Resources

Client Alerts, News Articles, Blog Posts, & Multimedia

Everything you need to know about BMD and the industry.

CLIENT ALERT: Ohio Incentivizes Cybersecurity Measures

Client Alert
November 15, 2018

On November 2, 2018, Ohio’s Data Protection Act (“DPA”) went into effect.  The DPA incentivizes Ohio businesses to proactively address cybersecurity and data protection by providing an affirmative defense/safe harbor for claims related to data breach. However, the safe harbor is only applicable if the organization can prove “reasonable compliance” to the DPA.

Brennan Manna Diamond (“BMD”) can assist your business by creating written policies that demonstrate compliance with Ohio law in the spirit of the DPA.  Additionally, BMD can educate your organization as to implementing and adhering to those policies.

The DPA is the culmination of Ohio’s efforts to foster a legal, technical, and collaborative cybersecurity environment to help businesses thrive. The only way to reap this benefit is to meet its requirements.

How to Comply

Any organization maintaining personal information of Ohio residents can be subject to Ohio’s breach notification laws and potential civil liability for data breach compromising such information.  The DPA rewards proactivity vs. reactivity by incentivizing businesses to implement policies and procedures to protect the security and confidentiality of personal/restricted information, protect against any anticipated threats or hazards to the security or integrity of the personal/restricted information and protect against unauthorized access of information that is likely to result in a material risk of identity theft or other fraud. Businesses should take the following steps:

  • Businesses must determine “reasonable” security measures. Such analysis must consider:
    •  The size of the business;
    • The nature, sensitivity and use of information;
    • The resources available to the business; and
    • The cost to implement and maintain the reasonable security measures to protect against a breach of security relative to the business’ resources.
  • Businesses must implement a cybersecurity framework and the DPA recognizes certain existing frameworks of which businesses can utilize in order to qualify for safe harbor. These include:
    • Industry recognized cybersecurity frameworks, (i.e., those recommended by administrative bodies, like the National Institute of Standards and Technology (NIST);
    • Regulatory frameworks required by federal or state law (i.e., HIPAA, Gramm-Leach-Bliley); or
    • A framework that combines the payment card industry (PCI) data security standard with a current version of an applicable industry recognized cybersecurity framework.
  • Businesses must create and maintain written cybersecurity policies and procedures. Such policies and procedures must contain administrative, technical, and physical safeguards for the protection of personal/restricted information.
  • Businesses must periodically review changes in regulations and framework updates and must likewise update its cybersecurity program.

BMD's Solution

In addition to implementing industry standard cybersecurity frameworks, prudent businesses will create and maintain written policies as it relates to cybersecurity and data protection. BMD can assist in crafting the policies and identifying proper security frameworks so that your business qualifies for the safe harbor. The Ohio legislature was mindful not to be hyper-technical with the regulations so that businesses can still qualify for the safe harbor by demonstrating reasonable efforts to comply. BMD can help navigate these regulations.

In today’s ever-changing cybersecurity landscape, data breaches are at times, inevitable. BMD can also provide post-breach solutions including meeting applicable reporting requirements and litigation defense. As now enacted by Ohio, perhaps the best defense involves proactively investing in front end compliance.

For more information, please contact Brandon T. Pauley. 

Cybersecurity
Client Alert

Telehealth Flexibility Updates: HIPAA, DEA, and CMS

May 12, 2023The Covid-19 Public Health Emergency (PHE) officially ended on May 11, 2023. But what does that mean for telehealth, a field that expanded exponentially during the PHE? Fortunately, many of the flexibilities will remain intact, at least temporarily. This client alert presents a brief overview of the timelines that providers need to follow, but for a more comprehensive review of telehealth flexibilities and when they will endClient Alert, Multimedia

WEBINAR SERIES RECAP | Ending the Public Health Emergency + Post-Pandemic Check-Up

May 10, 2023Some may take the position that the rest of the country already returned to a new “normal” following the COVID-19 pandemic.  But healthcare providers continue to implement COVID protocols and navigate the ever-changing healthcare regulations at both the federal and state levels.  It is important for healthcare providers to take time for a “Healthcare Check-Up” with the start of 2023 and the ending of the Public Health Emergency (“PHE”).Client Alert

Sharp Rise in False Claims Act Cases - Navigating the FCA Waters

May 5, 2023Recently, on April 18, 2023, the United States Supreme Court heard arguments regarding the FCA’s scienter, or mental state, requirement. To prove violation of the FCA, the statute requires that a defendant “knowingly” file false claims for payment. The term “knowingly” is defined within the statute to mean a person that acts with actual knowledge, deliberate ignorance, or reckless disregard. Circuit courts are split on how to interpret and apply the knowledge element of the FCA, and based on the Supreme Court’s decision, there will be a large impact on healthcare defendants and their businesses as well as anyone who contracts with, or receives money from, a federal program. A broader interpretation of the FCA would unnecessarily target and stifle healthcare, and other businesses, for simple errors in daily operations. This goes against the intended application of the FCA, which was to prevent fraudulent activity.Client Alert

Areas of Opportunity in Columbus: Highlights from the Columbus Opportunity Summit

May 5, 2023On April 27, 2023 Columbus Business First held its annual Columbus Opportunity Summit, bringing together business and economic development leaders to provide an update on how Central Ohio is preparing for expected growth in the coming years, an issue heightened by the arrival of Intel at its 1,000 acre site in Licking County, just outside of Columbus. The site will be home to two new chip factories with room to grow to a total of eight factories and is a $20 Billion investment.Client Alert

BREAKING: Biden Administration Has Officially Ended the Two Remaining COVID Vaccine Mandates

May 2, 2023As of May 1, 2023, the Biden Administration has officially ended the two remaining COVID vaccine mandates: (1) the Federal Contractor Mandate, and (2) the CMS Healthcare Provider Vaccine Mandate.
Older posts