Resources

Client Alerts, News Articles, Blog Posts, & Multimedia

Everything you need to know about BMD and the industry.

CLIENT ALERT: Ohio Incentivizes Cybersecurity Measures

November 15, 2018

On November 2, 2018, Ohio’s Data Protection Act (“DPA”) went into effect.  The DPA incentivizes Ohio businesses to proactively address cybersecurity and data protection by providing an affirmative defense/safe harbor for claims related to data breach. However, the safe harbor is only applicable if the organization can prove “reasonable compliance” to the DPA.

Brennan Manna Diamond (“BMD”) can assist your business by creating written policies that demonstrate compliance with Ohio law in the spirit of the DPA.  Additionally, BMD can educate your organization as to implementing and adhering to those policies.

The DPA is the culmination of Ohio’s efforts to foster a legal, technical, and collaborative cybersecurity environment to help businesses thrive. The only way to reap this benefit is to meet its requirements.

How to Comply

Any organization maintaining personal information of Ohio residents can be subject to Ohio’s breach notification laws and potential civil liability for data breach compromising such information.  The DPA rewards proactivity vs. reactivity by incentivizing businesses to implement policies and procedures to protect the security and confidentiality of personal/restricted information, protect against any anticipated threats or hazards to the security or integrity of the personal/restricted information and protect against unauthorized access of information that is likely to result in a material risk of identity theft or other fraud. Businesses should take the following steps:

  • Businesses must determine “reasonable” security measures. Such analysis must consider:
    •  The size of the business;
    • The nature, sensitivity and use of information;
    • The resources available to the business; and
    • The cost to implement and maintain the reasonable security measures to protect against a breach of security relative to the business’ resources.
  • Businesses must implement a cybersecurity framework and the DPA recognizes certain existing frameworks of which businesses can utilize in order to qualify for safe harbor. These include:
    • Industry recognized cybersecurity frameworks, (i.e., those recommended by administrative bodies, like the National Institute of Standards and Technology (NIST);
    • Regulatory frameworks required by federal or state law (i.e., HIPAA, Gramm-Leach-Bliley); or
    • A framework that combines the payment card industry (PCI) data security standard with a current version of an applicable industry recognized cybersecurity framework.
  • Businesses must create and maintain written cybersecurity policies and procedures. Such policies and procedures must contain administrative, technical, and physical safeguards for the protection of personal/restricted information.
  • Businesses must periodically review changes in regulations and framework updates and must likewise update its cybersecurity program.

BMD's Solution

In addition to implementing industry standard cybersecurity frameworks, prudent businesses will create and maintain written policies as it relates to cybersecurity and data protection. BMD can assist in crafting the policies and identifying proper security frameworks so that your business qualifies for the safe harbor. The Ohio legislature was mindful not to be hyper-technical with the regulations so that businesses can still qualify for the safe harbor by demonstrating reasonable efforts to comply. BMD can help navigate these regulations.

In today’s ever-changing cybersecurity landscape, data breaches are at times, inevitable. BMD can also provide post-breach solutions including meeting applicable reporting requirements and litigation defense. As now enacted by Ohio, perhaps the best defense involves proactively investing in front end compliance.

For more information, please contact Brandon T. Pauley. 

Client Alert

Explosive Growth in Pot of Gold Opportunity for Bank (and Other) Cannabis Lenders Driving Erosion of the Barriers

May 13, 2022Our original article on bank lending to the cannabis industry anticipated that the convergence of interest between banks and the cannabis industry would draw more and larger banks to the industry. Banks were awash in liquidity with limited deployment options, while bankable cannabis businesses had rapidly growing needs for more and lower cost credit. Since then, the pot of gold opportunity for banks to lend into the cannabis industry has grown exponentially due to a combination of market constraints on equity causing a dramatic shift to debt and the ever-increasing capital needs of one of the country’s fastest growing industries. At the same time, hurdles to entry of new banks are being systematically cleared as the yellow brick road to the cannabis industry’s access to the financial markets is being paved, brick by brick, by the progressively increasing number and size of banks that are now entering the market.Client Alert

2021 EEOC Charge Statistics: Retaliation & Impact of Remote Work

May 11, 2022The U.S. Equal Employment Opportunity Commission (EEOC) released its detailed information on workplace discrimination charges it received in 2021. Unsurprisingly, for the second year in a row, the total number of charges decreased as COVID-19 either shut down workplaces or disconnected employees from each other. In 2021, the agency received a total of approximately 61,000 workplace discrimination charges - the fewest in 25 years by a wide margin. For reference, the agency received over 67,000 charges in 2020, and averaged almost 90,000 charges per year over the previous 10 years.Client Alert

Ohio’s Managed Care Overhaul Delayed – New Implementation Timeline

May 4, 2022At the direction of Governor Mike DeWine, the Ohio Department of Medicaid (ODM) launched the Medicaid Managed Care Procurement process in 2019. ODM’s stated vision for the procurement was to focus on people and not just the business of managed care. This is the first structural change to Ohio’s managed care system since the Centers for Medicare & Medicaid Services' (CMS) approval of Ohio’s Medicaid program in 2005. Initially, all of the new managed care programs were supposed to be implemented starting on July 1, 2022. However, ODM Director Maureen Corcoran recently confirmed that this date will be pushed back for several managed care-related programs.Client Alert

Laboratory Specimen Collection Arrangements with Contract Hospitals - OIG Advisory Opinion 22-09

May 3, 2022On April 28, 2022, the Department of Health and Human Services, Office of Inspector General (“OIG”) published an Advisory Opinion[1] in which it evaluated a proposed arrangement where a network of clinical laboratories (the “Requestor”) would compensate hospitals (each a “Contract Hospital”) for specimen collection, processing, and handling services (“Collection Services”) for laboratory tests furnished by the Requestor (the “Proposed Arrangement”). The OIG concluded that the Proposed Arrangement would generate prohibited remuneration under the federal Anti-Kickback Statute (“AKS”) if the requisite intent were present. This is due to both the possibility that the proposed per-patient-encounter fee would be used to induce or reward referrals to Requestor and the associated risk of improperly steering patients to Requestor.Client Alert

Property Owner Protection from Tax Valuation Challenges

April 29, 2022New legislation provides significant new protections for commercial property owners against challenges to valuation primarily by local school boards and prohibiting side agreements to avoid tax valuation changes. The Ohio Legislature has approved House Bill 126 which will go into effect July 2022 but will effectively apply to the 2023 tax valuation year.
Older posts