Client Alerts, News Articles & Blog Posts

Everything you need to know about BMD and the industry.

CLIENT ALERT: Ohio Incentivizes Cybersecurity Measures

On November 2, 2018, Ohio’s Data Protection Act (“DPA”) went into effect.  The DPA incentivizes Ohio businesses to proactively address cybersecurity and data protection by providing an affirmative defense/safe harbor for claims related to data breach. However, the safe harbor is only applicable if the organization can prove “reasonable compliance” to the DPA.

Brennan Manna Diamond (“BMD”) can assist your business by creating written policies that demonstrate compliance with Ohio law in the spirit of the DPA.  Additionally, BMD can educate your organization as to implementing and adhering to those policies.

The DPA is the culmination of Ohio’s efforts to foster a legal, technical, and collaborative cybersecurity environment to help businesses thrive. The only way to reap this benefit is to meet its requirements.

How to Comply

Any organization maintaining personal information of Ohio residents can be subject to Ohio’s breach notification laws and potential civil liability for data breach compromising such information.  The DPA rewards proactivity vs. reactivity by incentivizing businesses to implement policies and procedures to protect the security and confidentiality of personal/restricted information, protect against any anticipated threats or hazards to the security or integrity of the personal/restricted information and protect against unauthorized access of information that is likely to result in a material risk of identity theft or other fraud. Businesses should take the following steps:

  • Businesses must determine “reasonable” security measures. Such analysis must consider:
    •  The size of the business;
    • The nature, sensitivity and use of information;
    • The resources available to the business; and
    • The cost to implement and maintain the reasonable security measures to protect against a breach of security relative to the business’ resources.
  • Businesses must implement a cybersecurity framework and the DPA recognizes certain existing frameworks of which businesses can utilize in order to qualify for safe harbor. These include:
    • Industry recognized cybersecurity frameworks, (i.e., those recommended by administrative bodies, like the National Institute of Standards and Technology (NIST);
    • Regulatory frameworks required by federal or state law (i.e., HIPAA, Gramm-Leach-Bliley); or
    • A framework that combines the payment card industry (PCI) data security standard with a current version of an applicable industry recognized cybersecurity framework.
  • Businesses must create and maintain written cybersecurity policies and procedures. Such policies and procedures must contain administrative, technical, and physical safeguards for the protection of personal/restricted information.
  • Businesses must periodically review changes in regulations and framework updates and must likewise update its cybersecurity program.

BMD's Solution

In addition to implementing industry standard cybersecurity frameworks, prudent businesses will create and maintain written policies as it relates to cybersecurity and data protection. BMD can assist in crafting the policies and identifying proper security frameworks so that your business qualifies for the safe harbor. The Ohio legislature was mindful not to be hyper-technical with the regulations so that businesses can still qualify for the safe harbor by demonstrating reasonable efforts to comply. BMD can help navigate these regulations.

In today’s ever-changing cybersecurity landscape, data breaches are at times, inevitable. BMD can also provide post-breach solutions including meeting applicable reporting requirements and litigation defense. As now enacted by Ohio, perhaps the best defense involves proactively investing in front end compliance.

For more information, please contact Brandon T. Pauley. 

SBA Releases New Frequently Asked Question (No. 49) - Maturity Dates for PPP Loans

On June 25, 2020 the SBA released a new Frequently Asked Question (No. 49) concerning the maturity dates for PPP Loans as modified by the recently passed Paycheck Protection Program Flexibility Act. All PPP Loans received on or after June 5, 2020, will have a five-year maturity. Any PPP Loan received before June 5, 2020, has a two-year maturity, unless the borrower and lender mutually agree to extend the term of the loan to five years. Businesses should address the maturity issue with their SBA lender and discuss any available change to the loan maturity date.

Top 10 Signs that May Indicate Financial Distress

The business world has been turned upside down with COVID-19 and the financial disruption it has created. Once healthy businesses are taking protective measures to remain viable. The impact of this health and financial crisis has affected nearly all industries in some manner. Being aware of areas or issues where your company is vulnerable is critically important. We have identified ten signs to look for when evaluating whether your company has some degree of financial distress.

HHS Delays Quarterly Reporting for Provider Relief Funds

There is good news for providers that received either (1) General Distributions from the HHS Provider Relief Funds [link to my article], or (2) Targeted Distributions from the HHS Provider Relief Funds [link to Ashley’s article]. HHS reversed its stance requiring quarterly reports for providers that received Provider Relief Funds and PPP loan monies. The initial quarterly reports would have been due by July 10, 2020. However, on June 13, 2020, HHS delayed the quarterly reporting requirement.

July 20 is Important Deadline for HHS Fund Distributions to Medicaid and CHIP Providers

On June 10, 2020, the U.S. Department of Health and Human Services (“HHS”) released details on the distribution of more CARES Act Provider Relief Fund payments. After allocating $50 billion to Medicare providers through its General Distribution fund, HHS has now announced that it will distribute $15 billion to eligible Medicaid and CHIP providers who apply by the deadline through a Targeted Distribution. Applicants must apply through the Enhanced Provider Relief Fund Payment Portal. The application form itself can be found on the HHS website and is due by July 20, 2020.

DOJ Updates Corporate Compliance Plan Guidance

With the passage of the Affordable Care Act in 2010, all healthcare providers were required to adopt and implement a corporate compliance plan. Historically, having an effective corporate compliance plan in place has been key to defending healthcare providers in fraud and abuse actions by Medicare, Medicaid, and commercial payers. Over the past couple of years, the U.S. Department of Justice’s (DOJ) Criminal Division has increased the number of prosecutions against U.S. corporations, including healthcare providers. Earlier this month, the DOJ’s Criminal Division updated its “Evaluation of Corporate Compliance Programs” guidance to educate prosecutors on how a corporate compliance program will be evaluated going forward.