Represented client in developing a comprehensive HIPAA compliance program for three health plans sponsored by the client and for medical and behavioral health clinics operated by the client.  This project required consideration of HIPAA, federal privacy laws governing substance abuse treatment records, relevant ERISA law, and state patient privacy laws.

Represented health care provider in responding to Office for Civil Rights HIPAA desk audit, including implementing improvements to existing policies and procedures.

Represented health plan client in responding to a data breach involving the inadvertent disclosure of PHI of over 7000 plan members by a business associate.  Also assisted the client in responding to the ensuing Office for Civil Rights investigation of the breach which ultimately resulted in the OCR taking no action against the client. 

Assisted a manufacturing company with operations in the U.S. and two other countries in responding to a ransomware attack, including coordinating with consultants on incident response and restoration of operations. Also worked collaboratively with the client’s legal counsel in other countries where operations were affected to ensure all required notifications were timely provided.