Sectors.

CISA identified and its guide addresses common vulnerabilities and insecure configurations across the HPH Sector, such as:

• Web application vulnerabilities
• Encryption weaknesses
• Unsupported software
• Unsupported Windows operating systems (OS)
• Known exploited vulnerabilities (KEVs)
• Vulnerable services

Exposure of these and other vulnerabilities can result in ransomware, data breaches, or denial-of-service, and can compromise the availability, confidentiality, and integrity of criticial HPH systems, functions, and data. So skip the holiday shopping crowds and spend a little time with CISA’s Mitigation Guide this weekend.

Your Password Cant Possibly Be This Bad, Can It?

Zick Colin J. — Sun, 19 Nov 2023 16:12:36 Z

NordPass (the purveyor of a password manager) has assembled a list of the top 20 passwords in healthcare, based on usage by the world’s largest companies. According to NordPass’s analysis, the “top” 20 passwords are:

1. 1. 1. 1. 123456
      2. password
      3. part of the company’s name*
      4. 12345
      5. aaron431
      6. part of the company’s name2012*
      7. Part of the company’s name*
      8. PART OF THE COMPANY’S NAME443*
      9. company name2014*
      10. linkedin
      11. pass1
      12. company name*
      13. COMPANY NAME’S ABBREVIATION1*
      14. company name*
      15. 00000
      16. 1111
      17. company name*
      18. 1234
      19. Med
      20. company name*

Obviously, none of these are optimal, particularly in situation where HIPAA Protected Health Information may be involved.

(One of these, Aaron431, is a bit of a mystery. It may be that it is a default password on a common application.) The point of noting these passwords is, of course, to prompt you to reviecw/change your passwords. Or better yet, adopt a password manager, so you can utlize more complete passwords and change the more easily.

Massachusetts Extends Protections for Counseling Records of Survivors of Sexual Assault

Zick Colin J. — Sun, 05 Nov 2023 12:13:54 Z

Massachusetts Extends Protections for Counseling Records of Survivors of Sexual Assault

The Massachusetts Supreme Judicial Court has ruled in In the Matter of a Motion to Compel, SJC-13336 that the Superior Court could not order a Massachusetts counseling center to turn over, at the behest of a Rhode Island court, counseling records of the alleged minor victim of a sexual assault that occurred in Rhode Island, without the court first following to the so-called Lampron-Dwyer protocol.

The Lampron-Dwyer protocol, first set out in Commonwealth v. Dwyer, 448 Mass. 122 (2006) and Commonwealth v. Lampron, 441 Mass. 265, 269-270 (2004), provides a step-by-step process Massachusetts courts must follow when defense counsel in a sexual assault case request access to a victim's counseling records. The Lampron-Dwyer protocol adheres as much as possible to M.G.L. c. 233, §20J, the statutory privilege shielding such records from disclosure, while protecting a defendant's due process rights.

In this case, Foley Hoag LLP submitted an amicus brief on behalf of long-time pro bono clients the Victim Rights Law Center (VRLC) and Jane Doe, Inc. (JDI). The case addressed whether survivors of sexual assault who are resident in Massachusetts and receive mental health counseling related to the assault retain the privacy rights in those counseling records granted to them under Massachusetts law if the assault occurred outside of Massachusetts (in this case, Rhode Island). As amici, VRLC and JDI argued that survivors should not be stripped of certain existing privacy protections simply because the assault occurred in another state. The SJC ultimately agreed, ruling that the well-established Lampron-Dwyer protocol must be followed prior to the disclosure of otherwise-protected counseling records of sexual assault survivors. Practitioners and advocates hailed the decision as a victory for sexual assault survivors who rely on the privacy protections provided in Massachusetts when seeking much needed counseling services.

The Underlying Criminal Case

The appeal arose out of a criminal case in Rhode Island against an alleged perpetrator of sexual assault against a minor. The minor survivor was resident in Massachusetts, but the assault occurred in Rhode Island. The minor sought counseling following the assault from Wayside Youth & Family Support Network, a Massachusetts-based counseling center that provides sexual assault counseling to youths. The defendant sought the survivor's counseling records from Wayside, claiming that he believed the records would support his alibi. He obtained an order from a Rhode Island court under the Uniform Law to Secure the Attendance of Witnesses from Without the State in Criminal Proceedings, M.G.L.c. 233, §§ 13A-13D (the Uniform Law), which demanded that Wayside turn over the victim's records.

Under Massachusetts law, counseling records like those sought in this case are generally privileged, under the sexual assault counselor's privilege provided in M.G.L. c. 233, § 20J. The SJC also established stringent non-disclosure protections for such records in the Lampron-Dwyer protocol and related cases.. The Lampron-Dwyer balancing test the SJC developed allows courts to determine when an exception might be made to the general bar for disclosing these confidential records.

The Massachusetts Superior Court judge in this case initially denied the defendant's request for counseling records in light of the §20J privilege, but ultimately issued an order compelling production of the records, citing the SJC's 1993 Matter of a R.I. Grand Jury Subpoena decision, which stated that, under the Uniform Law, the requesting state must make any privilege determinations. The judge also stayed the order and reported the case for appellate guidance.

The Impact for Survivors and their Advocates

The SJC's decision ruling that the Massachusetts judge committed reversible error when he issued the order compelling the production of the survivor's sexual assault counseling records without first considering the § 20J privilege or applying the long-standing Lampron-Dwyer balancing test reinforces the view of the Commonwealth, VRLC, and JDI that sexual assault counseling records are entitled to special privacy protections that few other records are entitled to under Massachusetts law.

Through the protections in § 20J, the Lampron-Dwyer protocol, and related cases, Massachusetts has identified the sexual assault counselor and survivor relationship as one of the few societal relationships entitled to a privilege that should only be pierced in rare and necessary circumstances. The list of relationships entitled to such privileges is small—the priest-penitent privilege is one of the few comparable statutorily established privileges—emphasizing the conscious decision made by the legislature to protect this beneficial relationship. This SJC decision upholds those protections and provides the consistency in application of the law that both survivors and their advocates can rely upon.

The Foley Hoag team representing VRLC, Jane Doe, Inc. and the other amici consisted of Anthony Mirenda, Laura Gradel, and Foley alum Adam Aguirre.

President Biden Issues Executive Order on Use of Artificial Intelligence in Healthcare Settings

Tue, 31 Oct 2023 10:37:40 Z

Key Takeaways:

This executive order (EO) directs federal agencies to review and develop policies to guide the use of artificial intelligence that touches every sector of the economy.
The EO directs the Department of Health and Human Services (HHS) to establish an HHS AI Task Force to develop a strategic plan on the responsible deployment of AI and AI-enabled technologies in healthcare settings.
The EO also directs HHS to develop a strategy for regulating the use of AI-enabled tools in the drug development process.
The Biden administration actions to direct government agencies on the development, use, and maintenance of AI will bring renewed focus and interest in the use of AI going forward.

_________________________________________________________________________________________

On October 30, 2023, President Biden issued an executive order (EO) to guide federal agencies on the development and use of artificial intelligence (AI). The administration views AI as holding numerous benefits but at the same time cautions it could exacerbate societal harms if not responsibly managed.

The Biden administration laid out eight principles to guide federal agencies in advancing, using, and overseeing AI. The first principle is that AI must be safe and secure, meaning there must be robust, reliable, and standardized evaluations of AI systems, as well as policies or other mechanisms, including institutions, to test, understand, and mitigate risks from these systems before they are in use. This is particularly relevant, as the EO notes, to the biotechnology and cybersecurity industries. In meeting this principle, the administration will develop labeling and content provenance mechanisms to help determine when content is generated using AI and when it is not.

The next set of principles focus on promoting responsible innovation, competition, and collaboration to allow the United States to lead in AI. This includes a commitment to supporting American workers and furthering health equity and civil rights. It also focuses on upholding consumer protection laws and Americans’ privacy and civil liberties.

The final set of principles seek to govern the Federal Government’s own use of AI and increase its internal capacity to regulate and govern the responsible use of AI. This includes developing a framework to manage AI’s risks, unlock AI’s potential for good, and promote common approaches with other nations.

EO Healthcare Implications
To ensure safe and responsible use of AI in the healthcare industry, the EO directs the Department of Health and Human Services (HHS) to establish an HHS AI Task Force within one year. This task force shall develop a strategic plan that includes policies, and possibly regulatory action, on responsible deployment of AI and AI-enabled technologies in the healthcare sector, including research and discovery, drug and device safety, healthcare delivery and financing, and public health.

The EO directs HHS to identify appropriate guidance and resources to promote AI’s deployment and use in a variety of settings and situations. This includes:

the development, maintenance, and use of predictive and generative AI-enabled technologies in healthcare delivery and financing, including quality measurement, performance improvement, program integrity, benefits administration, and patient experience, and considering appropriate human oversight of the AI-generated output;
identifying uses of AI that promote workplace efficiency and satisfaction, and the development and maintenance of documentation to help users determine appropriate and safe uses of AI in local healthcare settings;
monitoring long-term safety and performance of AI-enabled technologies, including clinically relevant or significant modifications and performance across population groups, and incorporating equity principles in AI-enabled technologies. This means using disaggregated data on affected populations and representative population data sets when developing new models, and monitoring algorithmic performance against discrimination and bias in existing models.

To protect personally identifiable information, the EO calls for incorporating safety, privacy, and security standards into the software-development lifecycle, including measures to address AI-enhanced cybersecurity threats.

The EO also directs HHS to consider appropriate actions to advance compliance and understanding of federal nondiscrimination laws by health providers that receive federal financial assistance, and its relationship to AI. This may include providing technical assistance or issuing guidance to healthcare providers and payers about their obligations under nondiscrimination and privacy laws as they relate to AI.

Notably, the EO directs HHS to develop a strategy for regulating the use of AI or AI-enabled tools in drug development processes. This strategy shall define the objectives, goals, and high-level principles required for appropriate regulation throughout each phase of drug development, identify areas where future rulemaking, guidance, or additional statutory authority may be necessary, and identify existing budget, resources, and personnel for such regulatory systems.

Lastly, the EO directs HHS, in consultation with the Secretary of Defense and Veterans Affairs, to establish an AI safety program that establishes a common framework for approaches to identifying and capturing clinical errors resulting from AI deployed in healthcare settings, as well as specifications for a central tracking repository for associated incidents that cause harm to patients, caregivers, or other parties.

Next Steps
While the EO provides up to one year for many of these actions to occur, it is possible the administration and these agencies will begin operationalizing and engaging industry to begin building AI frameworks and seeking necessary input to roll out AI systems and processes in key areas of the healthcare sector.

NY State Education Department Bans Facial Recognition Technology

Rodriguez Madeleine K. — Mon, 23 Oct 2023 10:30:04 Z

In late September, the NY State Education Department issued a two-page order providing that NY public schools may not purchase or utilize facial recognition technology. The Department relied on a report issued by the NY Office of Information Technology Services in August that was critical of the privacy implications of facial recognition technology, but left open the door for the use of other types of biometric technology in schools.

The Department's actions followed on litigation that began in 2020 after an upstate school district began implementing a facial recognition system intended to identify potentially threatening non-students on school premises. After the litigation began, the state legislature enacted a moratorium on facial recognition technology while the State Education Department and Office of Information Technology Services conducted further research and issued a final decision.

In its report, the Office of Information Technology Services focused heavily on potential impacts to student privacy as well as equity concerns, noting that research on facial recognition technology has noted the possibility of higher rates of incorrect identification on people of color, non-binary and transgender individuals, women, the elderly, and, importantly, children. The report likewise expressed significant concerns over the possibility of breaches to biometric databases that would be needed to make the facial recognition technology work, noting that because biometric information generally cannot be changed, the disclosure of biometric data could potentially put users at permanent risk.

Ultimately, the report was less critical of non-facial recognition biometric technology, such as the use of digital fingerprinting. The Department's order potentially allows for the use of such technology, as it authorizes school districts to “determine whether to use biometric identifying technology other than facial recognition technology at the local level.”

Similar debates are taking place at the local level in other states, too. Montana, for example, has recently begun to utilize facial recognition technology for security purposes in several small school districts. Though there is no over-arching federal policy on the use of facial recognition technology in schools, the Federal Educational Rights and Privacy Act (“FERPA”) does require certain protections for “biometric records” of students, which can include, among other things, “retina and iris patterns” and “facial characteristics.” That said, FERPA does not have highly built-out requirements in relation to privacy and data security (in the way that, for example, HIPAA does in the health context), and the potential for data breaches to occur figured heavily in the Department's analysis as well as other state-level debates about facial recognition.

We expect these debates will continue as schools continue to search for technologies that enhance security on campus, while attempting to balance the need for security with the various other issues presented by facial recognition technology.

HHS OCR/ONC Announce Latest Version of Security Risk Assessment Tool

Zick Colin J. — Sun, 17 Sep 2023 15:25:26 Z

The U.S. Department of Health and Human Services Office for Civil Rights (OCR) and the Office of the National Coordinator for Health Information Technology (ONC) have released version 3.4 of their Security Risk Assessment (SRA) Tool.

The SRA Tool is designed to help healthcare providers conduct a risk analysis as required by the HIPAA Security Rule. Identifying and assessing potential risks and vulnerabilities to electronic protected health information (ePHI) are foundational elements in the implementation of security measures that protect ePHI. As hacking and ransomware attacks continue to increase within the health care sector, it is more important than ever for organizations to understand their risk exposure and use that understanding to improve their cybersecurity.

The downloadable SRA Tool is a desktop application that walks users through the security risk assessment process using multiple-choice questions, threat and vulnerability assessments, and asset and vendor management. References and additional guidance are given along the way. Reports are available to save and print after the assessment is completed.

The latest version contains a variety of feature enhancements based on user feedback and public input. New features include:

1) A Remediation Report to help track responses within the tool
2) A Glossary and “Tool Tips” help
3) Updated references to Health Industry Cybersecurity Practices (HICP) for 2023 Edition
4) Bug fixes and stability enhancements

New EU-US Data Privacy Framework Promises Greater Ease for Cross-Border Transfers, but Uncertainty Remains

Christopher Escobedo Hart — Sun, 30 Jul 2023 08:10:36 Z

Ed. Note: Thank you to Summer Associate Nicole Onderdonk for her significant contributions to this post.

On July 10, 2023, the European Commission (EC) adopted its adequacy decision for the EU-U.S. Data Privacy Framework (EU-U.S. DPF, or “Privacy Framework”), which establishes the Privacy Framework as an authorized mechanism under the General Data Protection Regulation (GDPR) for personal data to be transferred freely from the European Union (EU) to United States (U.S.) companies, effective immediately.

The EU-U.S. DPF replaces the defunct EU-U.S. Privacy Shield Framework, ruled invalid as a transfer mechanism by the Court of Justice of the European Union (CJEU) in its July 2020 ruling in the Schrems II case. The new Privacy Framework introduces two binding safeguards that directly address concerns raised by the CJEU in Schrems II regarding U.S. intelligence agencies' surveillance programs and appropriate redress for EU citizens who believe their data rights have been violated. Under the EU-U.S. DPF, the U.S. government has committed to (1) limiting U.S. intelligence agencies' access to EU personal data (confining that access to only what is necessary and proportionate to protect national security); and (2) establishing an independent and impartial redress mechanism, including the new Data Protection Review Court (DPRC), to investigate and resolve complaints from Europeans regarding unlawful access to or use of their data by U.S. intelligence agencies.

As was the case under Privacy Shield, in order to rely on the EU-U.S. DPF for data transfers from the EU, a company must self-certify its adherence to certain privacy principles. The principles under the new framework—the EU-U.S. DPF Principles—and the self-certification process are generally the same as they had been under Privacy Shield. Nevertheless, the adequacy decision has several implications for U.S. companies that may require immediate or near-term action, in particular for companies that previously self-certified under Privacy Shield or would like to self-certify under the new framework.

Background

The EU-U.S. DPF adequacy decision follows a nearly two-year effort by the EU and the U.S. to develop a Privacy Shield replacement following the Schrems II ruling. Schrems II had not been the first judicial setback for transatlantic data transfers. Prior to the adoption of GDPR in 2016, EU-U.S. data transfers were governed by the Safe Harbor Framework, negotiated in 2009 and in place until 2015. In October 2015, the CJEU invalidated Safe Harbor in its Schrems I ruling, lack of adequate protection for personal data from U.S. government interference for national security and public interest purposes. In July 2020, the CJEU invalidated Privacy Shield, which had attempted to address some of the concerns surrounding Safe Harbor, on similar grounds in its Schrems II ruling.

Following this defeat, in August 2020, the EU and the U.S. began initial discussions on the potential for a replacement privacy framework, acknowledging mutual interests in both protecting privacy and facilitating transatlantic economic relations. In March 2022, the parties reached an agreement in principle on a new framework. On October 7, 2022, President Biden issued Executive Order (E.O.) 14086, “Enhancing Safeguards for United States Signals Intelligence Activities,” that directed the implementation of the privacy and civil liberty safeguards for U.S. signals intelligence activities called for by the EU: limiting U.S. intelligence agencies' access to EU personal data transferred to the U.S. and establishing an independent and impartial redress mechanism for Europeans alleging a violation of their data rights.

Pursuant to E.O. 14086, several departmental actions followed. First, the Department of Justice (DOJ) issued a regulation establishing the DPRC as the second level of the two-level independent redress mechanism for Europeans with complaints regarding U.S. intelligence agencies' access to or use of personal data (the first level being Civil Liberties Protection Officers (CLPOs)). Next, on June 30, 2023, Attorney General Merrick Garland designated the EU and Iceland, Liechtenstein, and Norway (collectively the European Economic Area) as “qualifying states” for the purposes of individual's filing “qualifying complaints” alleging certain violations of law by U.S. intelligence agencies. Finally, on July 3, 2023, the Office of the Director of National Intelligence (ODNI) confirmed that the U.S. intelligence community had adopted updated policies and procedures to limit access to EU personal data unless it is necessary and proportionate to protect a specific national security interest. On the same day, Secretary of Commerce Gina Raimondo issued a statement confirming that, through E.O. 14086, the departmental actions taken pursuant to it, and the updated EU-U.S. Data Privacy Framework Principles, the U.S. had fully implemented the agreed-upon privacy and civil liberty safeguards and had therefore fulfilled its commitments under the EU-U.S. DPF, paving the way for the EC to issue an adequacy decision. One week later on July 10, 2023, the EC adopted its adequacy decision, bringing the Privacy Framework into force.

The New Privacy Framework

In order to rely on the EU-U.S. DPF for personal data transfers from the EU, an organization must self-certify its adherence to the EU-U.S. DPF Principles issued by the DOC. To be eligible to self-certify, companies must be subject to the jurisdiction of the Federal Trade Commission (FTC), the U.S. Department of Transportation (DOT), or another statutory body that will ensure compliance with the Principles. Re-certification must be completed at least annually. The DOC maintains a publicly available list of certified organizations. An organization may be removed from the list if it fails to re-certify annually, if it persistently fails to comply with the Principles, or if it requests to withdraw from the program.

While the privacy obligations and procedures for U.S. companies under EU-U.S. DPF are generally the same as those under Privacy Shield, the adequacy decision nonetheless has implications that may require immediate or near-term action.

Who Can Certify, and How?

With the new framework in force and Privacy Shield fully defunct, whether a company needs to take action will be determined by whether a company was previously self-certified under Privacy Shield and whether a company would like to self-certify under the new framework.

Companies who previously self- certified under the Privacy Shield and wish to participate in the EU-U.S. DPF may begin relying immediately on the new framework for data transfers if they comply with the EU-U.S. DPF Principles, including updating their privacy policies to reference the new principles within three months of the adequacy decision (i.e., by October 10, 2023). Previously self-certified companies do not need to complete a separate, initial self-certification submission to participate in EU-U.S. DPF, but do need to complete an annual re-certification submission when due. A previously self-certified company updating its privacy policy to reference the new principles does not change that company's original certification date or re-certification due date.
Companies who previously self-certified under the Privacy Shield and do not wish to participate in the EU-U.S. DPF must follow the procedure for withdrawal referred to in Section III.6.f of the Principles. Companies must notify the DOC in advance and indicate what the company will do with the personal data that it received in reliance on the EU-U.S. DPF or prior privacy framework (e., retain, return, or delete the data; if retaining the data, specifying an alternative authorized mechanism for protecting the data is required).
Companies who did not previously self- certify under the Privacy Shield and would like to self-certify under EU-U.S. DPF must follow the procedure for initial self-certification referred to in Section III.6.b of the Principles. Companies must complete a submission that includes a confirmation of the company's adherence to the principles and other specific information such as the privacy policy, a description of how EU personal data is used, a contact office for handling complaints, and the U.S. statutory body which has jurisdiction over the company.

The EU-U.S. DPF website went live on July 17 and enables U.S. companies to complete initial certification and re-certification submissions, as well as access resources and receive program updates. The new website will also be a source of information for the UK Extension to the EU-U.S. DPF and Swiss-U.S. DPF, both of which are pending adequacy decisions from their respective national authorities and therefore cannot yet be relied upon for data transfers. The website replaces the resources and functionality previously available through the Privacy Shield website, which was taken offline on July 14.

Companies have several additional obligations under the EU-U.S. DPF Principles.

While the Privacy Shield Principles and EU-U.S. DPF Principles are generally the same, there some specific differences that companies should be aware of.

First, unlike under the Privacy Shield, a transfer of key-coded medical or pharmaceutical research data that is considered personal data under EU law is now covered by the EU-U.S. DPF Principles, even if only the researcher holds the “key” to the dataset.

Second, the EU-U.S. DPF Principles include a few additional requirements for certified companies who change their corporate status, including: (a) notifying the DOC of the change in advance; and (b) indicating whether the company will (i) continue to participate in the EU-U.S. DPF through an existing self-certification, (ii) self-certify as a new participant, or (iii) implement other safeguards (e.g., a written agreement) to ensure continued adherence to the Principles with regard to any personal data the organization received while certified. If the company does not plan to pursue any of those options for protecting the data, any personal data received while certified must be returned or deleted.

Cross-border transfer for certified organizations is greatly simplified

Post-Schrems II, U.S. companies that had relied on the Privacy Shield framework for EU to U.S. data transfers were forced to scramble to find new transfer mechanisms — namely Standard Contractual Clauses (SCCs) (although companies may have sought to implement Binding Corporate Rules or simply seek consent, if feasible). And the new SCCs that came into effect in 2022 required the use of Transfer Impact Assessments (TIAs) for transfers to the U.S.

The new Privacy Framework accomplishes two things: first, it obviates the need to have a separate transfer mechanism if an organization is certified. Second, it does away with the TIA requirement for any company in the U.S. In other words, so long as the DPF is valid, U.S. organizations have a much more simplified way of transferring data from the EU.

4. Other authorized data transfer mechanisms under GDPR are still valid.

An adequacy decision is only one of several authorized mechanisms under the GDPR by which a company may lawfully transfer personal data from the EU (and Norway, Liechtenstein and Iceland) to a non-EU country. Adequacy decisions are issued by the EC, which is responsible for assessing whether a non-EU country provides a level of protection for personal data essentially equivalent to that of the EU. Additional mechanisms for lawful transfers include standard contractual clauses (SCCs), which are model contract clauses pre-approved by the EC, and binding corporate rules (BCRs), which are data protection policies adhered to within a group of enterprises. The lawfulness of these mechanisms remains unchanged following the EU-U.S. DPF adequacy decision. However, the U.S. government's compliance with the new privacy and civil liberty safeguards established under the EU-U.S. DPF applies to all personal data transfers, regardless of which authorized data transfer mechanism is used. This may prove beneficial to U.S. companies, even if they are not relying on the EU-U.S. DPF adequacy decision for their transatlantic data flows. For example, while transfer impact assessments (TIAs) will still be required when using SCCs or BCRs to transfer personal data from the EU to a non-EU country, the transaction costs associated with these transfers may decrease due to a company's ability to rely on the EU-U.S. DPF adequacy decision for certain responses in TIA questionnaires.

Looking Forward: An Uncertain Future, or Should We Worry About Schrems III?

While the EU-U.S. DPF adequacy decision marks a significant step forward for stabilizing EU-U.S. data flows and related economic relations, uncertainty remains.

First, adequacy decisions may be adapted or withdrawn due to material developments affecting the level of protection in the non-EU country. The EU-U.S. DPF adequacy decision is subject periodic reviews by the EC and local European data protection authorities,(with the first review taking place within the first year), to assess whether all commitments under the EU-U.S. DPF have been fully implemented and are functioning effectively.

Second, based on the history of EU-U.S. privacy frameworks and the European courts, the EU-U.S. DPF is likely to be judicially challenged. And despite the European Parliament's best attempts to “future proof” the framework and its resolution to issue the adequacy decision only if it was likely to be held up in court, it is unknown whether the EU-U.S. DPF addresses the concerns raised in Schrems I and Schrems II sufficiently enough to resist invalidation by the CJEU.

Third, the DOC, responsible for administering and monitoring the efficacy of the program, is authorized to make changes to the ensure the program's compliance with the U.S. government's commitments. In addition, while the FTC has historically been responsible for enforcing U.S. companies' compliance with EU-U.S. privacy frameworks (including Safe Harbor and Privacy Shield), what enforcement will look like under the EU-U.S. DPF is not clearly prescribed.

