Privacy and Data Security

Organizations of all sizes and across all industries encounter extraordinary challenges in managing the security of their data — from personally identifiable information, trade secrets, intellectual property, and other confidential information. This critical data must be securely managed in compliance with constantly evolving laws and regulations and in a manner consistent with a company’s best practices. In a dynamic legal landscape, businesses need a legal team that can help mitigate risks and respond to the unexpected.

Taft’s Privacy and Data Security attorneys draw on experience that spans industries, practice areas, and jurisdictions. Our attorneys keep at the forefront of up-and-coming state, federal, and international privacy laws and regulations concerning the collection of personal/sensitive data. We advise clients on data privacy and cybersecurity issues, data security breaches, mergers and acquisitions, joint ventures, marketing programs, consumer protection, outsourcing, compliance and regulatory matters, information management, and information sharing. We help clients plan ahead and ensure the necessary safeguards are in place.

• Advise hospitals and physician groups with respect to security audits.
• Prepare HIPAA/HITECH privacy and security policies and procedures for health care providers and for business associates.
• Provide HIPAA/HITECH training for health care providers and for business associates.
• Act as outside counsel to a large academic medical practice providing guidance on HIPAA and HITECH matters, including advising on potential breaches and drafting notice of violations.
• Draft privacy policies and terms of use for websites and applications.
• Draft and review agreements involving the access, use and disclosure of personal information to address data privacy and data breach concerns.
• Conducted a HIPAA risk assessment and risk analysis for a large U.S. healthcare corporation with nationwide operations.
• Represented a large healthcare provider in a multistate data breach, including coordination with the Office of Civil Rights (HHS) and states attorneys general.
• Represented a large physician group practice in connection with a data breach HIPAA/HITECH analysis (breach originating with the vendor) and investigation, patient notification and HHS OCR notification.
• Represented a hospital in connection with a data breach analysis and investigation, HIPAA/HITECH analysis and advice.
• Successfully represented an industry leading company against a former employee who had electronically transferred trade secrets and other company confidential information prior to leaving to join a competitor.
• Successfully defended a company accused of misappropriating trade secrets.
• Drafted policies and provided training to numerous companies related to the human resources aspect of privacy and data security, including bring your own device policies.
• Drafted policies and provided training to companies relative to implementing reasonable precautions to protect trade secrets and other nonpublic, business sensitive information.
• Assisted educational institutions when student information may have been improperly disclosed.
• Assisted companies when employees’ personally identifiable information has been disclosed by a vendor.