In sum, while companies who self-certify can rely on the EU-U.S. adequacy decision for their transatlantic data transfers in today in the near term, other authorized transfer mechanisms (e.g., SCCs, BCRs) should remain at the forefront until the future of the EU-U.S. DPF becomes more certain.

Seven Major U.S. Tech Organizations Voluntarily Commit to A.I. Safeguards

Christopher Escobedo Hart — Fri, 28 Jul 2023 15:42:47 Z

Ed Note: Thank you to Summer Associate Nicole Onderdonk for her significant contributions to this post.

On July 21, 2023, the White House announced that seven leading A.I. organizations (Amazon, Anthropic, Google, Inflection, Meta, Microsoft, and OpenAI) agreed on and committed to immediately implementing voluntary safeguards for the development of artificial intelligence (A.I.) technology. Although not legally binding, these “voluntary commitments” mark one of the first steps in what could develop into a U.S. regulatory regime for A.I.

With this announcement, the U.S. joins other governments around the world trying to keep pace with A.I.'s rapid development, spurred on by recent advances in generative A.I. technology that can create text and imagery based on human prompts. These advances have raised concerns regarding A.I.'s potential to reinforce existing systems of oppression, spread disinformation, and serve as a tool to commit cybercrimes. The safeguards address these concerns by bolstering safety, security, and trust in the A.I. space. Specifically, the seven organizations committed to the following safeguards:

Conducting internal and external (i.e., independent) security testing of A.I. products for the most significant risks posed, including biosecurity, cybersecurity, and other potential societal harms before release to the public;
Sharing learnings and best practices with government, society, and academia on managing A.I. risks;
Investing in cybersecurity and insider threat mechanisms;
Facilitating third-party discovery and reporting of vulnerabilities in A.I. products;
Publicly reporting their A.I. product's capabilities, limitations, and appropriate/inappropriate uses, highlighting security (e.g., technical vulnerabilities) and societal (e.g., bias) risks;
Developing technical mechanisms (e.g., watermarking) to ensure users can easily identify A.I. generated content;
Conducting research on the societal risks of A.I. products, including bias, discrimination and invasion of privacy, and how to avoid such risks; and
Developing and deploy A.I. technology to address broad societal challenges, such as climate change and cancer.

Even before agreeing to these voluntary safeguards, the tech industry has explored self-regulatory governance mechanisms. For example, Google implemented teams to test its systems and publicized some information on certain A.I. models. In addition, Meta and OpenAI invited external teams to test the vulnerability of their models. Both measures are included in the list of voluntary safeguards, which calls into question how much these commitments will change the operation of these organizations in the near term.

Potential Future Efforts to Regulate A.I.

While all seven organizations committed to these measures publicly, and the Biden-Harris administration stated that it “will continue to remind these companies of their responsibilities and take decisive action to keep Americans safe,” there is no formal accountability mechanism accompanying these commitments to ensure effective implementation by these organizations. In addition, several of the commitments call for external, independent oversight, but the party responsible for performing these audits is not specified.

Despite these gaps, these voluntary commitments appear to be only an initial step in a long-term regulatory push by the White House, which is envisioned to include “some new laws, regulations and oversight,” as outlined by President Biden in his live remarks on the matter. Organizations can expect future measures that will go farther than these commitments, including a forthcoming executive order and a bipartisan legislative effort in Congress which is currently underway. Additionally, the FTC's investigation of OpenAI for alleged unfair and deceptive practices may indicate that government agencies could play a larger role in developing law enforcement mechanisms in this space, even without immediate executive or legislative action.

U.S. government and A.I. organization officials believe these safeguards can serve as a model for an international framework that enables responsible innovation while protecting the rights and safety of individuals. The Biden-Harris administration stated that it consulted with several international governments on the voluntary safeguards and hope that future regulatory efforts will “help America lead the way toward responsible innovation” in the A.I. space, said the President in his remarks.

Steps Organizations Can Take to Prepare for Future A.I. Regulations

While the regulatory future in this space is still uncertain, organizations can take steps in the near term to prepare for what might come next. As signaled by the White House, the voluntary commitments will likely serve as a basis for Congress and agencies tasked with regulating this space. Organizations using A.I. tools should conduct board-level conversations regarding the role of A.I. in their current and future business plans and develop generative A.I. acceptable use policies for their organizations. In addition, clients who operate global businesses should be aware of other government's regulatory developments. For example, the voluntary commitments contrast the strict requirements contemplated under the EU A.I. Act, which is in the process of being finalized and would impose mandatory compliance requirements based on the risk categorization of A.I. tools. However, both frameworks call for external audits (also mentioned in the White House's Blueprint for an A.I. Bill of Rights, published last year), which appears to be a preferred method for governmental oversight in the A.I. space. For this reason, organizations subject to multiple international jurisdictions looking to proactively implement A.I. controls may be prudent to start with enacting independent oversight over their A.I. development activities.

In sum, while the efforts in the U.S. and around the globe are nascent, organizations would be well-advised to start preparing for future A.I. regulations.

Biden Administration Publishes the National Cybersecurity Strategy Implementation Plan

Zick Colin J. — Tue, 25 Jul 2023 11:26:04 Z

On July 13, 2023, the Biden Administration released its National Cybersecurity Strategy Implementation Plan (NCSIP) with the goal of providng transparency and coordination for its existing goals. The NCSIP details more than 65 Federal initiatives (some completed, some ongoing, others planned for the future). Each NCSIP initiative is assigned to a responsible agency and has a timeline for completion.

There are five major “pillars” to the NCSIP:

Defending Critical Infrastructure
Disrupting and Dismantling Threat Actors
Shaping Market Forces and Driving Security and Resilience
Investing in a Resilient Future
Forging International Partnerships to Pursue Shared Goals

Some NCSIP initiatives, such as the issuance of the Administration's Cybersecurity Priorities for the Fiscal Year 2025 Budget, have been completed. Other completed activities, such as the transmittal of the May 26th Department of Defense 2023 Cyber Strategy to Congress, and the June 20th creation of a new National Security Cyber Section by the Justice Department, are milestones in ongoing initiatives.

Eighteen agencies are leading initiatives in this whole-of-government plan. The Office of the National Cyber Director (ONCD) will coordinate activities under the plan, including an annual report to the President and Congress on the status of implementation, and partner with the Office of Management and Budget (OMB) to ensure funding proposals in the President's Budget Request are aligned with NCSIP initiatives.

Privacy, Cyber Security and Data Protection 101: A Primer that Addresses New York's New Mandatory CLE Requirement

Zick Colin J. — Wed, 28 Jun 2023 16:49:53 Z

On Wednesday, June 21, Foley Hoag hosted a NY CLE program “Privacy, Cyber Security and Data Protection 101: A Primer that Addresses New York's New Mandatory CLE Requirements. You can access the materials and recording using the below links.

Presentation
Webinar Recording

Cyberattacks on the Energy Sector Continue to Rise

Fri, 23 Jun 2023 13:37:23 Z

Cyberattacks on the energy sector have been rapidly growing since 2017, and we saw an all-time high of cyberattack events on the sector in 2022. The energy sector is particularly vulnerable due to these types of attacks due to the outdated and unsecured networks oftentimes used in the industry, as well as the increased use of distributed energy resources (“DER”), which creates more openings to attack and requires more resources to monitor and manage.

Wind infrastructure is no exception to the vulnerabilities of the industry. In fact, in 2022, there were three high-profile cyberattacks against wind facility operators and turbine manufacturers in Europe. In February, a wind turbine maker lost remote connection to nearly 6,000 turbines following a disruption of satellite links coinciding with the Russian invasion of Ukraine. In March, a ransomware attack was launched against another wind turbine maker, in which the hackers locked down their systems and sought a ransom. In April, a wind energy company experienced a cyberattack that caused the company to shut down their remote systems for nearly a full day.

Wind assets are typically owned by independent power producers, may change ownership multiple times throughout the asset's lifecycle, and often include a variety of components that are developed, owned, operated, and maintained by a variety of independent companies which can result in a number of different makes, models, and configurations of equipment. Because of this, wind assets are less uniform—which makes it far more difficult to implement a uniform security approach that properly accounts for all the different vulnerabilities that may exist in any given wind facility.

Foley Hoag has continued to monitor the threats faced by the energy sector, the vulnerabilities in the infrastructure, and the government's actions to respond. Our most recent blog posts on the topic can be found here.

FTC Seeks to Send a Message about COPPA and Schools

Tue, 20 Jun 2023 15:09:21 Z

In late May, the Federal Trade Commission sought an injunction in the Northern District of California against Edmodo, which has historically offered school districts a virtual classroom platform with tools for assignments, quizzes, and similar items. The FTC argues that Edmodo violated the Children's Online Privacy Protection Act by failing to obtain parental consent to certain disclosures of children's personal information.

As the FTC has long expressed in guidance, schools can and commonly do consent on behalf of parents with respect to many software and similar solutions utilized in classrooms. But that guidance has also always had important caveats, two of which animate the FTC's complaint and are important for educational technology companies to bear in mind.

First, consent made by a school or teacher must, like consent by a parent, be informed consent. The FTC alleges that Edmodo did not provide teachers sufficient information as part of the onboarding process for teachers to decipher what information Edmodo collects and why. Part of this alleged failure stemmed from the fact that the information Edmodo did provide was buried within a much longer document “about international legal agreements, intellectual property, and publishers of third-party content,” contrary to COPPA's requirement that a privacy notice to parents be specific to privacy matters. The FTC alleges also that teachers were not required to click on the document containing the information related to privacy in any event.

Second, a school or teacher may not consent on behalf of a parent to collection of information for all purposes, but rather solely for educational purposes. The FTC alleges that Edmodo utilized personal information of children for the non-educational purpose of serving advertising. This would violate the FTC's longstanding guidance that if “an operator intends to use or disclose children's personal information for its own commercial purposes […] it will need to obtain parental consent.”

Neither point breaks new ground as far as COPPA is concerned, because both have long been a part of the FTC's guidance. That said, the FTC's complaint does provide more clarity on its view of the mechanics of privacy policies and the way that teachers view them (or, as applicable, do not view them). Based on the allegations in the complaint, educational technology firms should be paying close attention to whether teachers and schools – where they are standing in the role of a parent providing consent – are required to acknowledge key terms relating to the protection of personal information of children. They should likewise audit their practices to ensure that consent made by a teacher is used for no more than the essential purpose of providing educational services, and not for additional purposes such as marketing.

Privacy and Security of Genetic Information: The FTC Is Putting Privacy and Security Promises of DNA Companies to the Test

Zick Colin J. — Tue, 20 Jun 2023 14:42:31 Z

In the FTC's first case focused on the privacy and security of genetic information, the FTC alleges that San Francisco-based Vitagene, Inc. – now known as 1Health.io – failed to live up to its promises and unfairly changed material privacy terms without customers' consent.

After consumers paid between $29 and $259, sent a saliva sample to Vitagene, and answered an online questionnaire about their health history, family history, and lifestyle, the company provided them with a personalized “Health Report.” The Health Report included the customer's full name and an assessment of their risks for developing a host of health problems.

The company's website used images of locks, keys, and secure clouds, and also contained the following privacy and data security-related statements:

“We use industry standard security practices to store your DNA sample, your test results, and any other personal data you provide.”
“Rock-solid Security. We use the latest technology and exceed industry-standard security practices to protect your privacy.”
“Vitagene collects, processes, and stores your personal information in a responsible, transparent and secure environment that fosters our customers' trust and confidence.”
“You're in control of your data. You can delete your data at any time. This will remove your information from all of our servers.”
“Three of the ways we protect your privacy:
1. Your results and DNA sample are stored without your name or any other common identifying information.
2. Vitagene destroys your physical DNA saliva sample after it has been analyzed.
3. We don’t share your information with any third party without your explicit consent.”

The FTC's complaint alleged that Vitagene used a well-known cloud service provider for storing confidential information, including consumers' health reports and DNA data. Vitagene allegedly did not use built-in measures to secure the information and instead stored it in “buckets” that allegedly made it possible for anyone with internet access to see the detailed reports of Vitagene customers. The FTC also alleged that the raw genetic data of at least 227 other customers was not secure. While Vitagene promised to “exceed industry-standard security practices,” the FTC says the company did not encrypt that data, restrict access to it, monitor access, or inventory it to help ensure its security. The complaint also alleged that Vitagene did not take steps to ensure that a lab that analyzed many of the DNA samples had a policy in place to destroy them.

The complaint also alleged that over a two-year period, Vitagene received three separate warnings that it was storing customers' health and genetic information in a way that made it publicly accessible.

Of particular note is the FTC's claim that, in 2020, the company changed its privacy policy by retroactively expanding the types of third parties with which it may share consumers' data to include grocery chains, dietary supplement manufacturers, and the like. And it did that without notifying customers who provided their data under the former, more restrictive privacy policy and getting their consent.

To settle the case, 1health.io has agreed to implement a comprehensive information security program, including every-other-year third-party assessments. In addition, a senior company executive must certify annually that the company is complying with the terms of the settlement. The proposed settlement also includes a $75,000 financial remedy.

* * *

What lessons can other companies take away from this FTC action?

Sensitive health information – including genetic data – requires special care. Take particular care to substantiate the promises you make about your data practices. (If you have not read the FTC's May 2023 Policy Statement on Biometric Information, you should now.)

Just because data is in your possession does not mean it's yours to use as you wish. Consumers have a right to know in advance how you intend to use their information and you have the legal obligation to live up to your representations. The FTC's position is that you need consumers' affirmative express consent for any new uses of their data.

When it comes to security, keeping your data in the cloud does not absolve you of responsibility for privacy and security. The FTC has long said that storing data in the cloud does not give a company a free pass on security. sAs the FTC's Request for Information about cloud computing makes clear, sellers of cloud technology and the companies that use their services share the responsibility to secure consumers' personal information.

Respond to credible warnings about potential security lapses. The complaint against Vitagene alleges multiple instances in which the company failed to heed warnings others – including the provider of its cloud storage – had given about the security of its cloud-based information. Do you have systems in place to make sure those alerts get to the right people and get the immediate attention they deserve?

If Your Password Is On This List, Its Time to Change It

Zick Colin J. — Fri, 16 Jun 2023 14:54:55 Z

It’s been several years since I have written about password hygeine. I have been hoping that a better security solution would be widely adopted and while I hear rumors in that regard, passwords still reign supreme. So when I saw that the SafetyDetectives website had listed the 30 most common passwords, it seemed like a good time to revisit the topic. Their study found that “123456” and “password” still lead the list of most common passwords. Sigh.

If you find yourself on that list, do not dispair. The good people at the FTC have provided some common sense, free guidance when it comes to passwords:

Make sure your password is long and strong.
- That means at least 12 characters. Making a password longer is generally the easiest way to make it stronger.
- Consider using a passphrase of random words so that your password is more memorable, but avoid using common words or phrases.
- If the service you are using does not allow long passwords, you can make your password stronger by mixing uppercase and lowercase letters, numbers, and symbols.
Don't reuse passwords you've used on other accounts.
- Use different passwords for different accounts. That way, if a hacker gets your password for one account, they can't use it to get into your other accounts.
Use multi-factor authentication when it's an option.
Consider using a password manager. This lets you use more complex passwords and share them in a trusted circle.
Pick security questions only you know the answer to.
- If a site asks you to answer security questions, avoid providing answers that are available in public records or easily found online, like your zip code, birthplace, or your mother's maiden name.
- And don't use questions with a limited number of responses that attackers can easily guess — like the color of your first car.
- You can even use nonsense answers to make guessing more difficult — but if you do, make sure you can remember what you use.
Change passwords quickly if there's a reported breach.

Like everything else, passwords have an AI angle. ChatGPT probably can’t guess your passwords, but other AI applications can, especially if the passwords are short and commonly used. So take advantage of the long Juneteenth weekend and raise your password game.

MA Sports Wagering Regulators Take Aim at Data Privacy

Fri, 09 Jun 2023 11:33:24 Z

Following the March 2023 rollout of mobile sports wagering in Massachusetts, the Massachusetts Gaming Commission has been hard at work promulgating the various regulations needed to oversee Massachusetts' burgeoning sports wagering industry, which includes both brick-and-mortar locations as well as mobile apps. The quick pace of regulatory implementation following the sports wagering statute's passage last August has found the Commission wanting to promulgate some more complex regulations after having had time to further consider them – among these are the currently-proposed regulations (page 14) on data privacy, which will complement the Commission's existing regulations on sports wagering account management that likewise include some privacy provisions.

The regulations are interesting from a sports wagering perspective due to the significant scope of restrictions they propose, as discussed further below. But they are also interesting from a more general privacy perspective because they impose on the sports wagering industry many of the types of restrictions that other states, particularly those following California's lead, impose through more generally applicable privacy laws.

At a high level, the regulations contain five basic provisions:

By default, sports wagering firms would not be permitted to use and retain the confidential and personal information of customers for purposes beyond operating their wagering platform and complying with the law. Uses beyond that would require customer consent, which the regulations would require be specific and explicit (i.e., generally having a customer agree to a privacy policy that discusses sharing or sale of information would be inadequate).
Where sports wagering firms share customer info with service providers, they would be required to conclude “a written agreement” with the service provider that binds the provider to protecting that information, including through comprehensive written policies.
Customers would have substantial data rights with respect to sports wagering firms, including requesting information on what confidential or personal information has been shared and requests to restrict the use of confidential or personal information.
Sports wagering firms will need to develop, implement, and maintain comprehensive administrative, technical, and physical data privacy and security safeguards. Although MA regulations already require firms holding certain personal info on MA residents to have written information security policies, the Commission's regulations are considerably more stringent and require actions more akin to the administrative, technical, and physical safeguards required of healthcare providers and their business associates under Federal law.
Sports wagering firms will need to report data breaches to the Commission. This obligation will be in addition to existing MA law on data breach reporting.

The Commission discussed and approved the regulations at its June 1, 2023 open meeting, and authorized its staff to begin the formal promulgation process. Although the regulations are not yet listed on proposed rulemaking section of the Commission's website, it is likely that the Commission will continue to accept feedback on the regulations in the normal course of regulatory promulgation.

CISA and Partners Update the #StopRansomware Guide, Developed through the Joint Ransomware Task Force

Zick Colin J. — Wed, 24 May 2023 19:59:27 Z

On May 23, 2023, CISA, the Federal Bureau of Investigation (FBI), the National Security Agency (NSA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) published an updated version of the #StopRansomware Guide, as ransomware actors have accelerated their tactics and techniques since its initial release in 2020. The update incorporates lessons learned from the past two years and includes additional recommended actions, resources, and tools to maximize its relevancy and effectiveness and to further help reduce the prevalence and impacts of ransomware.

Since the initial release of the Ransomware Guide in September 2020, ransomware actors have accelerated their tactics and techniques. To maintain relevancy, add perspective, and maximize the effectiveness of the guide, the following changes have been made:

• Added recommendations for preventing common initial infection vectors, including compromised credentials and advanced forms of social engineering.
• Updated recommendations to address cloud backups and zero trust architecture.
• Expanded the ransomware response checklist with threat hunting tips for detection and analysis.
• Mapped recommendations to CISA's Cross-Sector Cybersecurity Performance Goals (CPGs).

The #StopRansomware Guide is designed to serve as a one-stop resource to help organizations reduce the risk of ransomware incidents through best practices to detect, prevent, respond, and recover, including step-by-step approaches to address potential attacks. The authoring organizations recommend that entities review this joint guide to prepare and protect their facilities, personnel, and customers from the impacts of ransomware and data exfiltration. For more information and to access the latest resources about how to stop ransomware, you can visit stopransomware.gov.

Anonymization and the GDPR Clarity from the European Courts? Not so Fast!

Christopher Escobedo Hart — Thu, 18 May 2023 16:52:41 Z

As we’ve written about before, the question of anonymization can be tricky. When is something “anonymized” or merely “de-identified” or “pseudonymous” — and when does it matter? This is a particularly fraught issue under the GDPR, where the text of the regulation creates practical compliance complications under various scenarios.

But in an important recent decision, the European General Court (or EGC, which hears actions against EU institutions, and where actions are appealable to the Court of Justice), the EGC apparently clarified that in certain important instances, data that we might think of as “de-identified” (or “pseudonymized,” in GDPR-speak) can be considered anonymous. This matters, because while the GDPR regulates pseudonymized data, it does not govern anonymous data.

In very brief summary and relevant to this post, the case — Single Resolution Board v. European Data Protection Supervisor, or SRB v. EDPS — SRB created a survey of shareholders. The survey respondent names were replaced with an alphanumeric code, and data (codes along with survey responses) was provided to a consulting firm for analysis.

One of the questions before the EGC was whether the information provided to the consulting firm was anonymized. The EGC responded that, because the consulting firm was provided de-identified information, it was not provided the “key” to that information (that is, the names linked to the codes). Because it had no way to access the uncoded information, the consulting firm could not re-identify the information as both a legal and practical matter. Accordingly, the information was not “pseudonymous,” it met the requirements for being anonymous (that is, it did not relate to an identified or identifiable person).

Per the decision, “in order to determine whether the information transmitted” to the third party “constituted personal data, it is necessary to put oneself” in the position of the third party “in order to determine whether the information transmitted to it relates to ‘identifiable persons.'” Here, in the absence of legal and practical means to access the information, the third party only had survey results with codes; as such, the did not relate to identifiable persons.

As a practical matter, this decision is not only sensible, but is also a huge sigh of relief to organizations that receive tokenized or de-identified information as a matter of course, but do not otherwise receive the “key” to unlocking that information. Thus a clinical trial sponsor running a trial from the U.S., but receiving coded information from a patient site in the EU, would not under this decision be forced to consider GDPR compliance because the information it is receiving is anonymized.

As a matter of plain text, however, the decision might not stand. The Court of Justice could take the case on appeal; if it does, it is likely to closely scrutinize the legal question. The EGC may not be the final word here, and the GDPR’s text and recitals — as well as the CJEU’s past interpretations of the GDPR and surrounding legal authorities — suggest that a reversal should not be discounted.

Expiration of COVID-19 Public Health Emergency Means the Beginning of the End for HIPAA Privacy and Security Enforcement Discretion

Zick Colin J. — Mon, 15 May 2023 09:37:09 Z

The Notifications of Enforcement Discretion issued under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act during the COVID-19 public health emergency expired at 11:59 pm on May 11, 2023, due to the expiration of the COVID-19 public health emergency.

As previously announced, the HHS Office for Civil Rights (“OCR”) is providing a 90-calendar day transition period for covered health care providers to come into compliance with the HIPAA Rules with respect to the provision of telehealth in particular. The transition period will be in effect beginning on May 12, 2023, and will expire at 11:59 p.m. on August 9, 2023. OCR will continue to exercise its enforcement discretion and will not impose penalties on covered health care providers for noncompliance with the HIPAA Rules that occurs in connection with the good faith provision of telehealth during the 90-calendar day transition period. Other HIPAA enforcement activity by OCR that was relaxed during the PHE will also return to normal.

As If Bank Failures Arent Enough Hackers Are Exploiting the Chaos to Breach Security

Zick Colin J. — Mon, 08 May 2023 13:47:37 Z

The Massachusetts State Police Commonwealth Fusion Center (CFC) believes that cyber actors may use the current bank failures for future phishing and business email compromise (BEC) attacks. Cyber actors often use current events to mask their phishing campaigns to seem more believable and relevant. As everyone now knows, Silicon Valley Bank (SVB) became one of the largest banks to fail since the 2008 financial crisis. More recently, First Republic Bank also failed. Due to the widespread attention these stories are receiving, cyber security professionals believe this will lead to phishing and BEC attacks utilizing an SVB and/or First Republic Bank lures. These lures could include legal services, loans, financial aid, bank information, potential lawsuits, account access, new bank ownership information, or anything related to bank failure.

Spear Phishing – Spear-phishing attacks are designed to target a specific person or organization. Spear phishing is primarily done through email but can also occur through text or phone call. Cyber actors can tailor their phishing campaign directly to SVB or First Republic Bank customers. These bad actors could try to manipulate customers of the failed or threatened banks by claiming they can provide them special deals, financial aid, banking assistance, account reset, or any other enticing offer. This could lead to victims providing sensitive information (bank account, SSN, routing number, etc.) or downloading malicious files to their network.

Businesses Email Compromise (BEC) – BEC targets organizations that conduct wire transfers. BEC attackers tend to target specific people within an organization based upon their influence and/or job capabilities (HR representatives, finance personnel, executives, etc.). BEC attackers rely heavily on social engineering to trick employees and high-ranking officials to unknowingly assist with their malicious goals (e.g., authorizing financial transactions, releasing sensitive information, granting privileges to databases, changing routing instructions, etc.). Instead of targeting individual SVB and First Republic Bank customers, bad actors could target companies and businesses that utilize those banking institutions.

Vendor Email Compromise (VEC) is a specialized form of a BEC attack that involves scammers impersonating a company's vendor. VEC is an attack that uses stolen information from one organization to defraud another business or individual, typically by impersonating a vendor and requesting a change to banking information. Bad actors could use the banking failures to deceptively notify companies that their vendor is changing financial institutions, routing numbers, or how they conduct financial transactions. This could lead to companies mistakenly sending payments directly to malicious cyber actors.

Typo-Squatting – Typo-Squatting is when malicious actors create fraudulent websites that are designed to look similar to legitimate domains. These websites usually have similar addresses or miniscule typos that unsuspecting victims may overlook. Within days of the initial SVB Bank news, there was a dramatic increase in domain names registered that include “SVB.” These newly registered domains could be used to trick unsuspecting victims into providing sensitive information or potentially downloading malicious files. Since similar in name, these potentially fraudulent websites could be accidentally accessed by people searching for the authentic SVB and First Republic Bank websites:

login-svb.com
svbbailout.com
svbcertificates.com
svbclaim.com
svbcollapse.com
svbdeposits.com
svbhelp.com
svblawsuit.com

Source: “SANS Internet Storm Center,” Accessed 16 March 2023

For strategies to utilize to avoid these type of attacked, check out our webinar on BEC by Chris Hart and Yoni Bard.

State Data Privacy Law Development Proceeds Apace

Hoff Samuel R. — Wed, 03 May 2023 15:32:06 Z

2023 is turning out to be the year of the state privacy law, including new laws in five states with the possibility of more to come. Indeed, in recent days both Indiana and Iowa have likewise passed new statutes, which we will detail in a forthcoming blog. These new laws, which are largely inspired by the California Consumer Privacy Act (“CCPA”) and the European Union's General Data Protection Regulation (“GDPR”), include:

The California Privacy Rights Act (“CPRA”) which is already in effect as of January 1, 2023, with civil and administrative enforcement to begin on July 1, 2023 (the CPRA is a voter-approved ballot-initiative that amends the CCPA).
The Virginia Consumer Data Protection Act (“Virginia Act”), which is already in effect as of January 1, 2023.
The Colorado Privacy Act (“Colorado Act”), which will become effective on July 1, 2023.
The Connecticut Act Concerning Personal Data Privacy and Online Monitoring (“Connecticut Act”), which will become effective on July 1, 2013.
The Utah Consumer Privacy Act (“Utah Act”), which will become effective on December 31, 2023.

These laws generally grant consumers an array of rights related to their personal information. They also impose affirmative obligations on businesses in connection with data collection and use, notice to consumers, and the processing of consumer requests. Businesses that are already compliant with the CCPA or GDPR may be in position to use their existing compliance programs as a framework for meeting these obligations. However, even robust compliance programs will likely require key changes to meet updated standards for website privacy policies, collection notices, consumer request forms, third-party vendor contract language, and other procedures. This high-level overview provides considerations for businesses with respect to each law, as well as action items that can be taken to prepare for and achieve compliance.

What consumers and businesses are covered?

Under the new laws, a “consumer” is typically defined as a resident of a particular state. Each law except for the CPRA further clarifies that a resident is only a consumer when acting in an individual or household capacity, as opposed to a commercial or employment capacity. By contrast, the CPRA broadly applies the definition of “consumer” to employees and job applicants of a covered business, as well as other businesses that share their data with a covered business.

Whether an entity will be deemed a covered business or “data controller” under one of the laws generally depends on the number of consumers from whom the entity has collected personal information and the percentage of revenue that the entity derives from selling or sharing personal information. One difference between the laws is that the Virginia Act, Colorado Act, and Connecticut Act each apply to for-profit entities and certain non-profit entities, whereas the CPRA and the Utah Act only apply to for-profit entities. The CPRA and the Utah Act also include a revenue threshold of $25 million, although each state utilizes this threshold differently. In California, a business with $25 million in gross revenue usually must comply with the CPRA even if it does not meet the remaining criteria related to consumer numbers and revenue percentages. In Utah, a business is not subject to the Utah Act unless it has an annual revenue of at least $25 million, regardless of the remaining criteria. The applicability and scope of the Utah Act is thus limited compared to that of the other laws.

The following table presents a breakdown of the criteria to be a covered business or “data controller” in each state.

What personal information is protected?

The new laws intend to protect personal information, which the Virginia Act, Colorado Act, Connecticut Act, and Utah Act define as “information that is linked or reasonably linkable to an identified or identifiable natural person” (the CPRA uses a similar but slightly differently worded definition that carries over from the CCPA). Notably, each law creates a unique category of personal information referred to as “Sensitive Personal Information” or “Sensitive Data” (collectively, “SPI”). The definition of SPI varies by state, but typically includes racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship status, genetic or biometric data processed for identification purposes, and precise geolocation data. In California, the scope of SPI is broadened under the CPRA to also include personal and financial information about a consumer such as a social security number, driver's license number, passport number, or a financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials which allows access to the account.

What rights do consumers have?

Under each of the new laws, consumers will generally have a right to know what personal information a covered business has collected about them; a right to obtain such information in a portable data format; a right to delete such information in the business's possession; and a right to opt-out of the business's sale of such information (in California, each of these rights already existed under the CCPA). Each law except the Utah Act also provides consumers with a right to correct inaccurate personal information in a business's possession. Under the CPRA, consumers also have a right to opt-out of a business's “sharing” of personal information for cross-context behavioral advertising, an activity which is defined independently of the “sale” of personal information.

With respect to SPI, the Virginia Act, Colorado Act, and Connecticut Act require that a covered business must obtain the consent of a consumer before it may process any of the consumer's SPI. The CPRA does not require consent, but consumers have the right to limit the use and disclosure of their SPI to business functions like the provision of a business's regular services, communication with the consumer, processing of payments, safety issues, and fraud and incident prevention. The Utah Act does not provide a right to limit the use and disclosure of SPI, but it does require that a business must provide consumers with notice of the business's intent to process SPI, and then allow consumers the opportunity to opt-out of processing at any time.

Since the implementing regulations of some laws have not been finalized yet, the list of consumer rights described above could potentially expand by the time that the remaining laws go into effect. It is worth noting that the rights granted under these laws are not absolute, but are subject to limitations on a state-by-state basis. For example, the CPRA allows a business to decline to comply with a consumer's request to access, delete, or correct information on the basis that doing so would require a “disproportionate effort” on the part of the business. Similarly, under certain circumstances, a business that receives a request to correct in California may instead simply delete the allegedly inaccurate information. A businesses that is subject to the CPRA also has discretion as to whether to offer an appeals process to consumers in the event of a denied request. On the other hand, the Virginia Act, Colorado Act, and Connecticut Act each require businesses to offer an appeal process.

What other affirmative obligations might businesses have?

In addition to processing consumer requests, covered businesses are also required to meet several affirmative obligations and standards under each new law. Businesses usually must act with transparency in collecting and processing personal information. Depending on the state, they may be required to provide consumers with a notice at the time and place (e.g., online, over the phone, or in person) where personal information is collected, or make request forms available online. They typically are prohibited against discriminating or retaliating against any consumer who exercises any rights under the law, for example, by providing a level of services that is less than what the consumer would have received had the consumer not made a request. They also generally must adopt data information technology security measures for personal information which are reasonable based on the industry and for each type of personal information collected. Each law except the Utah Act further requires some level of risk assessments and cybersecurity audits for certain threats and activities on a periodic basis.

Each law also establishes contractual requirements where a business engages a service provider to process or use personal information to render services on behalf of the business. These contractual requirements also differ based on the state, but they are somewhat similar to those which HIPAA imposes with respect to Business Associate Agreements regarding the exchange of Protected Health Information. For example, in California, the business must enter a written agreement with the service provider which states (among other things) that the service provider will adhere to security measures that are at least as stringent as those of the business, will only use personal information for the purposes expressly set forth in the agreement, and cooperate with the business in responding to consumer requests.

Who enforces the laws and what are the penalties?

Enforcement is one area in which the five states have adopted differing approaches. Under the Virginia Act, Connecticut Act, and Utah Act, the state Attorney General will have exclusive authority to enforce the law. In Colorado, however, the Attorney General and District Attorneys will each have enforcement authority. In California, the CPRA has established a new state agency called the California Privacy Protection Agency for enforcement purposes, and the Attorney General may prosecute violations in certain circumstances as well. The existence and length of a cure period following notice of a violation also varies between the states. Businesses that violate a law or fail to resolve an issue prior to the expiration of a cure period (where applicable) may be subject to fines as follows:

CPRA – $2,500 to $7,500 per violation.
Virginia Act – Up to $7,500 per violation.
Colorado Act – Up to $20,000 per violation.
Connecticut Act – Up to $5,000 per violation.
Utah Act – Up to $7,500 per violation.

In addition to enforcement by state agencies and departments, the CPRA is the only law which grants a limited right of private action to consumers. This right can be exercised in certain circumstances, such as where a consumer's non-encrypted and non-redacted personal information is stolen or improperly accessed due to the business's failure to implement appropriate security measures. The CPRA allows a plaintiff(s) who succeed in bringing such an action to obtain $100 to $750 per plaintiff, per violation, or actual damages (whichever is greater).

How do I get my business prepared?

The following is a list of initial steps that businesses can take to prepare for compliance with the CPRA, Virginia Act, Colorado Act, Connecticut Act, and Utah Act, or any additional laws in the coming years. State legislatures in New York, Kentucky, Tennessee, and Oklahoma have introduced their own comprehensive state data privacy bills in the early weeks of 2023. If these bills become law, they will likely share similarities with the five laws described above.

Assess coverage and gaps in existing compliance programs. Businesses should determine whether they are covered by one of more of the new laws based on the criteria set forth above. Notably, a business that does not meet the criteria for coverage in a certain state could still be subject to that state's law if it receives personal information as a service provider to a covered business. Once a determination is made as to which laws apply, a deeper review should be performed to assess where the business's existing compliance program must be updated.
Review whether specific data collection or activities trigger heightened requirements. Businesses that sell or share personal information may be subject to additional affirmative obligations beyond those applicable to businesses that only use personal information for their own internal purposes. Depending on the state, businesses that collect SPI from consumers may also be required to obtain additional consumer consents or comply with a wider array of consumer requests and opt-outs.
Implement audit and assessment plans and procedures. As required by each applicable law, businesses should ensure that they have implemented sufficient procedures to routinely audit and assess data protection standards and technology, and employee compliance with purpose limitations, data minimization, privacy-by-design, and other policies. Businesses should consider whether third-party audits or certifications would be appropriate based on industry standards and the nature of the personal information collected.
Update Privacy Policies and Collection Notices. Businesses should review and update their website privacy policies as necessary to ensure that they meet the requirements of each applicable law. Businesses may consider adding specific sections to their privacy policies to address each applicable law. Depending on the state, businesses may also need to develop a notice to provide consumers at the time that personal information is collected. In California, where the CPRA covers employee and B2B personal information, businesses should determine whether and how this notice will be required on job applications and other HR documents or business contracts.
Review Consumer Request Forms and Procedures. The personal information request forms that businesses make available to consumers should be reviewed and updated to ensure that they cover any new rights granted under these laws. Businesses may also need to update their information technology capabilities to detect opt-out preference signals which consumers send through their personal web browsers, indicating that a business may not collect their personal information or use it in a particular way. Additionally, businesses should consider implementing internal policies which govern the procedure for employees to follow in responding to consumer requests.
Implement a Third-Party Data Management Program. Businesses that provide personal information to service providers or other third-parties for any purpose should determine whether the arrangement necessitates a written agreement pursuant to any of these laws. It may be useful for businesses that depend upon multiple downstream service providers or third-parties to develop a template agreement that can be modified depending on the specific language that a certain state requires.

Prepare or Update Internal Data Privacy and Security Policies and Training. Businesses should review and update their internal policies relating to data privacy and security policies, including a written information security policy, incident response plan, record-keeping and document retention policy, cookie management policy, acceptable use policy, and/or remote access policy. As applicable, these policies should include training requirements for employees with specific responsibilities related to personal information collection, use, processing, maintenance, or protection. Training materials should be prepared and a training schedule should be developed. Businesses should consider appointing a Compliance Officer or Data Security Manager to oversee the implementation of these policies and any training.

Conclusion

As this overview provides a non-exhaustive list of the specific consumer rights that are available and the affirmative obligations that are required under each new law, businesses should confer with their legal counsel regarding a plan for achieving compliance. Foley Hoag's Privacy & Data Security Practice Group will continue to monitor developments that affect the rollout of the above data privacy laws. Our team of experienced attorneys is ready to assist clients in navigating compliance questions and challenges related to the collection, use, and maintenance of consumers' personal information.

FTC Likely to Continue Focus on Health Care Data

Wed, 03 May 2023 14:49:52 Z

In recent years, the FTC has increasingly focused on protecting consumers' access to healthcare, through both its competition and its consumer protection missions. Similarly, the FTC has become a force in federal privacy regulation, second only to the Office for Civil Rights of the Department of Health and Human Services. On occasion, the FTC's priorities in access to health care and health information privacy have come together, such as in settlements with health care companies regarding false or deceptive statements about the treatment of health data.

Since 2022, the FTC has signaled a significant increase in its focus on health privacy in general, especially related to personal health information, and rolled out significant new guidance that expanded the FTC's authority and sets the stage for ramped up enforcement this year.

In January 2022, the FTC released two new publications regarding the Health Breach Notification Rule (HBNR) to help businesses determine whether the HBNR applies to them and to determine the steps that must be taken if a data breach occurs. In the publications, the FTC laid out an expansive approach to the definition of a data breach, expanding beyond just cybersecurity incidents to also include situations where an app developer discloses an individual’s health information without the individual’s consent.

In May 2022, the FTC published a blog post asserting that regardless of whether an entity is covered by the HBNR, Section 5 of the FTC Act “creates a de facto breach disclosure requirement” for companies to notify individuals of breaches of their personal data—even where there is no other specific breach notification requirement under a state or federal law. The post explained that failure to provide breach notifications may “increase the likelihood that affected parties will suffer harm” and that breach notifications are “essential to enabling consumers and other affected parties to take actions to mitigate harm resulting from the breach.” As a result, failing to disclose a data breach involving personal information may violate Section 5 of the FTC Act.

As the year continued, the FTC continued to release new guidance expanding the scope of what it views as unfair data breaches. In July, the FTC published another blog post warning that companies efforts “to placate consumers' privacy concerns by claiming they anonymize or aggregate data” are often deceptive and companies that “make false claims about anonymization can expect to hear from the FTC.” Drawing on its Section 5 authority and its expansive definition of a “data breach,” again, the FTC takes the position that disclosing an individual’s health information without the individual’s consent (or through an inaccurate description of the disclosure) has the potential to cause consumer harm and will be considered by the FTC to be a violation of Section 5.

Perhaps in recognition that punishing companies for data breaches and inappropriate disclosures can go only so far to protect consumers, the FTC released in August an Advanced Notice of Proposed Rulemaking (ANPR) on its intent to limit or even prohibit commercial surveillance – the common corporate practice of collecting, analyzing, and monetizing consumers' data. In response, 33 states, including Massachusetts, New York, and Texas, submitted a comment letter supporting the proposed rule. Among several other areas of concern, the letter heightened concerns regarding the collection of consumer medical data by applications, wearables, and devices, regardless of whether the Health Insurance Portability and Accountability Act of 1996 (HIPAA) applies. Ultimately, the extended deadline for comments to the FTC's rulemaking proposal closed at the end of November and the FTC received more than 11,000 comments on the proposed rule. The proposed rule still has a way to go before it goes into effect, but the FTC clearly wants to send a message that businesses that are reckless about the collection of data will be held liable even if a data breach has not yet occurred.

Lurking in the background is the possibility (albeit unlikely) that Congress might pass the American Data Protection and Privacy Act (ADPPA) in 2023, which would be a game-changer for the FTC's privacy authority. The 2022 draft of the ADPPA granted the FTC expanded rulemaking authority and expressly named the agency as the law's primary privacy and cybersecurity enforcer. The ADPPA is currently being debated before the House Committee on Energy and Commerce.

The FTC has made it very clear that it does not intend to wait for Congressional approval to establish its privacy and cybersecurity authority. The FTC is likely to continue to issue additional guidance regarding unfair privacy practices that it seeks to curb or curtail, including further progress on the ANPR on commercial surveillance, but companies should expect that the FTC will also be seek to turn the guidance they issued last year into legal precedent. While the FTC has not brought any enforcement actions under the HBNR since it was issued in 2012, the FTC will not hesitate to bring that first case. Similarly, the FTC will undoubtedly be looking for a posterchild for the “de facto breach disclosure requirement” pursuant to its Section 5 unfairness authority. And in the current environment, if the FTC finds a company making false claims about anonymization of sensitive health information, the FTC will look to crack down and send a broader message to industry.

Physical and Cyber-Attacks on Energy Infrastructure Expected to Continue

Wed, 03 May 2023 14:44:42 Z

Over the past several years, the energy sector has become a prime target for hacking and ransomware attacks, with over 40 attacks on the industry since 2017. Cyber attacks have only continued to rise, with a record high of 13 reported attacks in one year occurring in 2022.

Physical Security Threats to U.S. Energy Infrastructure

A new type of threat against the energy sector crystallized at the end of 2022: physical attacks on the grid. On December 3, two substations in Moore County, North Carolina were attacked and tens of thousands of customers were left without power. Several weeks later, a similar event occurred in Tacoma, Washington, with three substations deliberately targeted and damaged, causing more than 14,000 outages. These were far from the only attempts to physically attack the grid in 2022, although these were the most impactful—for instance, several other substations in the Washington and Oregon area were attacked with less impact on the grid, and as early as February 2022, three men pleaded guilty for conspiring to provide material support to attacks on power grids.

The Department of Homeland Security (“DHS”) has been warning of the possibility of these types of attacks for some time. In January 2022, news outlets reported that DHS issued a bulletin warning that domestic violent extremists have “developed credible, specific plans to attack electricity infrastructure since at least 2020, identifying the electric grid as a particularly attractive target given its interdependency with other infrastructure sectors.” Among various possible plans, DHS noted the existence of a 14-page guide on executing low-tech attacks, including attacks on the power grid using guns, was released in 2020 and circulated on a variety of extremist communication outlets.

On November 30, 2022, just days before the North Carolina attack, DHS released an additional bulletin that warned of the threat of extremist attacks on a variety of targets, including U.S. critical infrastructure.

DHS is not the only agency that has acted in the wake of these attacks. On December 15, the Federal Energy Regulatory Commission (“FERC”) ordered the North American Electric Reliability Corporation (“NERC”) to consider increasing physical security standards, including requiring physical risk assessments at more transmission stations, substations, and associated control centers.

Throughout 2023 we expect to continue to see agencies introducing new regulations and guidance to prepare for and respond to these threats, and the industry will need to act to protect its assets from targeted physical attacks.

Cyber Security Threats to U.S. Energy Infrastructure

Cyberattacks on the energy sector were at an all-time high in 2022, and while the federal government has spent the past month scrambling to respond to the physical threats to energy infrastructure that dominated the news cycle in the final months of 2022, it spent the majority of 2022 focused on bulking up cybersecurity protections for the energy sector, including:

DOE raised the alarm on cybersecurity vulnerabilities in distributed energy resources (“DER”), with DOE releasing a report in October identifying that, while an attack on DERs may be negligible today, as the capacity of DERs is growing substantially, such an attack could have significant impacts in just three years.
NERC also noted these concerns in its Distributed Energy Resource Strategy released in November, flagging the lack of security requirements in resources such as rooftop solar systems.
FERC has continued to focus on increasing utilities' investments in cybersecurity. In September, it proposed new incentives for utilities to make voluntary investments in cybersecurity, including an extra 2% return on equity on expenditures. However, FERC is also continuing to consider whether mandatory standards will be needed to address these concerns.
DOE announced in August that it will direct $45 million to support “next-generation” cybersecurity research, development, and demonstrating projects to reduce cyber risks for energy delivery infrastructure.
DOE also unveiled in June its National Cyber-Informed Engineering Strategy: a plan to strengthen the energy sector's ability to respond to cyber threats, including increased cyber resilience in design, implementation, operation, and maintenance of energy infrastructure.

Based on these actions, we anticipate continued focus on the development of DERs in a manner to ensure robust security as this capacity grows. Agencies are also increasing the amount of funds available to the industry for beefing up their cybersecurity. With the increasing vulnerabilities in both cyber and physical security in the energy sector, we imagine agencies will be eager to find more ways encourage (or, as FERC is considering, require) industry actors to improve their cybersecurity technology.

Similarly, the National Security Agency (“NSA”) has also raised concerns that Russia may launch cyber attacks on the global energy sector as a tactic in the ongoing war, with the Cyber Director indicating that Russia has already been instigating attacks on countries neighboring Ukraine, such as Poland. As the war in Ukraine shows no signs of winding down, this issue too is likely to continue to require vigilance.

Fintech Companies Prepare for Forthcoming Updates to the NY Cybersecurity Regulation

Kalman Ben — Wed, 19 Apr 2023 10:11:37 Z

Proposed Amendments to 23 NYCRR Part 500

If you are the chief information security officer (“CISO”) of a fintech company operating in New York, you may already be aware that, on November 9, 2022, the New York State Department of Financial Services (“DFS”) proposed a second amendment to 23 NYCRR Part 500 (the “DFS Cybersecurity Regulation”). While many of the requirements included in the original 2017 DFS Cybersecurity Regulation remain, the proposed amendments impose heightened requirements for companies covered by the regulation.

Here are some important takeaways on the proposed amendments for fintech companies (and tech companies generally):

Covered Entities. The definition of “covered entity” remains largely the same under the proposed amendments. A fintech company will be considered a “covered entity” for purposes of 23 NYCRR Part 500 if it is subject to licensing, registration, or other requirements under New York State's Banking Law, Insurance Law, or Financial Services Law. While a comprehensive review of such requirements is outside the scope of this blog post, note that all companies (with some enumerated exceptions) engaged in the “business of selling or issuing checks” and the “business of receiving money for transmission or transmitting the same” (READ: money transmitters) must be licensed pursuant to § 641(1) of the Banking Law, and thus may be considered a “covered entity” for purposes of the DFS Cybersecurity Regulation.
Class A Companies. The proposed amendments introduce a new class of regulated entity: “Class A companies”. Class A companies are defined as covered entities with at least $20 million in gross annual revenue (across all affiliate entities) in New York State in each of the last two fiscal years, and either (1) 2,000 employees (across all affiliate entities, regardless of location), or (2) over $1 billion in gross annual revenue (again, across all affiliate entities) in each of the last two fiscal years. If adopted in its current form, the proposed amendments will add the following heightened requirements for Class A companies (among others):
- Conducting an independent audit of the company's cybersecurity programs at least annually;
- Implementing an automated method of blocking commonly used passwords for all user accounts;
- Engaging external experts to conduct risk assessments at least once every three years;
- Implementing an endpoint detection and response solution to monitor anomalous activity, along with a solution that centralizes logging and security event alerting.

What Can You Do?

For all covered entities (including the newly-defined “Class A companies”), compliance with the proposed amendments will require a comprehensive review (and potential overhaul) of existing cybersecurity policies. However, in preparing for the proposed amendments to take effect (which could occur at any time in 2023), below are some preliminary steps to take and important timelines to keep in mind:

Effective Immediately
- Annual Certification. A number of provisions will take immediate effect following the effective date of the proposed second amendment (“Effective Date”). One such provision requires that covered entities prepare and submit to DFS a “certification of compliance” either (i) confirming that the covered entity complied with the regulation, or (ii) acknowledging that the entity did not comply, identifying areas of noncompliance, identifying all areas, systems and processes requiring material improvement, and providing plans for remediation. This certification must be signed by the covered entity's “highest-ranking executive” and its CISO (or the senior officer responsible for the covered entity's cybersecurity program in absence of a CISO).

Thirty Days
- Within thirty days of the Effective Date, covered entities will need to ensure that cybersecurity policies reflect the following:
  - Ransomware. In the event that a ransom payment is made in response to a ransomware attack, covered entities will need to:
    - 1) Notify DFS within 24 hours of the payment; and
    - 2) Provide DFS within 30 days of the payment with a written statement explaining why payment was made (in addition to other points).
  - Notice of Cybersecurity Attack. The proposed amendments retain the requirement to notify DFS within 72 hours of a cybersecurity event; however, the proposed amendments expand the list of types of cybersecurity events subject to this notice requirement and add in that covered entities must further:
    - Provide any information “regarding the investigation of the cybersecurity event” requested by DFS within 90 days of a cybersecurity event; and
    - Notify DFS within 72 hours of a cybersecurity event at a third party service provider.

One Year
- Backups. Within one year of the Effective Date, covered entities will need to maintain backups that are adequately protected from unauthorized alterations or destructions.

Eighteen Months
- Within eighteen months of the Effective Date, covered entities' cybersecurity policies will need to include the following policies and procedures:
  - Scans. Moving forward, covered entities will need to conduct annual automated scans of information systems (and manually review systems not covered by automated scans) to analyze and report on vulnerabilities.
  - Password Policy. Covered entities will need to implement written password protection policies that meet “industry standards”. As noted above, Class A companies will have additional and heightened requirements.
  - Multi-Factor Authentication (“MFA”). Covered entities will need to use MFA for (1) remote access to information systems, (2) remote access to third-party applications (including cloud-based applications), and (3) all privileged accounts.
  - Malicious Code Protection. Covered entities will need to implement controls that protect against malicious code (including monitoring and filtering web traffic and emails).

Two Years
- Asset Inventory. Within two years of the Effective Date, covered entities must implement written policies and procedures designed to “ensure a complete, accurate and documented asset inventory”.

All other provisions will become effective 180 days after the Effective Date (unless otherwise noted in the text of the proposed amendments.

As noted above, this information should be viewed as a starting point and not as an exhaustive list of measures that need to be taken once the proposed amendments become effective. Companies must thoroughly review the proposed amendments to understand all updated obligations. This is especially pertinent given the updates to the enforcement-related provisions of the proposed amendments, which provide that failure to satisfy obligations required under the regulation for as few as 24 hours may result in DFS assessing a penalty.

Chris Hart Discusses the US National Cybersecurity Strategy with SecurityWeek

Christopher Escobedo Hart — Wed, 12 Apr 2023 14:18:44 Z

Privacy & Data Security Practice co-chair Chris Hart spoke to SecurityWeek about the Biden administration’s National Cybersecurity Strategy and government intentions for the future of U.S. cybersecurity.

Read the full article here.

Things We Learned at the 2023 IAPP Global Privacy Summit

Wed, 12 Apr 2023 11:13:25 Z

The International Association of Privacy Professionals held its annual Global Privacy Summit on April 4-5 in Washington, D.C. Here are some things we learned.

Generative Artificial Intelligence (“AI”) is Ubiquitous in the Privacy Community.
- Organizations are scrambling to deploy generative AI tools. Given the huge volume of data needed to train the large language models (“LLMs”) powering these tools, chief privacy officers (“CPOs”) are being tapped to lead their organization's efforts regarding AI governance and ethical uses of AI.
Data Scraped from the Internet to Train Large Language Models May Violate Privacy Laws.
- Privacy laws such as the GDPR place restrictions on when and how organizations can collect and otherwise process personal data. Data scraped from the Internet and used to train LLMs include personal data. Unless the data is processed in a way compliant with the GDPR (specifically, Article 14), use of that personal data will in nearly all circumstances not be permissible.
- However, according to OpenAI Deputy General Counsel Che Chang, the content of personal data in training sets is not as important as the format. For example, LLMs may use personal data to learn where a name should appear in a sentence or how an email address looks – and not concerned regarding who the person is. Accounting for that disconnect (between personal data collection and need) may be an important way forward to minimize risks to personal data.
Governments are Trying to Determine How to Regulate AI.
- While some technologists have called for a pause on further AI development, governments are also wrestling with how to regulate AI.
- There are several new pieces of legislation that directly address AI, such as the New York City Council's updates to Local Law 144 requiring employers and employment agencies to conduct annual independent bias audits of automated employment decision tools used to screen candidates or employees for employment decisions. Likewise, the European Union proposed a new legal framework (the EU AI Act) to regulate the use of AI, primarily focused on “high risk” applications such as the use of AI systems in autonomous vehicles, medical devices, and infrastructure. Developers and users of such high-risk AI systems must conduct rigorous testing, document the quality of data used to train the system, and create an accountability framework that includes human oversight. The EU AI Act also prohibits the use of AI systems for certain applications such as use in social scoring systems.
- Existing regulations can be used to correct some of the wrongs created via biased AI systems. For example, Title VIII of the Civil Rights Act of 1968 is the primary federal law banning discrimination in housing. Meanwhile, the Council of the District of Columbia has proposed the Stop Discrimination by Algorithms Act (“SDAA”) that would provide transparency to D.C. residents regarding how algorithms are used to determine outcomes in credit, housing, and employment decisions. The SDAA could bridge the gap between misuse of AI systems and the Civil Rights Act. Generally, there was a sense among some EU panelists that the GDPR and other digital technology laws that currently exist do a good job of regulating some uses of AI.
- There may already be differences in approaches between the EU and U.S. on AI regulation. One U.S. official summarized it as follows: the U.S. is concerned about regulating based on impacts, while the EU is concerned about regulating based on AI categories.
AI Governance Frameworks are Needed.
- CPOs can play a critical role in AI governance given their board engagement and position in senior management. The CPO is already tasked with monitoring the regulatory landscape and can morph from a “data protection officer” to a “responsible AI officer.”
- The privacy community can look to leverage tools such as data protection impact assessments to develop generative AI risk assessment templates. NIST recently released its AI Risk Management Framework that organizations can use to improve trust in the development and use of AI systems.
- Given the volume of data used in AI systems, detailed human oversight is not sustainable. Consequently, technology will be developed to monitor other technology. However, AI systems cannot be left alone – some human intervention is still needed to sample data.
- AI governance requires transparency, but this presents a challenge for AI systems that can be a “black box” in terms of understanding what data is processed. For example, technologists believed they removed all international data from the data set used to train GPT-2. However, LLMs that used GPT-2 were very adept at translating English text to French; this was a surprise to technologists who later discovered that some French data remained in the training set. AI systems are not rule-based and transparency requires that developers must be able to explain elements such as training methods and the data sets used.

HHS Office for Civil Rights Announces the Expiration of COVID-19 Public Health Emergency HIPAA Enforcement Discretion

Zick Colin J. — Wed, 12 Apr 2023 08:47:14 Z

Like many regulatory standards, enforcement of HIPAA was relaxed as part of the COVID-19 pandemic response. With the end of the public health emergency declaration on May 11, 2023, the broad relaxed HIPAA enforcement also will be coming to an end.

“OCR exercised HIPAA enforcement discretion throughout the COVID-19 public health emergency to support the health care sector and the public in responding to this pandemic,” said Melanie Fontes Rainer, OCR Director. “OCR is continuing to support the use of telehealth after the public health emergency by providing a transition period for health care providers to make any changes to their operations that are needed to provide telehealth in a private and secure manner in compliance with the HIPAA Rules.”

In 2020 and 2021, OCR published four Notifications of Enforcement Discretion in the Federal Register regarding how the Privacy, Security, Breach Notification, and Enforcement Rules (“HIPAA Rules”) would be applied to certain violations during the COVID-19 nationwide public health emergency. These Notifications and the effective beginning and end dates are:

Enforcement Discretion Regarding COVID-19 Community-Based Testing Sites During the COVID-19 Nationwide Public Health Emergency, effective from March 13, 2020, to May 11, 2023;
Enforcement Discretion for Telehealth Remote Communications During the COVID–19 Nationwide Public Health Emergency (“Telehealth Notification”), effective from March 17, 2020, to May 11, 2023;
Enforcement Discretion Under HIPAA To Allow Uses and Disclosures of Protected Health Information by Business Associates for Public Health and Health Oversight Activities in Response to COVID-19, effective from April 7, 2020, to May 11, 2023; and
Enforcement Discretion Regarding Online or Web-Based Scheduling Applications for the Scheduling of Individual Appointments for COVID-19 Vaccination During the COVID-19 Nationwide Public Health Emergency, effective from December 11, 2020, to May 11, 2023.

With this notice, OCR is providing a 90-calendar day transition period for covered health care providers to come into compliance with the HIPAA Rules with respect to their provision of telehealth. The transition period will be in effect beginning on May 12, 2023 and will expire on August 9, 2023. OCR will continue to exercise its enforcement discretion and will not impose penalties on covered health care providers for noncompliance with the HIPAA Rules that occurs in connection with the good faith provision of telehealth during the 90-calendar day transition period.

Colorado's Newly Released Data Privacy Regulations Get Specific Regarding Design and Technical Specifications

Thu, 06 Apr 2023 17:00:51 Z

We have written previously regarding Colorado's adoption of the Colorado Privacy Act (CPA)—describing its provision of consumer data rights, how it may function within the context of the cannabis industry, and how business might consider the law as they renew their insurance coverage. And all this before the state released regulations accompanying the CPA.

On March 15, 2023, the Colorado Attorney General filed the final rules implementing the CPA to go into effect July 1, 2023. The following finalized rules are noteworthy—both for their technical specificity and their uniqueness. (Note: Capitalized words have specific definitions under either the CPA or the regulations.)

Universal Opt-Out Mechanisms. Companies must provide Consumers the opportunity to opt out of the sale or processing of their Personal Data for purposes of targeted advertising. A consumer may use a universal opt-out signal (generally through their web browser) that allows them to communicate automatically that they opt out of the sale or processing of their Personal Data with all Controllers at once. The Rules dictate that companies have some mechanism that recognizes that Consumer's preferences and meets certain technical requirements (for example, default settings and authentication). The Rules announce that the Colorado Department of Law will maintain a public list of Universal Opt-Out Mechanisms that have been recognized to meet these technical requirements; the list will be available no later than January 1, 2024.

Privacy Notices. Controllers must provide a privacy notice giving consumers a “meaningful understanding and accurate expectations of how their Personal Data will be Processed.” Such a notice must identify the categories of Personal Data Processed, the Processing purpose, and whether the Personal Data that a consumer provides for a specific purpose will be sold or used for Targeted Advertising or Profiling (more on that below).

Loyalty Programs. If a consumer opts out of the sale of their personal data or processing for targeted advertising, and that data was needed for a “Bona Fide Loyalty Program Benefit,” the Controller no longer needs to provide that benefit. However, if the loyalty program offers benefits that are unrelated to the exchange of the Consumer's Personal Data, the Controller must provide those benefits.

Valid Consent. Controllers must obtain valid Consumer Consent before processing or selling Consumer Data. The rules lay out the required elements for a valid consent: it must (1) be obtained through the Consumer's clear, affirmative action; (2) be freely given; (3) be specific; (4) be informed; and (5) reflect the Consumer's unambiguous agreement. The Rules lay out the characteristics of each of the elements.

User Interface Design and Dark Patterns. Perhaps one of the most unique features of the Rules is the specificity with which it describes the design principles Controllers should use to obtain Consent. Regarding design principles, the Rules say that “[c]onsent choice options should be presented to Consumers in a symmetrical way that does not impose unequal weight or focus on one available choice over another such that a Consumer's ability to consent is impaired or subverted.” Further, consent choices should not use manipulative language or visuals designed to trick consumers (“dark patterns”). Buttons that say (as the Rules illustrate) “I accept, I want to help endangered species” or “No, I don't care about animals,” would constitute manipulation. The rules list several other design principles that help ensure that Consumers are able to make informed decisions regarding whether or not to Consent to sharing their Personal Data.

Data Protection Assessments. The Rules require that a data protection assessment identify and describe risks to consumers associated with processing of their data, document measures considered and taken to offset those risks, the benefits of the Processing, and a demonstration that the Processing outweigh the risks offset by safeguards. Controllers must use the scope of the risk presented, the size of the Controller, and the amount and sensitivity of the Personal Data Processed to determine what the data protection assessment should look like.

Profiling Opt-Out Transparency. If a Controller is Processing Personal Data for Profiling (a form of automated processing of personal data to predict certain things about the Consumer such as their interests, personal preferences, health, or wealth status), its data protection assessment must include certain information. That information includes an explanation of the decision to use Profiling, an explanation of the training data and logic used to create the Profiling system, and how the Profiling system is evaluated for fairness and disparate impact, and the results of any such evaluation.

While these aspects of the CPA are particularly noteworthy, the CPA does not have a section that identifies the responsibilities of Third Parties that may encounter Consumer Personal Data. Additionally, enforcement is left exclusively to the Colorado Attorney General and district attorneys. That being the case, enforcement for violations may be slow going at the start.

Time will tell how these new (and specific) Rules influence the ways in which companies operate in Colorado and beyond.

The FTC Outlines What It Sees as The HIdden Impacts of Pixel Tracking

Zick Colin J. — Thu, 16 Mar 2023 14:20:24 Z

In a very comprehensive post from the Federal Trade Commission’s Office of Technology, the FTC takes what it calls “[a] deep dive into the technical side of FTC's recent cases on digital health platforms, GoodRx & BetterHelp.”

As most readers know, the FTC recently took enforcement action against GoodRx and BetterHelp, two digital healthcare platforms, for allegedly sharing user health data with third parties for advertising. Both cases highlighted the use of third-party tracking pixels, which enable platforms to amass, analyze, and infer information about user activity. The remedies in GoodRx and BetterHelp included bans that place limits on whether and how certain user information may be disclosed for advertising. For GoodRx and BetterHelp, this included a ban on the sharing of health information for any advertising purposes, and the BetterHelp order further bans the disclosure of other personal information for re-targeting. Here’s what the FTC says about pixel tracking:

What is pixel tracking?

Tracking pixels have evolved from tiny, pixel-sized images on web pages for tracking purposes to include a broad range of HTML and JavaScript embedded in web sites (and email). Tracking pixels can be hidden from sight and can track and send all sorts of personal data such as how a user interacts with a web page including specific items a user has purchased or information users have typed within a form while on the site. Businesses often want to use them to track consumer behavior (pageviews, clicks, interactions with ads) and target ads to users who may be more likely to engage or purchase something based on that prior online behavior.

How does it work?

Companies interested in pixel tracking must first choose a pixel tracking provider. The provider will then generate a tracking pixel, a small piece of code that will be placed into the website or ad and define their tracking goals such as purchases, clicks, or pageviews. The company will then use some version of a dashboard or interface with the provider to track, test, and refine their settings.

Pixel tracking can be monetized several ways. One way to monetize pixel tracking is for companies to use the tracking data collected to improve the company’s own marketing campaigns. The data can be used to target more specific audiences with ads and other marketing messages. Another is that companies can monetize the data collected by further optimizing their own ad targeting systems and charging other companies to use its advertising offerings.

What are the FTC’s stated concerns?

- Widespread usage of invisible pixels with no way for consumers to avoid.
- Lack of clarity around data collection and use.
- Personal information may not be effectively removed.

* * *

Interestingly, the FTC does not claim it knows all there is to know about pixel tracking. In its post, the FTC took the unusual step of asking researchers and journalists to help it answer the following questions about pixel tracking (even as it brings enforcement actions regarding pixel tracking):

Industry conditions and competitive dynamics.
- Which pixel providers are particularly competitively significant for various tracking use cases, and how has competition in this industry evolved?
- How prevalent is pixel tracking relative to other forms of online tracking?
- What broader impact does pixel tracking have on competitive conditions in online tracking and advertising?
Consumer harms.
- What unique consumer harms, financial or otherwise, can result from the use of pixel tracking technologies?
- How might the harms of pixel tracking technologies differ for certain communities?
Business rationales.
- Does data collection from pixel tracking offer business advantages or disadvantages to companies, relative to alternative forms of data collection?
- What financial impact does pixel tracking have on advertising networks, data brokers, social networks, advertisers, and other parties?
Data processing, use, and monetization.
- To what extent do first parties—including companies with diverse businesses practices—internally share data to use for purposes that consumers might not reasonably expect?
- For parties that obtain data via pixel tracking, what processing do they perform on this data, and how do they use and monetize this data beyond direct ad targeting?
- Do other platforms that handle sensitive data (e.g., health, financial, location, etc.) make use of third-party tools like pixel tracking in ways that risk exposing that data?
Data retention and management.
- What is the minimum data retention period necessary to provide services based on pixel tracking?
- What are the circumstances that inform retention periods?
- How do companies keep track of the data they receive from pixels?

Minimizing Risk and Liability from Man-in-the-Middle Attacks (or, How to Keep Your Company's Wire Transfers from Going Awry)

Christopher Escobedo Hart — Tue, 14 Mar 2023 12:15:19 Z

Given the recent failures of Signature Bank and Silicon Valley Bank, we know clients are looking to set up new banking relationships and moving money around, especially by wire transfers. It will not come as a surprise that bad guys see this as an opportunity to prey on folks who are trying to access funds needed to make payroll or other basic business expenses. This is just what the criminal “man in the middle” attacker wants – a time when businesses have let down their guard and hackers can induce fraudulent wire transfer. We addressed these issues back in 2019, but the advice is just as relevant now.

Lex Mundi Reports on Global Trends in Data Privacy in 2023

Zick Colin J. — Tue, 21 Feb 2023 16:35:59 Z

Foley Hoag is pleased to contribute to Lex Mundi's report on global data privacy trends and topics. Our Lex Mundi network gives us access to the best attorneys in data privacy in jurisdictions across the globe, who provide local expertise on anticipated regulatory risks to overcome related to cross-border data and cybersecurity challenges. To access the full report, click here.

ChatGPT Writes a Blog Post About Itself.

Christopher Escobedo Hart — Fri, 27 Jan 2023 04:00:31 Z

Editors’ Note: How does ChatGPT fare in writing a law firm blog post? We asked ChatGPT to write one . . .

PROMPT: Write a 500 word blog post, in the style of a law firm blog post, on ChatGPT, focusing in particular on questions of privacy, cybersecurity, and ethics.

OUTPUT:

ChatGPT is a large language model developed by OpenAI that has the ability to generate human-like text on a variety of topics. It is trained on a massive amount of text data and can generate responses to questions, write articles, and even code. While ChatGPT has many potential uses, there are also important questions that need to be considered when using this technology, particularly in relation to privacy, cybersecurity, and ethics.

One of the biggest concerns when it comes to ChatGPT is privacy. The model is trained on a vast amount of text data, which includes personal information such as names, addresses, and phone numbers. While this data is publicly available, it is still important to consider the potential consequences of using it. For example, if ChatGPT is used to generate personal information for marketing purposes, it could potentially lead to unwanted spam or even identity theft.

Another major concern is cybersecurity. ChatGPT is a powerful tool that can be used to generate code, and this opens up the possibility of it being used to create malware or other malicious software. Additionally, the model could be used to generate phishing emails or other types of scams. It is important to be aware of these potential risks and take steps to mitigate them.

Finally, there are ethical considerations when it comes to ChatGPT. The model is capable of generating human-like text, and this raises questions about the potential for deception. For example, if ChatGPT is used to generate fake news or impersonate real people, it could have serious consequences. Additionally, there are concerns about the potential for the model to perpetuate biases and stereotypes that are present in the data it was trained on.

In conclusion, ChatGPT is a powerful and versatile tool that has the potential to revolutionize the way we communicate and generate content. However, it is important to consider the potential consequences of using this technology, particularly in relation to privacy, cybersecurity, and ethics. By being aware of these issues and taking steps to mitigate them, we can ensure that ChatGPT is used in a responsible and ethical manner.

It is also important to mention that OpenAI has been working on ways to mitigate these concerns by creating various ways to use the model in a safe and controlled environment, such as the GPT-3 sandbox, which allows to access the model through a safe API and also allows to monitor the usage and the outputs generated by the model. [Eds.’ note: this feels like lawyer’s or marketer’s addition; note this comes after the first conclusion!]

In summary, ChatGPT is a powerful technology that has the potential to improve many aspects of our lives, but it is important to be aware of the potential consequences of its use and to use it responsibly. We must take steps to mitigate the potential risks and ensure that the technology is used in a way that is ethical and respects the privacy and cybersecurity of all individuals.

Time to Update Your Cookie Banners? Helpful Guidance from the European Data Protection Board on Bad Cookie Banner Practices

Christopher Escobedo Hart — Thu, 26 Jan 2023 14:10:10 Z

When it comes to website privacy compliance, cookies have consistently presented the most fraught issues for U.S. businesses. This is especially true for those businesses that find themselves in a sometimes new or often uncertain relationship with the EU or UK GDPR. Do I need a cookie banner? Where does it go? How big does it have to be? Will a privacy policy alone do? Can’t users just be directed to the appropriate place to disable their browser’s cookie collection? Why does this even matter?

The European Data Protection Board (EDPB)–an independent EU body that, among other things, provides guidance on EU data protection laws–recently issued and adopted a report on from its “Cookie Banner Task Force,” created in September 2021. The report (which responds to several complaints from the Max Schrems non-profit outfit, NOYB [None of Your Business]), essentially amounts to a list of “don’ts” when it comes to cookie banners. Focusing on the application of the ePrivacy Directive and the GDPR, the report makes clear that cookie banners must be clear, they must provide an opportunity for meaningful consent (and withdrawal of consent), and they cannot be deceptive.

So what are the don’ts? The report criticizes eight different kinds of practices:

DON’T . . .

. . . fail to include a “reject” button. The EDPB notes that banners will sometimes only display “consent” buttons with further options, without displaying the “reject” button, or might otherwise bury the rejection option in a nest of links.
. . . use links, instead of reject buttons. The option to reject should be immediately and prominently displayed. “The members agreed that for the consent to be valid, the user should be able to understand what they consent to and how to do so.”
. . . use pre-ticked consent boxes. “The taskforce members confirmed that pre-ticked boxes to opt-in do not lead to valid consent . . .”
. . . use deceptive button colors or deceptive button contrast. “[T]he configuration of some cookie banners in terms of colours and contrasts of the buttons . . . could lead to a clear highlight of the ‘accept all’ button over the available options.”
. . . inaccurately label cookies as “essential.” “Essential” or “strictly necessary” cookies are those that are needed to make the website function. There are other kinds of cookies, but only “essential” cookies do not require specific consent. The taskforce noted that some entities made the “essential” cookie category broader than appropriate.
. . . rely on “legitimate interests” in processing cookies. The GDPR only allows for the processing of user data if it is lawful. The taskforce determined that if the collection of cookies was illegitimate, the entity could not then rely on “legitimate interests” as a basis to process the information collected. In other words–it’s consent all the way down.
. . . fail to provide a “withdrawal” icon. “Website owners should put in place easily accessible solutions allowing users to withdraw their consent at any time, such as an icon (small hovering and permanently visible icon) or a link placed on a visible and standardized place.”

No doubt, this clarification on prohibited banner uses may be unwelcome news to entities that have engaged in one or more of the above practices. But increased enforcement, as well as country specific guidance, make it clear that EU member states–and individuals protective of their privacy right–are being more vigilant about personal data collection through cookies, and how organizations are communicating with users. Time to update your banners!

Thirty-Three State Attorneys General Show Support for FTC's Proposed Crackdown on “Commercial Surveillance”

Mon, 26 Dec 2022 21:43:35 Z

On August 22, 2022, the Federal Trade Commission (“FTC”) indicated through the Advanced Notice of Proposed Rulemaking its intent to limit commercial surveillance – the common corporate practice of collecting, analyzing, and monetizing consumers' data. As slews of data breaches resulted in millions of dollars in settlement and countless consumers whose data had been jeopardized, 33 states, including Massachusetts, New York, and Texas, showed support for the FTC's proposed rule through a comment letter dated November 17, 2022.

The letter highlighted the following three areas of greatest concern regarding consumer data:

Location data;
Biometric data (such as facial recognition and fingerprinting); and
Medical data collected by applications, wearables, and devices, regardless of whether Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) applies.

As pointed out in the letter, consumers are often unaware of when and how their location and biometric information are collected and how they are used. In most cases, consumer-facing privacy policies go unread. Even when consumers take the time to read through the policies, they are often not helpful or understood. For medical data, many consumers do not have a full understanding of how far HIPAA can reach. To address these concerns, the comment letter urged the FTC to focus its regulatory efforts on these three areas of commercial data.

Additionally, the AG comment letter expressed concerns about data brokers and the risks posed by their creation of personalized profiles of consumers (profiles created by scouring online databases, social media, and internet browsing histories). Some data brokers then sell or release these consumer profiles, exposing consumers to heightened risk of targeted scams, advertising, and identity theft. While data brokers are not required to obtain consumers' consent to collect and sell the consumer profiles, consumers must contact each relevant broker to opt out of the data collection.

The AG comment letter also suggested the FTC refer to the approaches of five model states – California, Colorado, Connecticut, Utah, and Virginia – that have taken initiative in protecting their privacy of their consumers. All five states require businesses to limit the collection of consumer personal data only to what is “reasonably necessary” to a specified purpose. Similarly, the AG comment letter encouraged the FTC to consider limiting businesses' data retention and impose data minimization requirements to mitigate potential future exposure of consumer data.

Although the AG comment letter expressed support for the FTC's recent rulemaking approach, the FTC also faces strong pushback from advocacy groups and tech industry groups. These groups' main arguments are that: (i) the FTC does not have the rulemaking authority in the data privacy and security arena; and (ii) the FTC should focus its punitive efforts on the breachers rather than the businesses.

The extended deadline for comments to the FTC's rulemaking proposal closed on November 21, 2022, with over 11,000 comments submitted on the matter. Many parties have shown great interest in the FTC's response to the comments. We will continue to provide updates on the regulatory developments around commercial surveillance.

Tis the (Insurance Renewal) Season! What Enhanced Consumer Data Protection Laws Mean for Your Business

Wed, 21 Dec 2022 15:23:36 Z

As many businesses prepare to renew their insurance policies, considerations of consumer privacy rights ought to be top of mind.

The Colorado Privacy Act

Scope

Foley Hoag has previously written about the Colorado Privacy Act, or “CPA” (COLO. REV. STAT. ANN. §§ 6-1-1301 et seq), which was signed into law by Governor Jared Polis in July 2021 and goes into effect on July 1, 2023. See here and here. Many companies' insurance programs for the 2023 policy year will be in place before the new law goes into effect. The CPA is meant to “empower consumers to protect their privacy and require companies to be responsible custodians of data.”

The CPA has significant implications for companies and their insurance programs. The law applies broadly to any entity that conducts business in Colorado (or “produces or delivers commercial products or services targeted to Colorado residents”), and meets one of the following two thresholds:

(2A) controls or processes the personal data of 100,000 consumers or more during a calendar year; or
(2B) derives revenues or receives a discount on the price of goods from the sale of personal data or controls the personal data of 25,000 consumers or more.

Those familiar with California's comprehensive consumer privacy laws (CCPA or CPRA) will note that there is no financial threshold in Colorado's law, thus narrowing its scope by comparison. Companies should nevertheless be mindful that they could quickly meet the personal data processing threshold merely through the use of cookies on their websites. If the law does apply, exceptions exist for protected health information, the retention of de-identified data, and publicly known information.

Consumer Rights and Compliance Obligations

Under the CPA, consumers have robust personal data rights that companies must help facilitate. Those rights include access to, and deletion of, consumers' personal data; the right to correct inaccuracies; and the right to receive personal data in a way that makes it easy to transfer. The CPA requires companies to provide a privacy notice to consumers in “ways in which consumers normally interact” with i

t—such as having a notice on their website or through a mobile app. Companies must respond to any consumer data requests “without undue delay,” and within 45 days after the request is made, subject to a limited extension.

Companies have clear duties under the CPA regarding consumer privacy. They must take action to allow consumers to exercise their rights, employ security measures to protect the processing of personal data, and develop systems to notify consumers in case of a data breach. Companies must also specify the purposes for which they collect data. Data collection must be “adequate, relevant, and reasonably necessary in relation to the specified purposes.” Importantly, companies, as controllers of data, must take reasonable measures to secure personal data during both storage and use. In short, companies are accountable for the way they use and collect consumer data, as well as how they interact with and notify consumers regarding those processing activities.

As a practical matter, these requirements mean that companies subject to the CPA not already in compliance with the EU or UK General Data Protection Regulation (GDPR), or California's privacy laws, will need to start taking steps to understand their data flows, build appropriate internal processes and governance mechanisms to locate and manage their data, and create compliant external and internal policies.

Upcoming Regulations

The CPA vests the Colorado Attorney General with rulemaking authority (similar to the CCPA and CPRA in California). In October 2022, the Colorado Attorney General submitted an initial draft of rules governing CPA implementation. Importantly, the draft rules require businesses to protect consumers' biometric information by imposing both a consent requirement and a data minimization requirement: that is, permitting them to collect only that data reasonably necessary to fulfill the specific purpose for which a consumer has provided consent. 4 C.C.R. 904-3 (Rule 6.07). The comment period on the proposed rules will close on Feb. 1, 2023, at which point there will be a proposed rulemaking hearing. The rulemaking process could not only create additional specific obligations on organizations but also provide some insight into the Attorney General's enforcement priorities.

Enforcement

And if companies do not comply? Although there is no private right of action, the law allows the state Attorney General and state district attorneys to enforce the law by bringing legal action in the name of the state.

Importantly, the CPA makes it clear that a violation of any of its provisions constitutes a deceptive trade practice and is thus actionable under the provisions of the Colorado Consumer Protection Act (“CCPA”). C.R.S. § 6-1-1311(1)(c). In Colorado, a person who engages in deceptive trade practices violates the CCPA and may be liable for a civil penalty of not more than $2,000 per violation, where a separate violation exists for each consumer whose rights have been violated. The upward limit stands at $500,000.

Impact on Insurance and Renewals

Colorado is among the vanguard of states creating comprehensive privacy laws to protect consumers' personal information, including biometric data. With the enactment of the CPA and similar statutes around the country, businesses will inevitably face increased risk of liability. Insurance in the cyber and data security market is also evolving. While there remain many variations of cyber insurance available, some insurers are responding to minimize their exposure, such as by introducing exclusions relating to cyber incidents, including for violations of privacy or consumer protection data laws, increasing premiums and/or deductibles, imposing sub-limits, and non-renewing businesses altogether. In addition, underwriters are using increasingly stringent underwriting standards and imposing stronger risk management protocols on insureds as a condition of coverage. Therefore, as companies begin to assess their insurance needs over the coming months, questions concerning insurance coverage for possible data breaches and civil actions by the State, including for violation of the CPA and the CCPA, become an integral part of assessing and fortifying against risk.

What Can You Do?

Work with a qualified independent insurance broker who understands your business and the ever-evolving cyber/data security marketplace.
Start the renewal process early. Renewals often take longer than businesses expect.
Affected businesses ought to inquire about cyber insurance coverage in the context of the CPA and other applicable laws and regulations. Consider what that insurance covers, the extent to which it may interplay with other insurance already provided under your insurance program, and understand the differences between first-party and third-party coverages provided.
Gather a qualified team, including management, IT, risk management, finance, legal, and compliance, to assist with completely and accurately filling out the insurance application.
Be prepared to fully and accurately answer insurance application questions and warranty statements. Insurers are asking detailed questions about data security, internal controls, and risk mitigation on the applications, which companies must understand and answer accurately to avoid jeopardizing coverage down the road.
With the stakes of data breaches and related litigation increasing, expect increases in premiums, more onerous policy terms, higher deductibles, sublimits, and more insurance coverage disputes.
Be on the lookout for new policy forms and endorsements being added during the renewal of existing policies.
Be ready to negotiate terms to get a policy that works for your business, and don't be afraid to shop around.
Work with a qualified insurance coverage lawyer to help you navigate this process.

Massachusetts Governor Issues Executive Order to Strengthen States Cyber Defenses

Zick Colin J. — Mon, 19 Dec 2022 12:05:18 Z

Governor Charlie Baker recently took steps to strengthen cybersecurity in Massachusetts by signing an executive order on December 14, 2022 creating an advisory panel to improve the state's cyber defense. The new state task force will assess existing resources, develop contingency plans, and identify strategies for preventing future cyberattacks. The goal of the task force is to ensure that the Bay State is at the forefront of the ever-evolving cybersecurity landscape. With cyber threats becoming increasingly sophisticated, it's crucial for the state to stay ahead of the curve. The panel will study existing protocols, assess the state's current level of preparedness, and recommend ways to improve security measures.

The executive order will also create a Cybersecurity Incident Response Team (MA-CIRT), which will consist of state leaders from the public and private sectors, including representatives from the Governor's Office, the Massachusetts State Police, the Department of Telecommunications and Cable, the Commonwealth Fusion Center, the Department of Security, the Massachusetts Emergency Management Agency. MA-CIRT will be led by the Secretary of the Executive Office of Technology Services and Security (a position currently held by Curt Wood).

Additionally, the Executive Order:

Requires MA-CIRT to review cybersecurity threat information and vulnerabilities to make informed recommendations and establish appropriate policies to manage the risk of cyber incidents for executive department agencies and all other state agencies served by EOTSS.
Requires MA-CIRT to develop and maintain an up-to-date Cyber Incident Response Plan, which will guide the actions of the Commonwealth's key public safety and information security and technology teams, state agency resources, and security professionals in responding to and minimizing the impact of significant cybersecurity threats to Commonwealth systems. The Plan is required to be submitted annually to the Governor for review and approval.
Empowers the EOTSS Secretary to serve as MA-CIRT lead, with the approval of the Governor, to direct MA-CIRT in response to a significant cyber incident.
Requires the routine exchange of information related to cybersecurity threats and reported incidents between the Commonwealth Fusion Center and the Commonwealth Security Operations Center.
Requires EOTSS and MA-CIRT to consult with the Massachusetts Cyber Center and assist the Center with efforts to foster cybersecurity resiliency through communications, collaboration, and outreach to state agencies, municipalities, educational institutions and industry partners.
Requires executive department agencies to comply with protocols and procedures established by MA-CIRT and all related policies, standards and Administrative Directives issued by EOTSS.
Requires Commonwealth executive department agencies and other state agencies served by EOTSS to identify and report significant cybersecurity incidents and coordinate efforts to mitigate and prevent further damage from cyber incidents.
Requires all executive department personnel to annually complete the EOTSS approved security awareness training program administered by the Human Resources Division.
And strongly encourages other governmental entities throughout the Commonwealth not served by EOTSS to report cybersecurity threats or incidents to the Commonwealth Security Operations Center.

HHS Office for Civil Rights Issues Bulletin on Requirements under HIPAA for Online Tracking Technologies to Protect the Privacy and Security of Health Information

Zick Colin J. — Sat, 03 Dec 2022 08:46:04 Z

On December 1, 2022, the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services issued a bulletin to highlight the obligations of Health Insurance Portability and Accountability Act of 1996 (HIPAA) on covered entities and business associates under the HIPAA Privacy, Security, and Breach Notification Rules (“HIPAA Rules”) when using online tracking technologies. These online tracking technologies, like Google Analytics or Meta Pixel, collect and analyze information about how internet users are interacting with a regulated entity's website or mobile application.

The bulletin addresses potential impermissible disclosures of ePHI by HIPAA regulated entities to online technology tracking vendors. The Bulletin explains what tracking technologies are, how they are used, and what steps regulated entities must take to protect ePHI when using tracking technologies to comply with the HIPAA Rules. Specifically, the Bulletin provides insight and examples of:

* Tracking on webpages

* Tracking within mobile apps

* HIPAA compliance obligations for regulated entities when using tracking technologies

* * *

Some examples of the HIPAA Privacy, Security, and Breach Notification requirements that regulated entities must meet when using tracking technologies with access to PHI include:

Ensuring that all disclosures of PHI to tracking technology vendors are specifically permitted by the Privacy Rule and that, unless an exception applies, only the minimum necessary PHI to achieve the intended purpose is disclosed.
Addressing the use of tracking technologies in the regulated entity's Risk Analysis and Risk Management processes, as well as implementing other administrative, physical, and technical safeguards in accordance with the Security Rule (e.g., encrypting ePHI that is transmitted to the tracking technology vendor; enabling and using appropriate authentication, access, encryption, and audit controls when accessing ePHI maintained in the tracking technology vendor’s infrastructure) to protect the ePHI.
Providing breach notification to affected individuals, the Secretary, and the media (when applicable) of an impermissible disclosure of PHI to a tracking technology vendor that compromises the security or privacy of PHI when there is no Privacy Rule requirement or permission to disclose PHI and there is no BAA with the vendor. In such instances, there is a presumption that there has been a breach of unsecured PHI unless the regulated entity can demonstrate that there is a low probability that the PHI has been compromised.

Is the Video Privacy Protection Act a New Litigation Weapon for Consumers?

Thu, 17 Nov 2022 11:36:13 Z

On September 19, 2022, a Massachusetts federal District Court denied Boston Globe Media Partners LLC's motion to dismiss a consumer class action suit against it. This case is one of 47 proposed class actions filed since February 2022 against various companies, each based on a company's use of Meta's Pixel tracking tool.

Boston Globe Media Partners is a “multimedia organization that provides news, entertainment, and commentary across multiple brands and platforms”; one of those platforms is the subscription website, bostonglobe.com. The Plaintiff class in this case alleged that form them to subscribe to bostonglobe.com, they were required to reveal their personally identifiable information (PII). In particular, the Plaintiff class alleged that the Globe had obtained and improperly disclosed subscribers' information by hosting “the Facebook Tracking Pixel—a piece of code that ‘tracks the people and type of actions they take' by capturing a digital subscriber's action and sending a record of that action to Facebook.” Ambrose v. Boston Globe Media Partners LLC, 2022 U.S. Dist. LEXIS 168403 (D.Mass., Sept. 19, 2022). Plaintiffs further alleged that such disclosures violated the federal Video Privacy Protection Act (VPPA), a law requiring companies to obtain consumers' informed and written consent in order to disclose their information.

To assert a claim under the VPPA, plaintiffs “must allege that ‘a video tape service provider . . . knowingly disclose[d], to any person, personally identifiable information concerning any consumer of such provider.” In re Nickelodeon Consumer Privacy Litig., 827 F.3d 262, 279 (3d Cir. 2016). The VPPA defines a “a video tape service provider” as “any person, engaged in business, in or affecting interstate or foreign commerce, of rental, sale, or delivery of prerecorded video cassette tapes or similar audio-visual materials.” 18 U.S.C. § 2710(a)(4). And PII is defined by the VPPA as “information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider.” 18 U.S.C. § 2710(a)(3). In this case against the Globe, the judge found that the plaintiff class had plausibly stated a claim for relief, making a sufficient showing for the current stage of the case that: (1) the Globe engaged in the business of providing video content to its subscribers; (2) it disclosed PII, including subscribers' Facebook ID, email, first and last name, mailing address, and what videos the subscriber had viewed; and (3) subscribers to the Globe's videos are plausibly consumers under the law. Ambrose, 2022 U.S. Dist. LEXIS 168403 at *5-6.

There has been an uptick in claims against companies for their use of Meta's tracking tool under the VPPA; this trend suggests plaintiffs' lawyers may be trying to stretch the VPPA more broadly than perhaps Congress intended. Congress originally passed the VPPA in 1988, after a news organization obtained a list of films that Robert Bork's family had rented at a local video rental store — without Bork's consent — during the period surrounding his nomination to the Supreme Court. Plaintiffs' lawyers are now seeking to use the VPPA to prevent companies from disclosing information relating to their viewing habits online (and punish those that do).

While the Ambrose court denied the Globe's motion to dismiss, it is far from certain that the Plaintiff's VPPA claims will ultimately be successful. Of the 47 proposed VPPA class action suits to date, five have been voluntarily dismissed. Most of the other cases have not yet reached the discovery phase. But the stakes are high. The VPPA provides consumers with a private right of action, and the potential damages can be steep. 18 U.S.C. § 2710(c)(1). Awards can include actual damages (though not less than $2,500 per injured person), punitive damages, reasonable attorneys' fees, and other litigation costs. 18 U.S.C. § 2710(c)(2)(A)-(C). Considering that a plaintiff class could consist of hundreds of thousands of consumers, companies that access consumer data have reason to watch these VPPA claims closely.

Looking to a New EU-US Data Privacy Framework

Mon, 31 Oct 2022 11:12:23 Z

As we wrote in July 2020, the European Court of Justice issued a landmark decision that invalidated the Privacy Shield as untenable under the European General Data Protection Regulation (GDPR). The decision sparked negotiations between the United States and the European Union on a workable data privacy framework. And after a two-year long hiatus, the U.S. and the EU agreed on a replacement for the Privacy Shield.

The executive order (the “Order”) President Biden signed on October 7, 2022 signaled a step forward for the transatlantic data transfer pact. The Order implements the new EU-U.S. Data Privacy Framework that will enhance protections for EU residents' personal data. It regulates how the U.S. government will handle the EU personal data and complaints for redress. Although the Order limits certain agencies' reach into personal data, it represents a much-needed agreement that will help facilitate data sharing across the Atlantic.

New Oversights and Limitations

The Order creates two layers of oversight in the U.S. government. First, it creates the position of Civil Liberties Protection Officer (“CLPO”), who will work within the Office of the Director of National Intelligence and will have the power and independence to investigate possible breaches of citizens' privacy rights. Second, the Order establishes an oversight court, named the Data Protection Review Court (the “Review Court”), within the Department of Justice. The Review Court will oversee how U.S. intelligence agencies access and use information from citizens of the EU and the U.S.

Redress Mechanism through the Civil Liberties Protection Officers

One of the greatest concerns the EU had with the Privacy Shield was the lack of redress mechanisms for EU residents. Under the Order, the U.S. will create a signals intelligence redress mechanism for residents to file complaints. When a complaint is submitted, the CLPO must investigate and may even order remediation for the complaint.

The Data Protection Review Court

Once the CLPO finishes reviewing the complaint, the complainant may apply for review of the CLPO's determination by the Review Court. If the complainant decides to proceed with the appeal, court-designated “special advocates” would challenge the use of the personal data by the national intelligence agencies on behalf of the complainant. The Review Court would then hand down an independent and binding decision, possibly putting a damper on the agencies' operations.

Limitations

Under the Order, the U.S. intelligence agencies can only collect personal data through signals intelligence for specific, defined national security purposes in a “necessary and proportionate” manner. The intelligence agencies have one year to update their policies and procedures to comply with the Order. Meanwhile, the Privacy and Civil Liberties Oversight Board – an existing office created in 2004 to evaluate the impact of executive actions taken to protect the U.S. from terrorism on civil liberties – will review the updated policies and procedures to ensure the agencies' compliance.

Agencies will be required to consider the nature and extent of the personal information sought to be obtained and the potential for harmful impact on the individual before disseminating or retaining the personal information collected through signals intelligence. Under the Order, the personal data of non-U.S. residents will be extended various types of protections that already exist as to U.S. residents.

The Order also lists safeguards the U.S. intelligence agencies must adopt and narrows down the legitimate objectives the government can pursue through signals intelligence. Most of the acceptable objectives are directed against various forms of threats from foreign sources. The intelligence agencies must document their data collection to be prepared to provide a factual basis as to why the collection was necessary to advance a legitimate objective.

Next Move

Now that the U.S. has sent the Order to the European Commission for review, the EU must decide whether the U.S. government has done enough to address the ongoing concerns over government surveillance and judicial redress. The survival of the new Data Privacy Framework hinges on the EU's adoption of a new “adequacy” determination for the U.S.

The EU's determination process is estimated to last six months. Once the European Commission accepts the Order as satisfactory, the U.S. and the EU will publish a finalized agreement around March 2023. Even though the new Data Privacy Framework regulates the activities of the U.S. government, companies may still have to consider what changes they must make to their policies and data practices once the new framework is adopted. Since the U.S. intelligence agencies must update their policies and procedures to comply with the Order within one year, we may see many changes throughout the year 2023.

HHS Office for Civil Rights Posts HIPAA Security Rule Security Incident Procedures

Zick Colin J. — Wed, 26 Oct 2022 08:49:46 Z

Every October, in recognition of National Cybersecurity Awareness Month, the federal government and its partners work to educate stakeholders on cybersecurity awareness and how best to protect the privacy and security of confidential data. Within the health care industry, the HIPAA Security Rule applies to covered entities and their business associates (“regulated entities”) and electronic protected health information (ePHI). Because ePHI identifies individuals and includes information relating to an individual's health, treatment, or payment information, it is a valuable target for cyber-criminals.

Because of the recent flurry of security incidents impacting health care providers, HHS OCR has published its “HIPAA Security Rule Security Incident Procedures.” A 2022 report noted a 42% increase in cyber-attacks for the first half of 2022 compared to 2021, and a 69% increase in cyber-attacks targeting the health care sector. Breaches of unsecured PHI, including ePHI, reported to HHS OCR affecting 500 or more individuals increased from 663 in 2020 to 714 in 2021.

The HIPAA Security Rule requires regulated entities to “implement policies and procedures to address security incidents.” This means regulated entities need to have a plan in place and documented for responding to security incidents (suspected or known) that includes:

identifying security incidents;
responding to security incidents;
mitigating harmful effects of security incidents; and
documenting security incidents and their outcomes.

Given the focus on security incidents from HHS OCR, this would be a good time to revisit your own institution’s incident response procedures and conduct a tabletop exercise to improve your team’s ability to respond effectively.

California Trails Closely Behind UK to Protect Children's Privacy

Tue, 27 Sep 2022 12:33:26 Z

Recently signed into law by California Governor Gavin Newsom on September 15, 2022, the California Age-Appropriate Design Code Act (“AADC”) changes the playing field for certain businesses that provide online services, products, or features accessible to children under the age of 18. Although California models its new law after the Children's Code passed by the UK, the AADC is first state law of its kind in the US. Once it goes into effect on July 1, 2024, the Attorney General may fine noncompliant businesses up to $7,500 per affected child.

Whom does the AADC affect?

The AADC applies to businesses with online services, products, or features that minors “are likely to access,” that also meet the revenue or user thresholds established in the California Consumer Privacy Act (that is, gross revenues exceeding $25 million, buying or selling the personal information of 50,000 or more customers, or deriving more than 50% of annual revenue from selling personal information). The language in the AADC grants the AG a wider reach beyond online platforms that are specifically directed to children. Instead, the AADC affects online platforms that are:

Regularly accessed by a significant number of children, or platforms that are substantially similar to the regularly accessed platforms;
Largely comprised of child audiences;
Advertised to children; or
Made with design elements known to attract children, such as games and cartoons.

Social media platforms that are popular with children, as well as video game platforms, are most likely to feel the heaviest impact. With its broad reach, however, the AADC is likely to impact many more businesses that gear towards providing online platforms.

How can covered businesses comply?

Among many requirements, the AADC compels covered businesses under its purview to:

Implement strong privacy protections by default, with narrow exceptions;
Provide privacy information and terms of service in an age-appropriate language catered to children;
Limit the collection and use of a child's personal information, especially when tracking their location; and
Complete a Data Protection Impact Assessment (“DPIA”), which is an extensive survey, for any new applicable online service, product, or feature. Businesses must complete a DPIA on or before July 1, 2024 and provide it to the AG within 5 days upon request.

Overall, the AADC extends further than the federal Children’s Online Privacy Protection Act – which focuses on permission to collect, maintenance of, and deletion of children's personal information – and forces businesses to consider children's best interests in all aspects of its online service. They must consider what potential harms their content or contacts may have on child consumers and even reevaluate commonly used design features, like ‘autoplay,' and its harmful effects. With less than 2 years left until the enforcement of AADC, companies will benefit from consulting counsel to transition into the new regime if they plan to offer covered online services beyond July 2024.

Password Security Best Practices A Refresher

Zick Colin J. — Wed, 21 Sep 2022 09:39:00 Z

As more and more of us return to the office, it’s a good time to revisit the passwords you use. It is therefore timely that the U.S. Department of Health and Human Services, Health Sector Cybersecurity Coordination Center (“HC3”) recently published a set of password security suggestions and best practices. Here are some of HC3’s key takeaways:

Use multi-factor authentication when possible.
Use different passwords for different accounts.
Make passwords that are hard to guess, but easy to remember.
- To make passwords easier to remember, use sentences or phrases. Example: “pineappleonpizzaistasty”;
- Hackers will use dictionaries of words and commonly used passwords to guess your password. Avoid single words, or a word preceded or followed by a single number (e.g., Password1);
- Do not use passwords that are based on personal information that can be easily accessed or guessed (e.g., birthdays, children's or pet's names, car model, etc.);
- Length over complexity:
  - The longer a password is, the better. Use the longest password or passphrase permissible by each password system.
- But complexity still matters:
  - To increase complexity, include upper- and lower-case letters, numbers, and special characters. Example: “pin3appl30nPizzaI$Ta$ty
- Never reveal your passwords to others.
Password management tools, or password vaults, are a great way to organize your passwords.
Enable “Show Password” where possible.
- It is unlikely that the person behind you is going to record your password data, so there is little
  reason to hide your password as you type. You are more likely to make mistakes in typing if
  you cannot see the characters, and mistakenly think you have forgotten your password. This
  error leads to potential data exposure every time you need to reset your password.
Store Securely:
- Not on a Post-It under your keyboard.

References:
“Creating and Managing Strong Passwords,” CISA. 27 March 2018.
Kurko, Michael. “Best Password Managers,” Investopedia. 9 June 2022.
“NIST Password Guidelines: The New Requirements You Need to Know,” Auditboard. 24
“Password Best Practices,” UC Santa Barbara. N.d.

The FTC's Post-Dobbs Focus on Location Privacy Draws a Legal Challenge

Thu, 25 Aug 2022 14:27:19 Z

As we had previously blogged, the FTC in guidance following the Supreme Court's decision in Dobbs v. Jackson Women's Health indicated that it would aggressively wield its enforcement authority in relation to deceptive statements about location privacy, particularly in the context of what the FTC called “the often shadowy ad tech and data broker ecosystem.” The FTC voiced particular concern about unbeknownst tracking or selling of sensitive location data, such as data that relates to the receipt of medical care (or even just proximity to medical facilities). While it is difficult to know the full extent to which the FTC is putting its words into practice because investigations and settlement negotiations tend to be confidential, a recently filed lawsuit in Idaho suggests that the FTC's announced focus on location privacy is very real.

Idaho-based Kochava, which offers digital marketing and analytics services, has asked a federal court to grant an injunction against a proposed complaint that was apparently revealed to Kochava by the FTC in settlement talks. The lawsuit characterizes the FTC's concerns as relating to geolocation data that can be associated with sensitive locations such as therapists, addiction recovery centers, reproductive health centers, and other medical facilities. Kochava argues that data it collects and then sells as part of its business would not permit the buyer of the data to correlate specific location data with a specific individual or, in the alternative, that individuals agreed to the sharing of such data.

The limited window provided by Kochava's complaint shows both that the FTC is serious about claims made about location data, and also that critical terms like “anonymous” and “anonymized” carry multiple meanings out in the commercial world, meaning they are susceptible to claims of deception brought by the FTC and similar enforcers (such as state attorneys general). This underscores that, while anonymization can be a useful tool for commercializing consumer data, it is important to take into account whether the data is truly anonymized. While anonymization has a clear meaning in the US-based health information context (because HIPAA affirmatively provides one), the concept is more malleable outside of that context and also in other jurisdictions. Indeed, the GDPR treats many categories of information that might informally be referred to as “anonymized” in the US as merely “pseudonymized,” and thus still within the ambit of European regulators. All of which is to say, whether in the US or in Europe, it is important to scrutinize anonymization claims before making them public, as they are likely to remain a regulatory focus.

Federalism Rankles National Privacy Debate: California Weighs in on the proposed American Data Protection and Privacy Act

Tue, 09 Aug 2022 10:02:06 Z

As states have continued to debate and pass new comprehensive privacy statutes – such as those in Virginia and Colorado – a common refrain from business leaders is the need for a comprehensive federal privacy statute that will lessen the need to comply with a patchwork of state laws. Indeed, the absence of serious privacy protections at the federal level – something akin to PIPEDA in Canada or the GDPR in Europe – has long spurred states to act as online data gathering and brokering has grown and advanced well beyond what most extant federal law contemplates. But a recent meeting of the California Privacy Protection Agency (“CPPA”) – the state agency responsible for enforcing the California Privacy Rights Act of 2020 – suggests that at least some states may not be content to be mere forerunners to comprehensive national legislation.

The CPPA called a special meeting in late July to consider the American Data Protection and Privacy Act (“ADPPA”) that was advanced out of the Energy and Commerce Committee of the US House of Representatives. Agency staffers authored two memoranda for consideration that strongly opposed the current ADPPA draft because it would pre-empt many salient features of existing California law. In one sense, this is hardly surprising; the calls for uniformity and predictability that have led to momentum for the ADPPA necessarily seek to limit differences in state law, not preserve them. The issue was hotly debated in the Energy and Commerce Committee as California representatives called for the creation of a “federal floor” akin to that offered in the health information space by HIPAA – that is, a minimum federal standard that could be supplemented by more stringent state laws – rather than a uniform standard. But the amendment offered by the California delegation was not approved, at least for now, leading not only the CPPA but also California Governor Gavin Newsom publicly to opposed the ADPPA. Governor Newsom sent a letter to Energy and Commerce Committee Chairman Frank Pallone arguing that national legislation should “not undermine the state protections Californians already enjoy.”

While both the CPPA and Newsom phrased their opposition in terms of consumer protection, it is hard to consider the fraught state/federal privacy dynamic without also considering the privacy chaos unleashed by the Supreme Court's decision in Dobbs v. Jackson Women's Health Organization. Federal regulators have moved swiftly to use the government's primary existing tools – namely the Federal Trade Commission Act and HIPAA – to protect against or at least mitigate the effects of state laws that may attempt to gather data about individuals seeking, receiving, or providing reproductive health care. But California officials and those in other states also know that elections in 2024 and beyond could bring federal authorities with very different priorities when it comes to privacy. That knowledge is likely to continue to influence privacy debates in statehouses across the country.

SEC and DOJ Bring First-Ever Crypto Insider Trading Actions

Gross James M. — Tue, 02 Aug 2022 14:04:36 Z

This year had already seen an uptick in federal enforcement activity focused on digital assets with the expansion of the SEC's Crypto Assets and Cyber Unit (see our prior client alert on that expansion and its impact here) and the formation last year of the DOJ's National Cryptocurrency Enforcement Team. On July 21, 2022, the agencies executed on this enforcement priority by bringing the first-ever insider trading actions involving cryptocurrency.

The SEC action is one of the most noteworthy steps yet in the agency's expansion of its jurisdiction over digital assets, predicated on its view that many, if not most, cryptocurrencies qualify as “securities” under the federal securities laws. As we discuss below, however, it remains unclear whether the courts and Congress will endorse that view.

Similar Factual Allegations, Different Charges
The SEC and DOJ allege that Ishan Wahi, a former product manager at Coinbase—one of the largest crypto asset trading platforms in the United States with almost 100 million registered users—tipped his brother and a friend (the “tippees”) with confidential information about the planned listing of certain cryptocurrencies on Coinbase. The listing of a crypto asset on an exchange typically causes the market value of the asset to increase significantly. According to the government, Coinbase therefore treated that information as confidential and prohibited employees from sharing it with others.

The tippees allegedly purchased at least 25 crypto assets prior to 14 separate listing announcements between at least June 2021 and April 2022, and sold the assets shortly thereafter for profits totaling more than one million dollars. The government also alleges that the tippees sought to conceal their tracks by using accounts at exchanges held in the names of others, transferring funds and crypto assets through multiple anonymous Ethereum blockchain wallets, and regularly creating new Ethereum wallets with no prior transaction history. In addition, Wahi allegedly attempted to flee the U.S. after learning that Coinbase was investigating possible insider trading and after Coinbase's director of security instructed him to appear for a meeting about the listing process.

Of note, the SEC and DOJ brought insider trading charges on different legal theories. The SEC charged the defendants under the Securities and Exchange Act of 1934 (the “Exchange Act”), which prohibits fraud in connection with the purchase or sale of “securities.” Critically, the SEC contends that at least nine of the crypto assets should be classified as securities, and will be required to prove that assertion, in addition to the other elements of insider trading, in order to prevail on its charges. (Relatedly, the SEC is also reportedly investigating whether Coinbase itself violated the securities laws by listing these cryptocurrencies and thereby allowing the public trading of unregistered securities.)

The DOJ, however, did not charge the defendants with securities fraud under the Exchange Act, but rather, under the federal conspiracy and wire fraud statutes, which are not available to the SEC. Its indictment thus effectively sidesteps the question of whether cryptocurrencies are securities. The DOJ took a similar approach in June, when it brought its first digital asset insider trading case against a former product manager at a major online marketplace for the purchase and sale of non-fungible tokens, or NFTs, on wire fraud and money laundering charges.

Investment Contracts?
The DOJ's decision to pursue insider trading on a wire fraud theory may reflect a desire to avoid the often convoluted analysis that courts apply to determine whether an asset is a security. The SEC's jurisdictional argument is based upon the “Howey test,” as articulated in the 1946 Supreme Court case SEC v. W. J. Howey Co. That seminal case centered on the meaning of the term “investment contract” as used in the definition of “security” within the Securities Act of 1933. Howey held that an investment contract is defined as “a contract, transaction or scheme whereby a person invests his money in a common enterprise and is led to expect profits solely from the efforts of the promoter or a third party.” In reaching that conclusion, the Court emphasized that economic reality should control over the form of the asset when evaluating whether or not it qualifies as an investment contract, and thus, a security.

In the Wahi action, the SEC contends that at least some of the crypto assets at issue are a type of investment contract, because the issuers allegedly “solicited investors by touting the potential for profits to be earned from investing in these securities based on the efforts of others” through statements on the issuers' websites, social media, and in white papers. The issuers also allegedly emphasized both (i) “the ability for investors to resell these tokens in the secondary markets,” and, importantly, (ii) the issuers' “efforts to get their crypto asset securities listed on secondary trading platforms, and the critical role that executives and others at the company played in turning the company into a success, thereby increasing the value of the crypto asset security.”

This legal issue already has come to a head in the closely-watched SEC enforcement action against Ripple Labs in connection with the sale of its digital asset XRP, allegedly in violation of the registration requirements under the Securities Act. Ripple has mounted an aggressive defense in that case, which may yield needed guidance on the issue.

The regulatory uncertainty as to the status of crypto assets has caught the attention of some prominent lawmakers and regulators (and led Coinbase itself, on the same day that the SEC filed its complaint, to make a petition to the SEC requesting further rulemaking to clarify which digital assets are securities). Caroline Pham, a Republican member of the Commodity Futures Trading Commission, characterized the SEC's action as a “striking example of regulation by enforcement.” Senator Pat Toomey, a Republican ranking member of the Senate Banking Committee, similarly criticized the SEC for, in his view, failing to provide “regulatory clarity prior to enforcement.” (The SEC did issue guidance in 2019 explaining its “Framework for ‘Investment Contract' Analysis of Digital Assets,” though opinions differ as to whether that guidance is sufficient.) Moreover, a bipartisan bill introduced in the Senate last month would significantly curtail the SEC's jurisdiction over cryptocurrency, though Congress is unlikely to vote on the bill for at least the rest of 2022, according to one of the Senators who introduced it.

Regardless, the SEC has signaled that this will not be the last enforcement action on this front. In the agency's press release announcing the Coinbase action, Gurbir Grewal, the Director of the Enforcement Division, stated clearly that enforcement actions would continue “to ensure a level playing field for investors, regardless of the label placed on the securities involved.”

Takeaways
Because the DOJ, as a criminal law enforcement agency, has a higher burden of proof and therefore typically brings fewer insider trading cases than the SEC, a restriction of the SEC's jurisdiction over digital assets by the courts or Congress would likely limit future insider trading actions involving these assets. For the time being, however, the Wahi actions reflect the government's continuing prioritization of crypto enforcement and the remarkable expansion of the resources it has devoted to this space.

We expect that the government will continue to target individuals employed by issuers and exchanges as well as others who possess arguably market-moving information about cryptocurrency or other digital assets, and who tip or trade in breach of a duty of confidentiality to their employers or other source of the information, or trade on a tip with the knowledge of such a breach. Such individuals should therefore carefully consider the risk that the SEC or DOJ might view them as falling within this category before sharing information or trading. Issuers of digital assets and exchanges should also be mindful of the risk of secondary insider trading liability as control persons and/or aiders-and-abettors, and should ensure that their policies and procedures effectively address the misuse of material non-public information by employees and consultants.

We will continue to provide updates on the evolving crypto enforcement landscape.

Federal Agencies Issue Alert Regarding Maui Ransomware

Tue, 26 Jul 2022 14:38:18 Z

On July 7, 2022, three federal agencies – the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency, and the Department of the Treasury – issued a joint alert regarding Maui Ransomware, which has been linked to ransomware attacks on healthcare and public health entities carried out by North Korean state-sponsored cyber actors.

These are the key recommendations of the alert:

Since at least May 2021, the FBI has noted multiple ransomware incidents involving Maui ransomware in the healthcare and public health sector, targeting health records, diagnostics services, imaging services, and intranet services.
The agencies also encourage healthcare and public health entities to take steps to prepare for ransomware:
- Maintain offline backups and regularly test those backups.
- Create, maintain, and exercise cyber incident response plans and associated communications.
- Secure personally identifiable information and personal health information at collection points and encrypt that data at rest and in transit, in accordance with requirements under HIPAA.
- Monitor mobile devices and Internet of Things (“IoT”) or “smart” devices that are behaving erratically.
- Create and regularly review internal policies regarding the collection, storage, access, and monitoring of personally identifiable information and personal health information.
- Deploy public key infrastructure and digital certificates to authenticate connections with the network, IoT devices, and electronic health records systems.
Healthcare and public health entities are also encouraged to follow best practices for preventing ransomware:
- Secure and monitor remote desktop protocol and similar services.
- Implement user training around phishing and similar topics.
- Utilize multi-factor authentication, particularly for remote access, webmail, VPNs, critical systems, and systems that manage backups.
- Utilize strong passwords and avoid reusing passwords for multiple accounts.
- Require administrator credentials to install software.
- Audit user accounts with administrative or elevated privileges.
- Install and regularly update antivirus and anti-malware software.
- Avoid use of public wifi networks.
- Utilize an email banner to note messages originating outside of the organization.
- Disable hyperlinks in received emails.

The agencies discourage affected entities from paying ransoms associated with the Maui ransomware for two reasons: (1) doing so has not traditionally guaranteed recovery of affected data, and (2) pursuant to a September 2021 advisory from the Treasury Department, because of existing sanctions on North Korea, it is possible that paying ransoms may pose sanctions risks. Foley Hoag has issued two prior alerts on the sanctions risks posed by ransomware payments.

The agencies do, however, encourage all affected entities to report ransomware incidents to Federal authorities in order to assist the agencies with tracking, and responding to, these incidents.

Foley Hoag has comprehensive resources to help you protect against ransomware attacks, deal with an attack if you become a victim, and navigate potential sanctions risks:

If you are a business, protect yourself against ransomware attacks by ensuring that your cyber security policies are updated and actively carried out, and build compliance steps into your incident response plan. Foley Hoag's Cybersecurity Incident Response Team and the Privacy and Data Security Practice Group can advise on safeguarding company records, financial information, and other valuable information assets, and developing an effective incident response plan.
If you are a service provider, contact the Foley Hoag Cybersecurity Incident Response Team and White Collar Crime & Government Investigations practice group to avoid facilitating a sanctions violation by developing and implementing a risk-based compliance program. Financial service providers should also be aware that there are certain compliance requirements related to ransomware payments under Financial Crimes Enforcement Network (“FinCEN”) regulations.
If you are a victim, Foley Hoag's Cybersecurity Incident Response Team can help you navigate your legal obligations after being attacked. Foley Hoag's White Collar Crime & Government Investigations and Trade Sanctions & Export Controls practice group can advise on potential sanctions risks and assist with any communications with OFAC.

Anonymization v. De-Identification, Post-Dobbs; Rumblings from the FTC

Christopher Escobedo Hart — Mon, 18 Jul 2022 06:00:33 Z

When is personal data “anonymized”? The answer to this question has largely been based on jurisdiction. If your business is in the U.S., so long as HIPAA or the CCPA does not govern, then generally aggregated or de-identified data could often be considered “anonymized” for legal compliance purposes. (Both HIPAA and the CCPA have specific requirements for what counts as “de-identified” data.) Under the GDPR, the story has been much more complicated: merely “de-identified” data is not the same as “anonymous” data, and is still governed by the GDPR as “pseudonymous” data in many instances. The point, under the GDPR, is that if it’s still possible to combine or analyze that aggregated or de-identified data in such a way that allows for identification of an individual (which as a practical matter will almost always be the case), then it cannot be truly anonymous.

But businesses should be aware that, post-Dobbs v. Jackson Women’s Health Org. (overturning Roe v. Wade), the U.S. might look more like Europe where the differences between anonymization and de-identification are concerned. On July 11, 2022, Kristen Cohen, Acting Associate Director of the Federal Trade Commission’s (FTC) Division of Privacy & Identity Protection, wrote a blog post where she stated the following:

Claims that data is “anonymous” or “has been anonymized” are often deceptive. Companies may try to placate consumers' privacy concerns by claiming they anonymize or aggregate data. Firms making claims about anonymization should be on guard that these claims can be a deceptive trade practice and violate the FTC Act when untrue. Significant research has shown that “anonymized” data can often be re-identified, especially in the context of location data. One set of researchers demonstrated that, in some instances, it was possible to uniquely identify 95% of a dataset of 1.5 million individuals using four location points with timestamps. Companies that make false claims about anonymization can expect to hear from the FTC.

Cohen’s blog post, which does not mention Dobbs explicitly, comes on the heels of President Biden’s July 8 Executive Order “encourag[ing]” the FTC to “consider actions, as appropriate and consistent with applicable law, to protect consumers' privacy when seeking information about and provision of reproductive healthcare services.”

In the absence of a comprehensive federal data privacy statute, the FTC–through its Section 5 authority to enforce against unfair and deceptive acts and practices–acts as the country’s general privacy watchdog. While Cohen’s blog post is neither a rule nor formal guidance, it does signal that the FTC’s view of what counts (and does not count) as “anonymized” personal data appears to hew much closer to the GDPR’s strict view of anonymization.

From an enforcement perspective, the FTC’s primary concern has long been about what representations organizations make to consumers, and whether those representations are clear and accurate. The FTC here is not suggesting that businesses are prohibited from “merely” aggregating or de-identifying personal data. Rather, through Cohen’s post, the FTC is instead sending the message that businesses that only de-identify or aggregate personal data, but do not truly anonymize it, must be clear and honest with individuals about that fact. If companies state, through their privacy policies, that individual data is “anonymized,” when it is merely de-identified, they are opening themselves up to an enforcement action from the FTC (and perhaps state attorneys general, which also have broad consumer protection powers). The FTC appears to be particularly concerned with location-tracking data–a significant post-Dobbs privacy concern for pregnant individuals who might seek reproductive care across state borders.

As a practical matter, consider what you are doing with personal data that you might have considered “anonymized.” If there is any question about whether that personal data is in fact truly “anonymized,” review and edit your privacy representations accordingly.

Colorado Privacy Act: The Cannabis Industry Prepares for Enforcement

Fri, 17 Jun 2022 08:18:25 Z

As we wrote last year, Colorado is among the vanguard of privacy-focused states—including California, Washington, and Virginia—to adopt significant state-level privacy legislation. One year out from enforcement of the Colorado Privacy Act (which begins on July 1, 2023), businesses should begin to put their compliance frameworks in place, as some of the Colorado Privacy Act's significant requirements will need substantial investment beforehand to afford consumers the rights that they are guaranteed under the Act.

Sizeable businesses that are part of Colorado's over $2 billion cannabis market should take special note of the Act's requirements, as cannabis businesses with a significant retail component often manage large amounts of personal information in relation to customers. While many smaller operations are likely to be exempt—the Act does not apply unless the business either processes the data of 100,000 consumers yearly or engages in the sale of personal data while also processing the data of 25,000 customers—larger businesses should be planning now to comply with the Act. Notably, some businesses may be within the ambit of the Act even if they do not think of themselves as primarily being in the business of selling information, as the Act's broad definition of information selling includes receiving a discount on services in exchange for providing customer data, which is a common provision in many service agreements in the cannabis and other industries.

Notable too is the fact that many of the Act's most significant exemptions would not apply in the cannabis context. For example, like many state data privacy statutes, the Act exempts from its own jurisdiction categories of data that are otherwise regulated by several federal statutes, most significantly HIPAA. But because most cannabis businesses would not be considered covered entities under HIPAA, neither would they benefit from that exemption even though they may handle substantial amounts of patient data. The same businesses may also not have in place the mechanisms needed to comply with the suite of rights afforded under the Act—such as the rights to inspect and correct data—that would be de rigueur in a covered entity.

The Act's requirements go well beyond simply providing certain rights to customers and in theory apply to many aspects of a business's operations. The Act requires companies to limit collection to that necessary to achieve purposes that are clearly specified at the point of collection, as well as to limit secondary transfers of data and protect sensitive data (including the kind of health data that many medical providers would necessarily have). Similar to HIPAA and to the GDPR, companies are also required to conduct periodic data protection assessments if they undertake certain types of processing activities, including targeted advertising and processing of sensitive data (e.g., health data).

Multi-state operators in particular should remain attuned to privacy developments not only in Colorado, but in the sizeable group of states that are currently advancing significant privacy legislation. Many of these—such as New York, New Jersey, and Pennsylvania—already are or are projected to become significant markets for both medical and adult use cannabis, and are taking privacy issues seriously at the legislative level.

New Privacy Shield Framework in the Works, Favoring Continuity Over Change for Businesses

Fri, 13 May 2022 09:59:15 Z

President Biden and EU leaders announced on March 25, 2022 an agreement in principle to craft a replacement for the Privacy Shield and expand options for trans-Atlantic data transfers in accordance with the General Data Protection Regulation (“GDPR”).

Background

The GDPR requires that transfers of personal data of EU residents to countries outside of the EU must take place pursuant to an approved transfer mechanism, provided the recipient country has not received a decision by the European Commission that the its data protection laws are adequate. Various states – including Canada, Israel, Japan, South Korea, and the UK – are considered by the European Commission to have “adequate” data protection laws. Importantly, the United States has never received such a determination. Since the GDPR went into effect, the U.S.'s status has left few avenues for lawful transfers to the United States.When the GDPR came into force, most transfers took place pursuant either to Standard Contractual Clauses approved by the EU Commission, or to the Privacy Shield, a self-certification program where recipient companies would undertake certain responsibilities to protect the data they received.

Options have grown still more limited since July 2020, when the European Court of Justice invalidated the Privacy Shield as a legal transfer mechanism. It based its concerns on domestic surveillance by the U.S. government.

Meet the New Trans-Atlantic Data Privacy Framework, Same as the Old Trans-Atlantic Data Privacy Framework

Although the White House has released only an overview of the new framework, it appears to be aimed squarely at addressing the legal rationale for the invalidation of the Privacy Shield. The White House states that, under the new deal, “signals intelligence activities” – that is, the interception of electronic communications – carried out by the United States government with respect to EU personal data will be “necessary and proportionate in the pursuit of defined national security objectives,” and that the deal will “create a new mechanism for EU individuals to seek redress if they believe they are unlawfully targeted by signals intelligence activities.” In other words, the substantive crux of the deal is aimed at the U.S. government, not private entity data protection.

For private companies, early indications suggest that the new framework will require adherence to essentially the same Framework Principles that were used for compliance with the Privacy Shield, such as giving notice of data processing, giving individuals meaningful choices regarding their data, and remaining accountable for onward transfers of data. The White House has also suggested that the self-certification mechanism supervised by the U.S. Department of Commerce will continue to be used. In other words, after a two year hiatus, companies may find themselves picking up where they left off.

Seeking Counsel Ahead

Foley Hoag will continue to monitor the negotiations as they progress towards binding legal documents to be adopted both in the United States and the EU. Even at this early stage, though, companies can begin to prepare for the new regime by seeking counsel as to how to comply with the Privacy Shield Framework Principles upon the basis of existing Privacy Shield guidance.

How to Prevent and Respond to Business Email Compromises

Christopher Escobedo Hart — Mon, 02 May 2022 11:51:01 Z

Foley Hoag presented a discussion and Q&A regarding the growing threat of business email compromises (a.k.a. man-in-the-middle attacks). Attorneys Chris Hart and Yoni Bard, litigators with experience in privacy matters and business disputes, shared what they have learned through successfully representing victims of hacking and phishing attacks that have led companies to misdirect payments to unknown criminal actors. They discussed strategies for preventing these attacks and, if they occur, maximizing the likelihood of recovery through rapid response strategies (involving law enforcement and banks), forensic investigation, and litigation with your counterparty.

Download presentation materials here.

Speakers:

Christopher Hart, Partner, Co-Chair, Privacy & Data Security Practice
Yoni Bard, Associate

Key Considerations for Health App Developers from the FTC

Zick Colin J. — Mon, 25 Apr 2022 22:37:22 Z

If your company creates health-related apps, the Federal Trade Commission (FTC) has set out some key considerations:

Make accurate representations. Clearly explain how people's information will be used and shared and then live up to those promises. If your company has deployed apps to read credentials at storefronts, ensure that those businesses understand your practices and the limits on how they may use the data you share.
Keep your app updated and your customers in the loop. If your app needs to be updated to protect against new security vulnerabilities, follow through and do just that. And if a customer needs to update information on file to continue to use your app, communicate that clearly.
Review and update your privacy claims. Companies are creating apps that may evolve over time to share new or different information, particularly as they relate to public health developments. If your privacy claims don't keep pace with changes to your data practices, consumers could be misled.
Minimize the data that is shared. When verifying a consumer's vaccination status, it may be sufficient to communicate their status to another entity without sharing the person's name, date of birth, email address, type of vaccine, etc. That principle applies equally to other health-related apps.
Protect the data you use for verification. If your app transmits sensitive data to verify a person's status, use transit encryption. People using those apps (or other health apps) commonly rely on open Wi-Fi access points at coffee shops, airports, and other locations where it's easy for info thieves to intercept data. If your app stores information on a phone, consider protecting or obscuring the data. This helps protect users in the event of viruses (the digital kind), malware, or a lost device.
Apply the lessons of the pandemic as you develop new health-related apps. Health apps are here to stay. But before your company rushes to market with a new product, train your team to prioritize best practices for secure development. If you Start with Security – and keep it Job #1 as you design, develop, and test – you can reduce the risk of rolling out a product with a fatal flaw. Another important resource: NIST's Secure Software Development Framework (SSDF).
Before your product goes live, verify that it works as advertised and that security measures are operational. One unskippable step: testing your product to ensure it's not susceptible to common security vulnerabilities.
If you're dealing with health data or kids' data, understand applicable standards and regulations. Additional legal provisions may apply when health information and kids' information is involved. Seek guidance on the Children's Online Privacy Protection Act and the COPPA Rule, the Health Insurance Portability and Accountability Act (HIPAA), the Health Breach Notification Rule, and other relevant laws.Does your business, nonprofit, or other group check people's vaccine status?
Research the marketplace. If you decide to use an app or other technology to assist in performing health-related functions, exercise the utmost care in selecting service providers. Investigate the companies, learn more about their software, and ask questions about their privacy and data security practices. What information will they be sharing with you? What information will an app be collecting from you, your customers, or your employees? Are the representations you make to others consistent with your service provider's practices.
Provide a secure environment. If you do use technology to collect personal information, do you have a secure network through which the information is transmitted? And if you must maintain information, can you store it securely?
If you need to maintain information about a person's health status, consider how long you have to retain it. Once you no longer have a legitimate need for someone's vaccine status or other health-related information, dispose of it securely. Why collect or keep data you don't need?

CISA, FBI, and DOE Release Joint Cybersecurity Advisory in Light of Increased Threats to Energy Sector's Cybersecurity

Holahan Carol J. — Thu, 21 Apr 2022 15:57:48 Z

On March 24, 2022, the Department of Justice unsealed two indictments charging four Russian government employees in two hacking campaigns that targeted critical infrastructure in the energy sector. We cover these indictments in depth here. Concurrently, the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Department of Energy (DOE) jointly published a Cybersecurity Advisory (CSA) relating to the hacks.

The CSA, titled “Tactics, Techniques, and Procedures of Indicted State-Sponsored Russian Cyber Actors Targeting the Energy Sector,” details the campaigns conducted by state-sponsored Russian actors, outlines the techniques, tactics, and procedures used by the hackers, and provides a variety of mitigation strategies for energy sector entities to protect their own networks from similar attacks.

This CSA was released just days after the FBI issued an advisory to US businesses, warning that hackers associated with Russian internet addresses had been scanning the networks of five US-based energy sector companies, potentially in advance of initiating hacking defenses, as well as a warning from President Biden that Russian-linked hackers may target US organizations as part of its continued attack against Ukraine and in light of the sanctions imposed on Russia.

As pressure on Russia mounts, experts expect the energy sector to remain particularly vulnerable to attack—and anticipate that the US government will continue to urge business leaders to strengthen cybersecurity to protect against such attacks.

The key points in the CSA and highlight the mitigation tactics that CISA, FBI, and DOE recommend in light of these threats are summarized below.

Techniques, Tactics, and Procedures of Hackers Targeting the Energy Sector

The CSA describes the technical details of both the Global Energy Sector Intrusion Campaign and the compromise of a Middle East-based energy sector organization.

The Global Energy Sector Intrusion Campaign took place from at least 2011 through 2018, in which the Russian Federal Security Service (FSB) conducted a multi-stage campaign and gained remote access to numerous US and international energy sector networks, deployed malware that attacked infrastructure control systems (ICS), and collected and exfiltrated enterprise and ICS-related data. This campaign included use of:

Spear phishing emails (emails claiming to be from a known or trusted sender to induce a targeted individual to reveal confidential information);
Watering hole tactics (infecting websites that actors in a specific industry commonly visit to lure users to a malicious site, infect the user's computer, and gain access to the network); and
Supply chain attacks (when a cyber-threat actor infiltrates a software vendor's network and employs malicious code to compromise the software before it is sent to the customer).

Together, these three types of tactics were used to harvest energy sector credentials, gain access to the networks, and collect and exfiltrate information about the enterprise, ICS, and operational technology (OT) environments.

These tactics highlight several common tools used by hackers to access energy sectors' networks and disrupt or damage critical infrastructure. The CSA then provided several recommendations to prevent and mitigate future cyber-attacks.

Mitigation Recommendations

The CSA recommends a variety of mitigation measure entities can take related to enterprise environment and ICS environment. Three key actions are highlighted at the top of the CSA as actions energy sector entities should take today to protect their networks:

Implement and ensure robust network segmentation between IT and ICS networks;
Enforce multifactor authentication (MFA) to authenticate a system; and
Manage the creation, modification, and use, as well as the permissions associated with, privileged accounts.

The CSA also offered addition actions for entities looking to impose additional layers of protections.

The CSA also includes mitigations measure to harden ICS and OT environments, including:

Network segmentation mitigations, such as:
- Implementing and ensuring robust network segmentation between IT and ICS networks;
- Implementing a network topology for ICS that has multiple layers;
- Using one-way communication diodes to prevent external access, whenever possible;
- Setting up demilitarized zones (DMZs) to create a physical and logical subnetwork;
- Employing reliable network security protocols and services where feasible;
- Using virtual local area networks (VLANs) for additional network segmentation,
- Implementing perimeter security between network segments;
- Controlling traffic between network segments by using firewalls, intrusion detection systems (IDSs), and rules for filtering traffic on routers and switches
- Implement network monitoring at key chokepoints;
- Configuring an IDS to create alarms for any ICS traffic outside normal operations;
- Configuring security incident and event monitoring to monitor, analyze, and correlate event logs from across the ICS network to identify intrusion attempts.

Employing ICS Best Practices, including:
- Updating all software;
- Testing all patches in out-of-band testing environments;
- Implementing application allow listing on human machine interfaces and engineering workstations;
- Hardening software configuration on field devices;
- Replacing all end-of-life software and hardware devices;
- Disabling unused ports and services on ICS devices;
- Restricting and managing remote access software;
- Configuring encryption and security for network protocols;
- Disallowing vendors to connect their devices to the ICS network;
- Disallowing any devices that do not live solely on the ICS environment from communicating on the platform;
- Maintaining an ICS asset inventory of all hardware, software, and supporting infrastructure technologies;
- Maintaining robust host logging on critical devices within the ICS environment;
- Ensuring robust physical security is in place; and
- Regularly testing manual controls.

***

While cyber threats to this sector are nothing new, the mounting pressure on Russia has already resulted in an increase in attacks, and outdated cyber infrastructure continues to leave the energy sector highly vulnerable. This CSA provides timely and useful recommendations for how to mitigate these vulnerabilities, but getting this infrastructure up to snuff in the face of increasingly sophisticated hackers will be no easy task. As a result, the industry should buckle up and get ready for a rocky road ahead.

US Unseals Indictments of Four Russian Government Employees in Connection with Cyber Attacks on Energy Sector

Holahan Carol J. — Thu, 21 Apr 2022 15:56:12 Z

The United States Department of Justice unsealed two indictments in March involving four Russian government employees who have been charged in connection with two separate hacking conspiracies targeting the global energy sector. These campaigns took place between 2012 and 2018 and affected thousands of computers, hundreds of organizations, and approximately 135 countries.

These indictments were unsealed just days after President Joe Biden publicly warned US business executives that Russia is exploring using cyberattacks as part of its offensive strategy during its continued attacks on Ukraine. Biden warned that the private sector needed to strengthen its cyber defenses, and that Russia's capacity to deploy cyberattacks is “fairly consequential, and it's coming.”

These unsealed indictments underscore the President's somber message. U.S. companies—particularly energy sector companies—must turn their attention to investing even more in their cyber infrastructure.

Below, we break down the indictments and highlight some of the tactics allegedly used by the Russian-backed hackers.

The Indictments

(1) S. v. Gladkikh

The first of these indictments, United States v. Evgeny Viktorovich Gladkikh, relates to the Compromise of a Middle East-based energy sector organization. In connection with this campaign, an employee of the Russian Ministry Defense research institute allegedly attempted to damage critical energy infrastructure outside of the US, which resulted in two separate emergency shutdowns at the targeted facility. The conspirators additionally attempted to hack the computers of a US company managing similar critical energy.

The indictment alleges that Gladkikh was an employee of the State Research Center of the Russian Federal FGUP Central Scientific Research Institute of Chemistry and Mechanics' (“Research Center”) Applied Developments Center (“ADC”). The Research Center has identified itself as the Russian Ministry of Defense's leading research organization, and ADC has stated that it engaged in research regarding information technology-related threats to critical infrastructure—an attempt to suggest its research was defensive in nature and focused on protecting Russia from threats, and not offensive in nature as these hacks would be considered.

According to the indictment, however, Gladkikh's role was to hack industrial control systems and operational technology of global energy facilities to enable future attacks and damage. Gladkikh is accused of hacking a foreign refinery to install malware that would prevent its safety systems from operating. Luckily, the installation of the malware led to a fault that initiated two automatic emergency shutdowns, preventing any major harm. Gladkikh has been charged with one count of conspiracy to cause damage to an energy facility (which carries a maximum sentence of 20 years in prison), one count of attempt to cause damage to an energy facility (also carrying a maximum sentence of 20 years), and one count of conspiracy to commit computer fraud (carrying a maximum sentence of five years).

(2) S. v. Akulov

The other indictment, United States v. Pavel Aleksandrovich Akulov, et al., relates to the Global Energy Sector Intrusion Campaign, which occurred from approximately 2011 through 2018 and targeted US and international energy sector networks. This compromise included a two-phased campaign to disrupt energy sector entities. The indictment involves three officers of Russia's Federal Security Service. These hackers, along with their co-conspirators, allegedly targeted and compromised the computers of hundreds of energy-sector entities across the globe. The hack enabled the conspirators to access the computers and disrupt and damage those computers at a later time of their choosing. The co-conspirators targeted a variety of organizations in the energy sector, including oil and gas firms, nuclear power plants, and utility and power transmission companies.

As the first phase of this campaign, the conspirators engaged in supply chain attacks, compromising computer networks for industrial control system manufacturers and software providers to hide malware inside of legitimate software updates for these systems. Unsuspecting customers would then download the software updates along with the malware, which created backdoors into a now-infected system, giving the hackers access to those systems. This malware was installed onto more than 17,000 unique devices in the U.S. and abroad.

The second phase of this campaign included more targeted compromises focused on specific energy sector entities and individuals, including engineers working on industrial control systems. This phase targeted more than 3,300 users at over 500 companies and entities, as well as U.S. government agencies. The hackers used tactics including spear phishing (i.e., sending emails that appear to be from a known or trusted sender to induce a target to reveal confidential information) and watering hole attacks (i.e., infecting a website typically used by workers within a specific industry and luring them to a malicious site) for both phases of this campaign.

The three Federal Security Service employees, along with their co-conspirators, are charged with conspiracy to cause damage to the property of an energy facility and commit computer fraud and abuse (carrying a maximum sentence of five years) and conspiracy to commit wire fraud (carrying a maximum sentence of 20 years). Two of the employees are also charged with substantive counts of wire fraud and computer fraud (carrying a maximum sentence ranging from five to 20 years) and three counts of aggravated identity theft (each count carrying a minimum sentence of two years).

***

Concerns about cyber threats to the energy sector continue to grow, and rightfully so, especially as sanctions and other measures are aimed at Russia in light of its military campaign against Ukraine. The two indictments discussed above show the profound impact these types of hacks can have, and the sophistication of the state-sponsored hackers who are targeting energy infrastructure.

In our next post, we will dive into the Cybersecurity Advisory released jointly by the Cybersecurity and Infrastructure Security Agency, the Federal Bureau of Investigation, and the Department of Energy, which was published concurrently with the DOJ's unsealing of the indictments.

US, UK, Australia, Canada and New Zealand Issue Advisory on Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure

Zick Colin J. — Thu, 21 Apr 2022 10:46:55 Z

The cybersecurity authorities of the United States, Australia, Canada, New Zealand, and the United Kingdom have released a joint Cybersecurity Advisory (CSA) to warn organizations that Russia's invasion of Ukraine could expose organizations both within and beyond the region to increased malicious cyber activity from Russian state-sponsored cyber actors or Russian-aligned cybercrime groups.

Joint CSA: Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure, drafted with contributions from industry members of the Joint Cyber Defense Collaborative, provides an overview of Russian state-sponsored advanced persistent threat groups, Russian-aligned cyber threat groups, and Russian-aligned cybercrime groups to help the cybersecurity community protect against possible cyber threats.

U.S., Australian, Canadian, New Zealand, and UK cybersecurity authorities urge critical infrastructure network defenders to prepare for and mitigate potential cyber threats by hardening their cyber defenses as recommended in the joint CSA.

According to the Advisory, cyber threat actors from the following Russian government and military organizations have conducted malicious cyber operations against IT and/or OT networks:

The Russian Federal Security Service (FSB), including FSB's Center 16 and Center 18
Russian Foreign Intelligence Service (SVR)
Russian General Staff Main Intelligence Directorate (GRU), 85th Main Special Service Center (GTsSS)
GRU's Main Center for Special Technologies (GTsST)
Russian Ministry of Defense, Central Scientific Institute of Chemistry and Mechanics (TsNIIKhM)

A Comprehensive Privacy Law May Be Heading for Massachusetts, And Businesses Should Prepare (originally on the MassTLC Blog)

Christopher Escobedo Hart — Wed, 16 Mar 2022 12:38:06 Z

Eds. Note: This post was originally published on the MassTLC Blog.

Get ready: there's a good chance that comprehensive data privacy legislation is coming to the Commonwealth. If your business is not already compliant with the European Union's or UK's General Data Protection Regulation (GDPR), or the California Consumer Privacy Act (CCPA), then you might have some work to do.

Proposals for general data protection legislation are not new to Massachusetts; but, following global and national trends, the current iteration being entertained at the State House (sponsored by the Joint Committee on Advanced Information Technology, the Internet and Cybersecurity) has momentum and a good chance of making it to a floor vote, at least as of this writing.

For those entities that are already GDPR and, to some extent, CCPA compliant, the provisions of the proposed legislation are largely familiar. But for entities that have had the luck or luxury of avoiding the need to comply with such comprehensive laws, the Massachusetts Information Privacy and Security Act (MIPSA) may be something of a shock to the system. As entities doing business in Massachusetts know, while the Commonwealth maintains a robust law concerning data breach notification, and a first-of-its-kind statewide data security regulation, these are ultimately very narrow laws. The data breach law only applies in the event of a data breach; the Massachusetts regulations apply if an entity processes information of a Massachusetts resident, but the information that triggers the regulation is limited to the kind of information likely to lead to identity theft if stolen (such as Social Security numbers and bank account information).

MIPSA is something different, and assuming it applies (there are scope thresholds in the current bill), it will require entities to create comprehensive data governance plans that go far beyond limited security measure and potential breach notification. It also appears more robust than two other recent comprehensive state privacy laws, passed in Virginia and Colorado and coming into effect in 2023.

The following outlines some of what the bill covers and discusses some possible implications.

1. Scope. The bill borrows from both the CCPA and the GDPR in its scope of application. If an entity does business in the Commonwealth the law will apply, even if the entity is not located in the Commonwealth, so long as the entity is offering goods or services to, or monitoring the behavior of, residents of the Commonwealth. However, the law will only apply to such an entity if it has annual global revenues exceeding $25M per year; determines the processing of at least 100,000 individuals; or is a data broker.

While the territorial scope is broad, the law is crafted to exclude smaller entities that might not have the resources to implement comprehensive data governance or compliance protocols.

2. Personal Information

Following an important global trend, the law defines personal information broadly, to include any information that “identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an identified or identifiable individual.” This broad definition (which excludes de-identified or publicly available information) is meant to sweep information that goes far beyond Social Security numbers and bank account numbers, but can include cookies, IP addresses, or purchase orders combined with other information that could lead to a person being identified.

3. Sensitive Information

Also following recent trends, the bill identifies eight categories of personal information as “sensitive,” thus requiring special protection in various circumstances. These eight categories include

Racial, ethnic, religious, or citizenship and immigration information;
Biometric information;
Mental or physical diagnoses or treatments;
Sex life or sexual orientation;
Specific geolocation information;
Information from a child (defined as a minor under the age of 13);
Philosophical beliefs and union membership; and
Social Security number and financial account information

4. Controllers and Processors

The bill carves the world up into “controllers” and “processors,” as does the GDPR and as is the trend in global data protection laws. Controllers are the entities that direct the processing of information. Processors are the entities that process information (that is, store, transmit, analyze, or otherwise use personal information) based on the controller's instructions. Entities can be controllers without ever storing or even viewing personal information. Based on the kind of entity one is (and one can be both at the same time for any given data set), different obligations will apply.

5. Lawful Basis for Processing

Like the GDPR, but unlike the CCPA, MIPSA is not a mere notice statute. Entities are not allowed to process information merely by providing notice. Instead, they must have a lawful basis to process personal information. That lawful basis can be based on consent, contract, or legitimate or vital interests, among other things.

While mere notice does not necessarily provide a lawful basis to process, notice must nevertheless be provided at or before the collection of personal information and must state what information is being collected, why it is being collected, who it is being shared with, and for how long it is being processed, among other things. To the extent companies rely on a privacy policy for notice, simply providing notice will not be sufficient to obtain consent; the individual must affirmatively agree, and the terms of that agreement must be specific to the processing at issue, not general.

6. Privacy rights

Under MIPSA, individuals have affirmative privacy rights that entities must, with certain exceptions, honor. Those include the right to notice, deletion, portability of their personal data, access to and knowledge of what personal information is being processed about them, correction of personal information, the ability to place limitations on the use and disclosure of sensitive data, and the ability to opt out of the sale of their personal data (discussed further below).

7. Sale

Similar to the CCPA, the “sale” of information includes any kind of sharing or disclosure of personal information to a third party (one that is not a service provider), which is done for some kind of compensation. If entities sell information, they must give individuals the right to opt-out of such sale and may not discriminate against individuals who choose to do so.

8. Risk Assessments

If an entity believes that certain data processing poses a “high risk of harm” to an individual, then the entity must carry out a risk assessment before any processing takes place. The requirement to carry out such an assessment includes if the processing will involve sensitive information, the sale of personal information, or “a systematic and extensive evaluation of personal aspects relating to individuals that is based on automated processing,” in most circumstances. The assessment must then lead to the implementation of processes sufficient to mitigate such risks. Importantly, the Attorney General has the right to have any risk assessment disclosed to it pursuant to a civil investigative demand (which functions like a subpoena).

9. Data Brokers

Similar to legislation first introduced in Vermont and later recapitulated in California, “data brokers,” or entities that buy and sell data (whether or not they have a personal relationship with the individual, something unique to MIPSA) must register their status as a data broker with the Commonwealth. Data Brokers must allow individuals to exercise their right to opt out of the sale of their personal information and to limit the use and disclosure of sensitive information.

10. Right of Action

Individuals have a private right of action in the event of a data breach. The Attorney General maintains broad and comprehensive enforcement power relating to the bill's provisions.

11. Harmonization

As a matter of interpretation, the bill allows entities that are in compliance with more stringent data protection laws to claim reliance on those laws in the event of a conflict.

12. Data Breach Amendments

The bill aims to amend the Massachusetts Data Breach statute to expand the meaning of personal information encompassed by that statute, and to change the responsible entities to “controllers” and “processors,” among other things.

This is a summary; it merely scratches the surface of significant provisions within the bill, which contains much more by way of substance and nuance. While there is still plenty of time for the bill to be amended, if passed in this form or close to it, the law would be the most comprehensive and robust data protection law in the United States.

As a practical matter, for entities already in compliance with the GDPR and CCPA, there may be little to do to be in compliance with MIPSA. For those entities that are not, if the law passes, there will be quite a bit of preparation to do to come into compliance, including building the internal resources necessary to carry out and maintain such comprehensive data protection measures.

Potential Board Liability for Cybersecurity Failures Under Caremark Law

Rizkallah Leah S. — Wed, 23 Feb 2022 17:41:41 Z

Blog contributor Leah Rizkallah recently wrote an article for CPO Magazine, available here, about how cybersecurity is a critical risk-area for companies across industries and boards of directors must be vigilant in overseeing their companies' cybersecurity efforts.

Preparing for and Mitigating Foreign Influence Operations Targeting Critical Infrastructure (i.e., Dealing with the Fallout from Russias Invasion of Ukraine)

Zick Colin J. — Tue, 22 Feb 2022 17:37:41 Z

The Cybersecurity & Infrastructure Security Agency (“CISA”) has just released CISA Insights: Preparing for and Mitigating Foreign Influence Operations Targeting Critical Infrastructure, which provides proactive steps organizations can take to assess and mitigate risks from information manipulation. Malicious actors (i.e., Russia) may use tactics—such as misinformation, disinformation, and malinformation—to shape public opinion, undermine trust, and amplify division, which can lead to impacts to critical functions and services across multiple sectors. Current social factors—including heightened polarization and the ongoing global pandemic—increase the risk and potency of influence operations to U.S. critical infrastructure. CISA encourages leaders at all organizations to review the CISA Insights and follow the guidance to assess risk and increase resilience.

What can you do? CISA suggests:

Assess the current information environment
Identify your vulnerabilities
Fortify your own communication channels
Engage in proactive communications
Develop (or revisit) your incident response plan.

CISA also suggests adopting the TRUST model for incident response, to help reduce risk and protect stakeholders:

Tell your story
Ready your team
Understand and assess
Strategize your response
Track the outcomes.

Or, as the lyrics of Lin-Manuel Miranda in Hamilton remind us, “who tells your story” truly matters.

The proposed Massachusetts Information Privacy and Security Act: Will This Be the Year Massachusetts Finally Updates Its Consumer Privacy Laws?

Zick Colin J. — Sun, 06 Feb 2022 12:44:59 Z

Since Massachusetts becoming a trailblazer among states with the passage of privacy legislation in 2007 and subsequent regulations, Massachusetts’ own privacy laws have been passed by those of other states, most notably California. The proposed Massachusetts Information Privacy and Security Act (“MIPSA”) would bring Massachusetts back to the forefront of state regulation of privacy and data security.

The 65 page long bill would, among other things, give Massachusetts residents the right to opt out of having their personal information sold and having advertising targeted to them, and would create a right to limit how companies can use and share things like location data, biometric data and racial data, the committee said. Opt-in consent would be required to sell the personal information of people 16 or younger. Massachusetts residents would also get the right to access, delete, correct or transport personal information that companies collect and maintain about them.

Many of the bill’s requirements on businesses would apply only if an entity either has global revenue of at least $25 million per year, processes personal information of at least 100,000 Massachusetts residents, or is a data broker that collects and sells sensitive or personal information of at least 10,000 Massachusetts residents. Massachusetts business should not panic, as they will have time to come into compliance: as currently written, the law would not go into effect until 18 months after its passage.

And the bill is far from becoming law: it still needs to clear additional committees, and both branches of the Legislature, and then be signed by Governor Baker. But after many years of moving back in the pack, it looks like Massachusetts is trying to regain its place as leader in privacy and security regulation.

U.S. Department of Homeland Security Launches First-Ever Cyber Safety Review Board

Zick Colin J. — Sat, 05 Feb 2022 16:57:49 Z

Earlier this week, the U.S. Department of Homeland Security (DHS) announced the establishment of the Cyber Safety Review Board (CSRB), as directed in President Biden's Executive Order 14028 on Improving the Nation's Cybersecurity. The CSRB is a public-private initiative that will bring together government and industry leaders to elevate U.S. cybersecurity.

The CSRB will review and assess significant cybersecurity events, so that government, industry, and the broader security community can better protect our nation's networks and infrastructure. The CSRB's first review will focus on the vulnerabilities discovered in late 2021 in the widely used log4j software library. These vulnerabilities, which are being exploited by a growing set of threat actors, present an urgent challenge to network defenders. As one of the most serious vulnerabilities discovered in recent years, its examination will generate many lessons learned for the cybersecurity community. The White House and DHS determined that focusing on this vulnerability and its associated remediation process was the most important first use of the CSRB's expertise.

The CSRB is composed of 15 cybersecurity leaders from the federal government and the private sector. Robert Silvers, DHS Under Secretary for Policy, will serve as Chair, and Heather Adkins, Google's Senior Director for Security Engineering, will serve as Deputy Chair. DHS's Cybersecurity and Infrastructure Security Agency (CISA) will manage, support, and fund the Board with CISA Director Jen Easterly responsible for appointing CSRB members, in consultation with DHS Under Secretary for Policy Rob Silvers, and for convening the Board following significant cybersecurity events. The other CSRB members are:

Dmitri Alperovitch, Co-Founder and Chairman, Silverado Policy Accelerator; Co-Founder and former CTO, CrowdStrike, Inc.
John Carlin, Principal Associate Deputy Attorney General, Department of Justice
Chris DeRusha, Federal Chief Information Security Officer, Office of Management and Budget
Chris Inglis, National Cyber Director, Office of the National Cyber Director
Rob Joyce, Director of Cybersecurity, National Security Agency
Katie Moussouris, Founder and CEO, Luta Security
David Mussington, Executive Assistant Director for Infrastructure Security, CISA
Chris Novak, Co-Founder and Managing Director, Verizon Threat Research Advisory Center
Tony Sager, Senior Vice President and Chief Evangelist, Center for Internet Security
John Sherman, Chief Information Officer, Department of Defense
Bryan Vorndran, Assistant Director, Cyber Division, Federal Bureau of Investigation
Kemba Walden, Assistant General Counsel, Digital Crimes Unit, Microsoft
Wendi Whitmore, Senior Vice President, Unit 42, Palo Alto Networks

The CSRB's first report, which will be delivered this summer, will include the following:

a review and assessment of vulnerabilities associated with the Log4j software library, associated threat activity and known impacts, as well as actions taken by both the government and the private sector to mitigate the impact of such vulnerabilities;
recommendations for addressing any ongoing vulnerabilities and threat activity; and,
recommendations for improving cybersecurity and incident response practices and policy based on lessons learned from the Log4j vulnerability.

Cybersecurity 2022 – The Year in Preview: Continued Threats to Nation's Energy Supply as Regulators Race to Keep Up

Wed, 02 Feb 2022 07:43:24 Z

Continued Threats of Ransomware Attacks

As we reported in our 2021 Year in Preview series, we began 2021 anticipating that ransomware would be a serious threat to critical energy infrastructure. These concerns were realized in May 2021 when the Colonial Pipeline Company's (“Colonial”) entire 5,500-mile pipeline system carrying liquid fuels was shut down due to a ransomware attack by DarkSide, a hacking group that allegedly has loose ties to the Russian government.

Colonial is far from the only business that has experienced a cyberattack this year—media reports indicate that the energy sector was in the top five most attacked industries in 2021, and at least a quarter of big energy companies are highly susceptible to ransomware attacks. Experts have classified these threats as substantial and growing, and requiring strong action in the face of increasingly sophisticated and destructive hackers.

The attack on Colonial was conducted by exploiting compromised credentials in Colonial's system, allowing the hackers to access the network. Other attacks have also used this method, as well as through fraudulent domains sent via phishing emails, and by taking advantage of weak email security, allowing hackers to gain access to secure information.

Outdated, unsecured networks and accounts will continue to create a vulnerability for the energy sector in 2022 until these systems are updated. The industry will also need to focus on training employees to identify phishing emails to protect sensitive data. And, perhaps most importantly, the industry is in need of clear, centralized leadership on how to navigate this serious and growing threat.

Threats to Gas and Oil

The Biden Administration released both an Executive Order and a Memorandum to improve cybersecurity. However, neither directly addressed the challenges the energy sector faces. The Executive Order was in the works prior to the attack on Colonial and did not address ransomware attacks and only applies to the federal government and federal government contractors and suppliers, not private sector actors. The Memorandum, which came several months after the Colonial attack, did not address the segmented and incomplete oversight of cybersecurity concerns at the federal level, particularly with respect to the energy sector, leaving the industry without strong leadership on this issue.

The Transportation Security Administration (“TSA”), which oversees U.S. gas and oil pipelines, has taken some steps to fill this leadership void, releasing two Security Directives after the Colonial attack. Prior to the attack, TSA's oversight was primarily focused on physical security, and TSA had only released voluntary guidelines regarding cybersecurity. The initial directive was released in the wake of the ransomware attack and required pipeline operators to report attacks, to designate a cybersecurity coordinator to act as the primary contact for cyber-related activities, and to review and assess current cyber practices. The second directive came several months later and seems to have been far more comprehensive. The directive itself has been deemed sensitive and not released to the public, but the press release indicated that pipeline operators will be required to implement specific mitigation measures against ransomware attacks and other known threats, develop and implement a cybersecurity contingency and recovery plan, and conduct a cybersecurity architecture design review.

However, these directives were implemented without comment from stakeholders or the public, and were not implemented through the formal rulemaking process, which may make them vulnerable to challenge in the long run.

Threats to the Bulk Power System

Unlike oil and gas pipelines, the bulk power system–the large, interconnected electrical system including generation and transmission facilities–is overseen by the Federal Energy Regulatory Commission (“FERC”) and complies with standards set by the North American Electric Reliability Corporation (“NERC”). NERC has issued comprehensive cybersecurity standards for the industry. In the past few years, FERC has also taken action to invest in cybersecurity, issuing a White Paper on cybersecurity in 2020 and updated standards in 2021.

At the end of 2021, FERCs cybersecurity practices audit of electrical grid operators indicated that most operators are largely compliant with required cyber measures. However, the report indicated that, there are numerous practices that are not required that would improve security—highlighting that the existing standards do not comprehensively protect bulk power operators from cyber threats. For the coming year, FERC's audit report recommended enhancing policies and procedures around cybersecurity to address these vulnerabilities.

***

Throughout 2022, we expect to continue to see emphasis on cybersecurity policy for this industry. Cyber threats continue to grow for energy companies and, as we have seen with Colonial, attacks have far-reaching and potentially devastating impacts for the country. The implementation of formal rules for gas and oil pipelines and the expansion of required rules for electric grid operators will be crucial to protect our access to reliable energy.

Cybersecurity 2022 – The Year in Preview: Privacy Regulations at the FTC

Wed, 02 Feb 2022 07:38:48 Z

As we think about what 2022 may hold with regard to privacy and data security regulation by the Federal Trade Commission (FTC), we should first look back at some of the developments from last year that set the stage for this year. Just like 2021, it appears that the regulatory culture at the FTC this year will be heavily entangled with the political environment. Recent events suggest that while privacy and data security related reforms previously enjoyed bipartisan support, there are limits to that bipartisanship and not everyone agrees on the FTC's role in crafting new privacy and data security regulations. One thing that remains to be seen is will the partisan disagreements derail the FTC's efforts to draft new regulations or will the FTC press ahead anyway.

The Politics of Filling the Fifth Seat

To start the new year, President Biden renewed his nomination of Alvaro Bedoya, founding Director of the Center on Privacy & Technology at Georgetown Law School, to fill the vacancy at the FTC created by Rohit Chopra's departure last year to take over as Director of the Consumer Financial Protection Bureau. The nomination had to be renewed because it hit an unexpected delay at the end of last year in the Senate Commerce Committee, when what many expected to be an unremarkable vote, instead turned out to be a party line vote with all of the Republicans voting against Bedoya's nomination.

Earlier in the year, during Bedoya's confirmation hearing, only a handful of Republicans expressed concern over his nomination and most Senators appeared content with Bedoya's privacy expertise. Among those who expressed concern at the hearing was Sen. Ted Cruz (R-TX) who criticized Bedoya for tweets that Cruz insisted show Bedoya to be “a left-wing activist, a provocateur, a bomb thrower, and an extremist.” Despite these accusations, Bedoya repeatedly expressed his support for collaboration and highlighted his previous bipartisan successes as a Senate staffer, but that was apparently insufficient in assuaging the concerns because no Republicans voted in favor of confirmation and the committee deadlocked at 14-14.

After the vote, the Committee's ranking member, Sen. Roger Wicker (R-MS), echoed Sen. Cruz's concerns when he summed up the opposition to Bedoya by stating that there “has been a troubling trend of politicization at the FTC, which is different from how it has been in previous years.” Sen. Wicker went on to express a concern that Bedoya may not bring “the cooperative spirit to the commission” that has historically set the FTC apart from other agencies.

The deadlocked vote is even more remarkable when considering that Chair Khan, who has since become a source of controversy during her tenure at the FTC, was voted out of the same committee and confirmed by the full Senate earlier this year with significant Republican support. (Only four Republicans on the Commerce Committee voted against sending her nomination to the full Senate and 22 Republicans ultimately voted in favor of her confirmation.) However, now that Bedoya's nomination has been renewed and despite a delay caused by the need for an extra procedural vote to clear the full Senate, his nomination is not dead. Since the Democrats control the Senate, Bedoya is still likely to be confirmed early this year.

The Winds of Change at the FTC

This shift towards partisanship is another signal that support for new federal privacy and data security regulations, which once seemed unified and bipartisan, may become a victim of the partisan divide. But the deadlocked vote over Bedoya's nomination was not the first sign of trouble. Instead of a bipartisan Commission unified in its goal “to engage in sound, vigorous privacy and data security enforcement,” Bedoya may be joining a Commission already divided by partisan conflict over the very nature of what privacy and data security enforcement should look like.

There is bipartisan support for the FTC's mission to “protect consumers from harms caused by unfair and deceptive data security and privacy practices,” and there is also agreement amongst the Commissioners that Congress needs to enact new legislation to enable the FTC to better protect the privacy and security of consumers. However, there has been little progress on new legislation from Congress and Chair Khan appears unwilling to continue waiting. In her statement regarding the FTC's Report to Congress on Privacy and Security, Chair Khan stated that now is an “opportune time for the Commission to examine how we can best use our tools and update our approach in order to tackle the slew of data privacy and security challenges we presently face.”

The Report to Congress and Chair Khan's Statement set off alarm bells for the Republican FTC Commissioners about what she may be planning. They expressed concerns in their dissents to the Report objecting to the extent that “the Privacy Report that could be construed as exceeding the agency's statutory authorities” and warning that Khan's proposed reforms may be guided by “misplaced priorities, a disregard for statutory boundaries, and the replacement of market preferences with regulatory fiat.”

The Return of Rulemaking at the FTC

One part of the FTC's Report that caused the biggest concerns was the suggestion that “the Commission should deploy all of its tools to protect Americans' privacy” including its rulemaking authority under Section 18 of the FTC Act, which has been largely dormant since the 1980s. Instead of waiting for Congress to act, the Report seems to suggest that the FTC may use Section 18 to go around Congress and make up its own regulations.

The FTC as the primary federal regulator in the privacy and data security space has relied upon its authority under Section 5 of the FTC Act, which prohibits deceptive or unfair commercial acts or practices. The FTC has broad authority under Section 5, but there are limitations including the evidence that is required to prove a violation and the availability of certain remedies for violations, including civil fines. In contrast, if the FTC were to promulgate new regulations under Section 18 prohibiting certain privacy and data security practices, the FTC would need only to demonstrate that the practices to be prohibited are “prevalent” and then the FTC could seek civil penalties by filing suits in federal district court against violators of the rule.

Earlier last year, the FTC released a Statement Regarding the Adoption of Revised Section 18 Rulemaking Procedures, supported only by the Democratic Commissioners, in which the FTC announced that it was changing its Rules of Practice to remove what it called “extraneous and onerous procedures that serve only to delay Commission business.” In effect, the changes made it much easier for the FTC to issue new regulations under Section 18. In response, the Republican Commissioners objected that the reforms make it too easy to impose new regulations and in a dissent by Commissioner Wilson, she expressed concern that the reforms would open the door to “aggressive, unbounded rulemaking efforts.” Commissioner Phillips, along with the Ranking Members of the Senate and House Commerce Committees, warned in an op-ed that the FTC's “lone ranger approach” to new privacy and data security regulations “would be a blatant overreach” and “a recipe for bad policy.”

Undeterred by Republican criticism, the FTC released a Statement of Regulatory Priorities in December announcing that in the coming year the FTC would prioritize new privacy regulations. In particular, the FTC intends to focus on developing regulations under the Section 18 rulemaking process that “allow the agency to recover redress for consumers who have been defrauded and seek penalties for firms that engage in data abuses.”[14]

The New Commissioner Likely Means New Regulations

New privacy or data security regulations would fit squarely within Bedoya's area of expertise, considering his previous work to ban so-called stalking apps that have been used to target victims of domestic violence and his stated concerns regarding the U.S. Immigration and Customs Enforcement's policies regarding the use of facial recognition technology and the detention of children at the Mexican border. Given his pending nomination, it is highly unlikely that the FTC would start the rulemaking process on any new privacy or data security regulations without his involvement. If Bedoya is confirmed, there would presumably be three votes in favor of new regulations, even if the Republican Commissioners are less inclined to support them.

Predicting what new regulations the FTC might put forward under a seldom used rulemaking authority may be difficult, but in its Statement of Regulatory Priorities, the FTC identified the need to curb the abuses stemming from surveillance-based business models as one of the most pressing issues consumers confront in the modern economy. In addition, the FTC has indicated that it is considering new regulations designed to curb lax security practices, limit intrusive surveillance, and ensure that algorithmic decision-making does not result in unlawful discrimination. In other contexts, the FTC said that it intends to “spend more time on the overlap between data privacy and competition” to ensure that they use “both privacy and competition lenses” when addressing problems that arise in digital markets.

The specifics of those regulations and how aggressive they may be remains to be seen, and it is possible that concerns over the FTC going it alone might be enough to prompt Congress into action. One thing is certain though, privacy and data security is becoming more partisan and is going to be a hot topic next year at the FTC.

CISA on Russia, Ukraine and Ransomware

Zick Colin J. — Sun, 30 Jan 2022 22:43:44 Z

According to the U.S. Cybersecurity and Infrastructure Security Agency (“CISA“), the potential hostilities between Russia and Ukraine are likely to spill over into cyber warfare. In this month’s CISA Insights:

Every organization in the United States is at risk from cyber threats that can disrupt essential services and potentially result in impacts to public safety. Over the past year, cyber incidents have impacted many companies, non-profits, and other organizations, large and small, across multiple sectors of the economy. Most recently, public and private entities in Ukraine have suffered a series of malicious cyber incidents, including website defacement and private sector reports of potentially destructive malware on their systems that could result in severe harm to critical functions. The identification of destructive malware is particularly alarming given that similar malware has been deployed in the past—e.g., NotPetya and WannaCry ransomware—to cause significant, widespread damage to critical infrastructure.

To reduce the likelihood of a damaging cyber intrusion, CISA recommends that companies:

Validate that all remote access to the organization's network and privileged or administrative access requires multi-factor authentication.
Ensure that software is up to date, prioritizing updates that address known exploited vulnerabilities identified by CISA.
Confirm that the organization's IT personnel have disabled all ports and protocols that are not essential for business purposes.
If the organization is using cloud services, ensure that IT personnel have reviewed and implemented strong controls outlined in CISA’s guidance.
Sign up for CISA’s free cyber hygiene services, including vulnerability scanning, to help reduce exposure to threats.

NYC Employers Face New Restrictions on Use of Artificial Intelligence in Hiring

Feudo Christopher — Tue, 14 Dec 2021 14:01:46 Z

As technological advances have given employers artificial intelligence (AI) based tools to assist them in the hiring process, New York City has taken note. Recently, New York City adopted a new measure restricting the use of artificial intelligence (AI) in hiring.

The law, which will go into effect on January 1, 2023, bars the use of AI-based hiring tools unless those tools have been subject to a bias audit. The goal of this audit will be to ensure that the AI-based tool does not lead to disparate outcomes on the basis of race or gender. Once the law takes effect, employers using AI-based hiring tools will be required to notify candidates that the AI-based tool is being used and identify to candidates which job qualifications and characteristics the program will review. Prospective employees will have the right to opt-out and request that a human review their application instead.

Employers will not themselves be responsible for conducting the audit; that responsibility falls to the vendor administering the hiring tool. However, employers will be subject to liability for violations of the law (including both the audit requirement and the notification requirement) for $500 on a first violation and up to $1,500 on subsequent violations.

In light of the January 1, 2023 effective date, New York City employers should use the coming year to review their use of AI-based hiring tools and to ensure that their use of AI in hiring is compliant with the law.

Requiring Robust Security for Financial Institutions, FTC Finalizes Amendments to Safeguards Rules

Fri, 19 Nov 2021 11:05:36 Z

The Federal Trade Commission has finalized amendments to the Standards for Safeguarding Customer Information (“Safeguards Rule”), specific to defined financial institutions, designed to strengthen security for consumer financial information following a recent uptick in data breaches.

The amendments contain four main modifications to the existing Rule that outline additional protections financial institutions must implement when handling sensitive consumer data.

First, the amendments provide financial institutions with additional guidance regarding developing and implementing an information security program, including access controls, authentication, and encryption.
Second, the amendments increase accountability by requiring periodic reports by financial institutions to boards of directors or governing bodies regarding information security programs.
Third, the amendments expand the definition of “financial institution” to include entities engaged in activities that the Federal Reserve Board determines to be incidental to financial activities, including “finders”—i.e. brokers or other companies that bring together buyers and sellers of a product or service.
Fourth, the amendments reduce the burdens on financial institutions that collect small amounts of customer information by exempting them from certain requirements.

According to Samuel Levine, the director of the FTC's Bureau of Consumer Protection, the amendments “detail common-sense steps” that financial institutions and other entities that collect sensitive consumer data “must implement to protect consumer data from cyberattacks and other threats.”

The amendments were passed 3-2 by the FTC, even though Rohit Chopra departed to head up the Consumer Financial Protection Bureau and the agency temporarily has only four commissioners. Pursuant to the FTC's arcane rules, if Chopra weighed in on pending proceedings before he exited, his votes continue to count and the Democrats continue to have a “majority” even though he has left. The agency's rules do not impose a time limit on the release of votes cast by a commissioner before they left the commission. Chopra's replacement, privacy expert Alvaro Bedoya, has been nominated but his confirmation hearing has not yet been scheduled.

Both Republican Commissioners, Noah Joshua Phillips and Christine S. Wilson, dissented from the amendments. In a joint statement, they expressed concerns that the “new prescriptive requirements could weaken data security by diverting finite resources towards a check-the-box compliance exercise and away from risk management tailored to address the unique security needs of individual financial institutions.”

The amendments continue the trend of the expanded use of the FTC's rulemaking authority under FTC Chair Khan and follow the recent issuance of the FTC's policy statement clarifying the FTC's position that health apps and related connected devices are subject to the Health Breach Notification Rule, which requires vendors of personal health records (“PHR”) and PHR-related entities to notify U.S. consumers, the FTC, and in cases of certain breaches involving over 500 consumers, the media, if there has been a breach of unsecured identifiable health information. These actions combined with the increased focused on privacy concerns have spurred discussions about the potential need to create bureau of privacy within the FTC, which was wholeheartedly supported by David Vladeck, a former Director of the Bureau of Consumer Protection, during a Senate Commerce Subcommittee hearing in September titled Protecting Consumer Privacy.

Regardless of whether or not the FTC creates a new bureau dedicated to privacy concerns, companies that collect or store consumer data should expect significantly increased scrutiny if they are not safeguarding the data. If you have any questions about the FTC's intensified focus on privacy or about your companies own handling of consumer data, the Foley Hoag privacy team is here to help.

Biden Administration Focus on Cybercrime Continues with Israeli Companies Added to Entity List, New Export Controls, and Cryptocurrency Sanctions

Mirenda Anthony D. — Fri, 12 Nov 2021 13:37:08 Z

On November 3, 2021, the U.S. Department of Commerce's Bureau of Industry and Security (“BIS”) added two Israeli entities to the Entity List due to malicious cyber activities. In its press release, BIS stated that the designation of Israeli companies NSO Group and Candiru was based on evidence that these entities developed and supplied spyware to foreign governments, which was then used for malicious surveillance, including targeting journalists and activists. This addition aligns with the Biden administration's increased use of the Entity List to target human rights abuses, especially related to cybercrime and unlawful surveillance. A Russian entity (Positive Technologies) and a Singaporean entity (Computer Security Initiative Consultancy PTE. LTD) were also added to the Entity List for selling cyber tools used to gain unauthorized access to information systems. While the addition of Israeli entities is not common – the vast majority of entities on the Entity List are Chinese and Russian – Israeli entities were previously added to the list in 1997, 2016, and 2020, for a total of12 entities to date.

BIS uses the Entity List to restrict the export of certain items subject to the Export Administration Regulations (“EAR”) to certain end-users. As a result of the November 3, 2021 action, BIS has imposed a license requirement for the export of all items subject to the EAR to these entities, including EAR99 items, with a presumption of denial, and no license exceptions will be available. The BIS Entity List is distinct from the Specially Designated Nationals and Blocked Persons List (“SDN List”) administrated by the Office of Foreign Assets Controls (“OFAC”) of the U.S. Department of the Treasury. The Entity List restricts the export of U.S.-origin items, while the SDN List more broadly prohibits U.S. persons from engaging in most transactions with SDNs. Entities on the Entity List may also be separately subject to OFAC sanctions.

Cybercrime has been a key area of focus for the Biden administration. On October 21, 2021, BIS released an interim final rule which adds new export controls on “intrusion software,” which are “tools that could be used for surveillance, espionage, or other actions that disrupt, deny or degrade the network or devices on it.” These items are now controlled for National Security (“NS”) and Anti-terrorism (“AT”) reasons. While items subject to NS and AT controls are ineligible for export to most countries without the exporter first receiving a license, BIS has also added a new License Exception Authorized Cybersecurity Exports (“ACE”) to allow for exports of otherwise covered items for legitimate cybersecurity purposes to many end-users. However, Group E:1 and E:2 countries (Cuba, Iran, North Korea and Syria), certain Group D government end-users (such as China, Russia, Saudi Arabia and the UAE), and certain non-governmental end-users in Russia and China are excluded from the license exception. Exports under License Exception ACE to Group D government end-users that are also included in Country Group A:6 (which includes Israel) are permitted only in limited circumstances.

As reported earlier by Foley Hoag, OFAC also recently released updated guidance related to sanctions and ransomware and also added the first cryptocurrency exchange to the SDN List. Cryptocurrency is often the payment mechanism of choice for hackers seeking a ransom to release a victim's data. Continuing this focus, on November 8, 2021, OFAC added several individuals and entities to the SDN List. The designated entities include Chatex, a cryptocurrency exchange, and its affiliated entities, which were designated for facilitating ransomware transactions. The designation also includes multiple digital currency addresses associated with Chatex. Digital currency addresses are potential destinations for the transfer of digital currency and are stored in a virtual “wallet” which allows the user to send, hold, and receive money. More information on digital currency, wallets, and addresses in the context of OFAC sanctions programs is available here.

Companies with questions about these new cyber-related actions or how to ensure compliance with U.S. sanctions and export control regulations should contact a member of Foley Hoag's Trade Sanctions & Export Controls practice.

OFAC Publishes New Guidance for the Virtual Currency Industry

Mirenda Anthony D. — Wed, 03 Nov 2021 13:37:31 Z

The U.S Department of the Treasury's Office of Foreign Assets Control (OFAC) has published guidance to aid members of the virtual currency industry (ranging from tech companies to brokers to users) in complying with OFAC requirements. OFAC defines “virtual currency” to encompass non-sovereign, non-fiat currencies that can be used as a store of value or as a medium of exchange—a category inclusive of most cryptocurrencies, including common tokens such as Bitcoin or Ether. OFAC views the increased use of virtual currency in the world economy as presenting significant risks that sanctioned persons could exploit to evade sanctions and undermine U.S. foreign policy and national security interests.

OFAC's new guidance follows a number of recent virtual currency-related enforcement actions, including the designation of cryptocurrency exchange SUEX OTC, S.R.O. on OFAC's Specially Designated Nationals and Blocked Persons List (SDN List) on September 21, 2021 for facilitating financial transactions connected to ransomware operations. (For more on OFAC's guidance on ransomware, please see our October 1, 2021 alert.) This increased attention comes on the heels of multiple recent Financial Crimes Enforcement Network (FinCEN) advisory notices related to illicit activities involving virtual currency. On October 28, 2021, the Financial Action Task Force issued updated guidance on a risk-based approach to virtual assets and virtual asset service providers to serve as a global benchmark. On November 1, 2021, the President's Working Group on Financial Markets provided a report to Congress on stablecoins (a form of virtual currency designed to maintain a stable value relative to a reference national currency), supporting the call for additional legislation to address, among other things, the illicit finance risks presented by stablecoins and other virtual currency. And in recent Senate testimony, Deputy Treasury Secretary Wally Adeyemo listed the growth of digital currencies as one of the primary challenges to the continued effectiveness of U.S. sanctions regimes. The uptick in enforcement actions can be understood as a part of a broader, whole-of-government effort to target vulnerabilities in the financial sector presented by virtual currency. The OFAC guidance is the latest in a number of recent signals from across the government that should put industry players on notice to expect increased scrutiny of virtual currency across the board.

Traditional Compliance Obligations Apply to Virtual Currency

OFAC is responsible for the administration and enforcement of economic sanctions programs as applied against foreign countries, individuals, and other entities. This guidance emphasizes that the obligations triggered by U.S. sanctions apply with equal force to transactions conducted with virtual currency as they do to those made with traditional fiat currency.

As a result, much of OFAC's specific guidance aims to educate the virtual currency industry on various sanctions programs and details traditional best practices for ensuring compliance with U.S. sanctions. Broadly speaking, U.S. sanctions programs prohibit engaging in or facilitating (without a license) a wide range of transactions and activities, ranging from broad prohibitions on all unlicensed dealings with certain jurisdictions (like North Korea), to specific prohibitions on transactions or activities with listed individuals or involving certain identified property. Consequently, OFAC's basic compliance standards expect parties to have mechanisms to avoid, identify, evaluate and prevent such transactions and activities. Although OFAC may impose civil penalties based on the “strict liability” legal standard, OFAC generally takes into account whether an enterprise has implemented a reasonable compliance program and how it responds to discovery of an apparent violation in determining whether to impose a penalty, and, if so, its magnitude.

Best Practices for the Virtual Currency Industry

Beyond putting the virtual currency industry on notice that OFAC is paying close attention to it, the guidance contains some specific best practices, including novel guidance on software tools that can enhance sanctions compliance. As in the past, OFAC recommends use of geolocation tools including IP address blocking controls for any platform dealing with virtual currency, as a safeguard to avoid contact with sanctioned jurisdictions. However, for what appears to be the first time, the guidance acknowledges that a simple geography-based IP screen may be insufficient, recommending that companies also monitor for known virtual private network (VPN) addresses, to prevent users from masking their location. Companies in the virtual currency industry will need to carefully consider how to treat VPN use given that VPNs are frequently utilized by individuals and entities around the world for legitimate reasons, including as a security and privacy measure. OFAC also recommends screening for “improbable” IP logins, where an individual user repeatedly logs in from different, geographically distant locations within a short time. In making these specific recommendations, this publication provides the most detailed guidance to date with respect to VPN use on virtual currency platforms.

Additionally, OFAC recommends use of transaction monitoring and investigation software, making use of identifying information associated with virtual currency transactions. OFAC notes that it has been including certain known virtual currency addresses as identifying information for sanctioned persons on the SDN List. Best practices include not only monitoring and blocking transactions associated with listed addresses, but performing extra due diligence by monitoring suspicious virtual currency addresses that may be associated with known blocked persons. For example, OFAC recommends monitoring virtual currency addresses that share a wallet with listed addresses.

OFAC further details best practices associated with “Know Your Customer” (KYC) procedures. While such regulations have long been mandated for financial institutions, this guidance recommends their application to the virtual currency industry where users often place a premium on privacy and anonymity. OFAC characterizes a number of user behaviors that may be endemic to virtual currency as potential “red flags” including providing incomplete personal information, VPN use, or failing to respond to KYC requests.

Implications for Virtual Currency Globally

The OFAC guidance marks an acceleration of recent trends in the U.S., with officials cracking down on use of virtual currency to evade traditional financial sector regulations. We expect U.S. regulators, including OFAC, FinCEN and other agencies, to continue to scrutinize and increase pressure on the industry. Whether attributable to the rise in ransomware attacks, or simply the increased popularity of cryptocurrencies, we expect that these moves will have ripple effects globally. Last month, speaking at a Center for a New American Security event, Deputy Secretary Adeyemo noted that the Treasury Department is aiming to work more with global partners, and is placing a high priority on multilateral designations related to cryptocurrencies. The President's Working Group report on stablecoins reiterated that the Financial Action Task Force (FATF) will continue encouraging other countries to implement the FATF standards for virtual currency as part of global efforts to combat money laundering and the financing of terrorism. Going forward, we would expect to see additional activity from European regulators given that they have traditionally been vigilant in enforcing KYC regulations and may be under pressure to increase enforcement. We would also expect to see additional sanctions designations in the virtual currency industry, as well as high-profile prosecutions for sanctions violations and/or facilitation.

Companies with questions about this new OFAC guidance or how to ensure compliance with U.S. sanctions and export control regulations should contact a member of Foley Hoag's Trade Sanctions & Export Controls practice.